General

  • Target

    d4b649fa835be5c08224c91ce20d8365_JaffaCakes118

  • Size

    116KB

  • Sample

    240908-s9jxwawhre

  • MD5

    d4b649fa835be5c08224c91ce20d8365

  • SHA1

    85e111fdc51898b9057868f17a4a1496d00db689

  • SHA256

    f74c7a605588db80b0812de54ae0f5bf26fcaef8e7dce830a64cbeaddbac7673

  • SHA512

    62353357fa8f487502b7536fa5e4ac23d11116175d743f59a22eb05d10cf1a875d56f117a20afbc290037774b0d02be4c22b65675f442bc212eda1052b7735c7

  • SSDEEP

    1536:CPp8kFF4+utlznGEvCrUmUYwGOmpX2yaICS4Aa7AuJ/Opu5Sn1WTBmrQ0z0U4iq8:8vnuGqfGOqVBuJ2BWTN0VqaZn

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$JpdTOqVoVReuWvcF5cNXbeB5alHI5.h.qwmmxDTcmYadYLVhKN4QC

Campaign

5406

Decoy

piajeppesen.dk

coursio.com

helenekowalsky.com

bayoga.co.uk

labobit.it

vyhino-zhulebino-24.ru

brevitempore.net

fibrofolliculoma.info

teczowadolina.bytom.pl

pinkexcel.com

slimani.net

faronics.com

starsarecircular.org

xlarge.at

katketytaanet.fi

dr-tremel-rednitzhembach.de

officehymy.com

schlafsack-test.net

abogadosadomicilio.es

gratispresent.se

Attributes
  • net

    true

  • pid

    $2a$10$JpdTOqVoVReuWvcF5cNXbeB5alHI5.h.qwmmxDTcmYadYLVhKN4QC

  • prc

    firefox

    ocomm

    mydesktopqos

    steam

    xfssvccon

    mspub

    dbeng50

    wordpad

    oracle

    thebat

    sql

    isqlplussvc

    onenote

    visio

    ocautoupds

    encsvc

    outlook

    sqbcoreservice

    powerpnt

    synctime

    tbirdconfig

    dbsnmp

    agntsvc

    mydesktopservice

    excel

    thunderbird

    msaccess

    ocssd

    winword

    infopath

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    5406

  • svc

    sql

    veeam

    mepocs

    sophos

    memtas

    svc$

    vss

    backup

Extracted

Path

C:\Users\q64yx8at-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension q64yx8at. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/361B213EB262C399 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/361B213EB262C399 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: NSd1J9FnBCOS6uoV9PJXyHxb1VPcPdubX35FANfqYFWAu/08v+mslgoTh63qonL0 h7lUhbLKWp/ySqbKL4eNTYasq7rewtvLBvwC8blmxImEo56yLwBW8bFg2HKVh6Qh r+za87I0raGneKiOcV4Q7PRDsd4U9sgADdTrIB8uN+3xA8WdvDg2Yeq+oqlrbVJ0 IguzI4V00PZGNaDg4JJmjK+fcTwIFDddyyRJZ/8vqGTmVoQy6icAcjELeMUFasId xPM9R8paR0QBUj48KgPC8sYaxiTk5W6ZP22iHTK7QrHSAYkLq9TrohfrHU4RofF8 lRajWw1fgOU1KAOMCci7iPRKcH88DsEkDyOiIfiLPI9oQLCN+JFFCAzFUvHxpxfv qxLtlJZpv0fUxEZpntw1Uphs0kGzBhVRi1ShjKmYob1tFlTw7gFY6QWyzaFV/4b0 PUL5s7HY13PKH8OH+gdZnHrWXnSUrxcAk3fgRGn+QVXRULuT4DupXVtqR32BjPP5 7jXsZHBrVP3pvttthS8JdzPbSevtV8f9VrHzbWx7hiLXiB4LXLic3umFTJ8WELso bk8E7y7WTLmFJjr3RWtvfNdba3Ymiioj90CW+XEgKtVeZcfAi0zPlHxkYao/4qI2 4lNLoyzKYuuohP6wHKrDC853L90htNq1W3bxO9hGxRndZ639loQdWPNJb7WaxOlI 2YGN+KE53Kv1xTK0OlsaRIhoB9qyBPUIvV6GmFV4AVWulCJ+8ZwRXlmemvhtKykZ 6ioV8/gRyzG8MSixRKwMYBcDh609jYd+dKiatDhWrBEv+nw+5f/5UvJhlfLE7lb+ O38UJucdFgclOGpKWQlFcen+OEYAPCWxE7OpJHg2JRDDYMQ/kwlcbyzuqxIwruRE 2queYFEsHkH0DHR+YM+1unA364tnIi+lBl0VyNmsTn0jftiOY39V9fc+HDy2fXzx jCL/Her2tlzHsrhsCkI+8FOGP027fKuFXQSX1BnC9LLDQVzj05yxLPgDmkGBR1+8 UVO3XmOyX2I4XubbTMdUJCEmabGPfVY7mL0wT3Iw4QwfkQLZqMlThPX2MPTZI5G9 tFubz/VhQCRlLttLNtZJCqm00rMNqZtyNnJuQMel40vSi5+BgHeK4R3xfPIydUWl H1pIWIyoJt3qDMS8qVPcACfGG3HWBoe7/zUEEhVoege/ErdTTivmjIOj2O/q2Npo rzDuwJUNCMLHRr32Svi+gV4wuidHx28IZiStcmSTDzi93qdJ/9Ndd3XJkuXzkvgj /uBOMPjhhN50wB6z/1oo+hxa5WDtPvfKZJgdvDrYDXEkcn9w6g6D4MWOxrznGORU TxDeGgJ1Onb2Km2atUB/JqDN8jeEZvcnHdYziKXywzM8Ea+d ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/361B213EB262C399

http://decryptor.cc/361B213EB262C399

Extracted

Path

C:\Users\0b0rqlzk13-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 0b0rqlzk13. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/824273BC99598056 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/824273BC99598056 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: PTt5mVJgxeudu9BeeOfzOVf7raCOTnHh4LUcP1wyld93frHpbXcPcic0W23Dz2e7 qZL6M2/NPyh49Mou8VNR+54pcNUs2RoTN+ePs58e9EvBqJdvdaogcR+9JM/Ji+FR 3Bbm2JvdHOBdoESrRGHlXtfgfjdFLEETywVmMk1ia599EbUYlO8aIMPJD5F3OtaX 3btXkAtUnGsF3ul9JU3lQrQli/bBGlOA2PJSI4Bsa7Hn0eY2lv3PGcQD5M2NX+J8 qZkc4l55u4vljE1FaagEymVdu0ateBo8RbF8BtUQKFstHLxevctEXFiDniAG0zth 8UoVTyYvHQzi8NasMTj0NtfJgYpub1kVv81r7O8rQf5OZ2U9MprFjLB8e2f7zj1z 6cQyJWQKt2LKS0iIYuUI6YVQqa2gcp9CyXw2ir/YHcFyXpBS5aWt+NHOrGBLjxDK FbWqipe3Qy7IOzff8uHePPx0rPKM9UjvgAQIlrpvPX1juyGIjWSU1jemp6xSR7hl R8ihQR5rSO9ub1vLhBlie97xk7cPqayA35Ngsv1Zv+4t5sA9ZsMP4B3VfRHYZgMX uMH6uYHHF98vlsCTaosSxRJEEzLeL4S7z8mujwvN0NMduBIeDtH2lsVt2c88Knrg dF+5kwXFZ14BqPfbMP/mGRpabLrX2ClXVGH1c06IGbyfP1prwN4E7tRBqtn2g8Se v1wbk97pImaiSGWqXYFHtd4loGhG7PeVuL83X0dUmflXbj+uATHCrfj/TwdvLxl2 kIytMgt3uA/+KxTKr2RIg3sVbhywBrBOX/1ev3H6Bs4Dip7oAm09xEv856+pro9Y cwooPS/29vH6VTshXGIqQqEhdwe3PLXZH6C0baG2oRclxaQomNT68MBlITXOXoXI 3qvXDqvQ6ovddQuatDckXmBr2zYLjAHHxMