General

  • Target

    c4f6fca09af28473aac8647fad42734e_JaffaCakes118

  • Size

    164KB

  • Sample

    240827-pal2ea1fmk

  • MD5

    c4f6fca09af28473aac8647fad42734e

  • SHA1

    564f41f54b76b850491259cd71ab0ade9a6d18ac

  • SHA256

    0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018

  • SHA512

    89f758dbbae7c8cec596343316e121b635b5268866517c7c754b3919b074bcc82cfc006851127662e978f0d234d91f0e061cd5449e29dfd38936fc4358cabf85

  • SSDEEP

    3072:VY+/DEGmOECUR5ai2XGmSQEjv5TpF+OjN57YEWeVw:VY+gT/Cu8i2W5jh7xz7B

Malware Config

Extracted

Family

sodinokibi

Botnet

35

Campaign

1546

Decoy

purepreprod4.com

ravage-webzine.nl

smartmind.net

creohn.de

betterce.com

aslog.fr

hostastay.com

leatherjees.com

5thactors.com

akwaba-safaris.com

corporacionrr.com

dmlcpa.com

operativadigital.com

boyfriendsgoal.site

apiarista.de

imajyuku-sozoku.com

gatlinburgcottage.com

davedavisphotos.com

theatre-embellie.fr

aberdeenartwalk.org

Attributes
  • net

    true

  • pid

    35

  • prc

    ocssd

    ocomm

    outlook

    excel

    tbirdconfig

    thunderbird

    ^qb.*$

    steam

    msaccess

    dbeng50

    sqbcoreservice

    winword

    dbsnmp

    ocautoupds

    encsvc

    mydesktopservice

    wordpa

    isqlplussvc

    xfssvccon

    ^.*sql.*$

    agntsvc

    thebat

    synctime

    onenote

    mydesktopqos

    mspub

    visio

    infopath

    oracle

    powerpnt

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    1546

  • svc

    vss

    veeam

    backup

    sophos

    mepocs

    sql

    memtas

    svc$

Extracted

Path

C:\Recovery\z475ow-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension z475ow. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D3535367E0982F08 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/D3535367E0982F08 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: LaVFyvqSDB0lQkKyWrfxMyGRkpPggikDKrOMfOMwTsST1W91Sk8GttHW9WRtIzJe 1xqEMgVn2S+rlktVDPld3eBEFsnxFds2PZAWX4ClrK1tgqmTvOCahhbAmFXym479 +7GQqYXM6h9rP6UjngzoqfF8oW4JjqzxB5GJCLHlRm4l2M9o28gEgvTspU3bjdcN obY7q9pSgbFavqG5Rxx3NfQ5yrv6750n13tC0ebkMe0ImwFhmhW/k01H4gRU3kk/ SRgd/MiFzZvGMaInwSA6ldIIgVduDHDFNdOOhrY0143YvMfactnHMIMYcdhzhpJC G9lfHAhQu/+e2ick6pyoVgyuioOzccW2kkdtfOaTsqq4aiapbAZAFTMuknsSOgcx SniFIiRNNS+qrn96wF3ce29fdPPcfbVI5hhAIIrIxQNGY3GH6+5OVLbNYD48wlIb cuUPnZjPZT6pSdObslXlrnHSbCYsSlefIjpUTLpq364vkuAk+NCwhU73t2MZ7NYU orAzcst1SIMu2Xjo/GORcFjcy70+J3OE8j7hOj3Ycjnm853+nSruw6SiuMXAHR7m 3VXtO9erdJHKX3NJ5jwLsJq0lbxp8ipN6krLgOH4OAXzvHnayFMYG1ni0z+PVjAE MbmEdENYcw0mb/smZGYVXlr5ZiSVZG6eM0dWw0/w+2ZwJC7dwBIY+Yz8aUUU/wJQ OMr76w/BlAci+zpoVCMwyP0s84wIDj1AruJoGxmkDeBGs0zxerbPiHe+kY7RBYm1 20A0pLbYZsvbPaTnTnPPj1UqBtNoNBwKG1iy24suGq4oDvPqEJi/TdOBPK1xJlKs WHX2JYpIWr6Ll+VGSNQvk/5QTxBB1KmA5Jgy58y0CGy3RXTPMilNpiSngsZScVH3 untB1VF7eX6dNoO1C9I9fxRJkxFTr+WHVcOv2XTdPL0oILsdvtroY2Vsrv2fX8+G M+5RirGe7+Vf7MFrwFf8AbL0Hiah59gXLei2lSWQJY8BMbUtnNRIKlwf6KrHV2LQ 9TyYOEpsLr6WCshsqFx0L49QxI0UimTz0C68QF4o9tUx+cMUUmJmibsQUv3TwBgV mxuxEiwrFww+9BDTcMl29VDWKSSTNISf2ogOJ2hkFAmo8wJfJTfKXBO1lVcgm1kI /R/yAjfkIlRSK9D/BhpIFL2riqgym/Y7dfAfadE6GlPkIo2r0thaDxcCPSH6XTdR Vv/ToADJlZaSIzFp Extension name: z475ow ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D3535367E0982F08

http://decryptor.top/D3535367E0982F08

Extracted

Path

C:\Recovery\36a36k-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 36a36k. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/843217B2BA12E2FE 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/843217B2BA12E2FE Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: xSnp00Y2aBnovvErdVjc9Ma/Y4YIxKWQMM3vPbUZYivg0u95MWAa+sQad5JHsQDX Bf1/UhdZvqf1SYqD2kyhA1QLOgEtruqeKqokouN+jgkBXXaWm2B4cl8pjBPpnlpT KXP/HOBgtLc8okSP/XkQFBn4oTaoh6bruL0UZhhtUMmFzZewYym1AADHuIKGd0Zu dGKHFMIkwf9t6oNsAj16lYPAnPXkl1HSMdkL0oWRhV3L5oeWioYTOvomhWRUWaHT 1Dj0QkyZkUwKe/LtpDtvwBfm+0C1VtPV580c6m/OeC56KwBK95VK1dEl7dOhBAhW DxorqvStGVJ76kxDNiGB+LSlI25BtVoT1J6ot26z1rzsHfFqlk24YvaIl5pxfiFi z/R470i7IZyZXPZmMwNMxweAU0ensNDzmPbxXtvnf6JF38m9DjV1Dw8oktdUREXW x8JQ6642iFVlMwLXXw7qNK2hcDiPItR6GEC7Frf2zuteEHRiPwoFnldqKh0d8zEn vjPBTNWFnOYvOM28Nf7dU9nUYL/b0x9wlKbcQxCUhmaDlv1DaFE45512DvDPgoJ4 mXO/DLxplXjUM62durPr5/92sXLoxS2FgR3LW046Zffgm/K+baldjsjgCfra81Yj d/WZPQgJdVwVD6j2IiavjqZZ1laiNT85IgxIhySTUSVjG/ux3UjxooPazQHQx7sw u2ZSv/iuzWLJBcmBt3j3Peh56M0jOGeNQsWP3QA2KmWt5NiZQBSuXYMNBWY0mM3l 8PUu/E0I/7Vok6GIx+xYVK0B+mPKs3tBLLQnYa2yLikAIe8vG+NkkjjUSOQ07loF mdVSa8bCh1KtTBjDSqzTYmgHeVPRhpZKWWdshLp96BiaBp02ty2EwlKSOvg+DyMk WCsJ/f16K0hRf2kDPn6uw5ElP9l9+y/jQtC0VBFvFiT3iE+BFAkz0+7jS0K4jhRZ u07FXJmHLbhkFyKMyakVUJQhvOlZFN8qr1IMvTLUFX/a3RCd07VUn171FpaxKHfd 0pgbOYwKMd6FIECFypNhdwC6Pim3C5Wl6tQyZI+kPVP+iSJu0W4aYbKnuF4j35gw 6Y7Ym2Mtmtnh5DQHzQj9eWCHrabmtXQAF4JpxBg5TcEDyqhW9x8/UKaRyEQGucm0 aATa497Q+9eLvCuRBR/iqlu1BIBqmOictpT5WG6H1KNyfxckLEZWfmVGKO2ETqow Jo0IwLUMHKLIAsTBtlySLyG8 Extension name: 36a36k ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/843217B2BA12E2FE

http://decryptor.top/843217B2BA12E2FE

Targets

    • Target

      c4f6fca09af28473aac8647fad42734e_JaffaCakes118

    • Size

      164KB

    • MD5

      c4f6fca09af28473aac8647fad42734e

    • SHA1

      564f41f54b76b850491259cd71ab0ade9a6d18ac

    • SHA256

      0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018

    • SHA512

      89f758dbbae7c8cec596343316e121b635b5268866517c7c754b3919b074bcc82cfc006851127662e978f0d234d91f0e061cd5449e29dfd38936fc4358cabf85

    • SSDEEP

      3072:VY+/DEGmOECUR5ai2XGmSQEjv5TpF+OjN57YEWeVw:VY+gT/Cu8i2W5jh7xz7B

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks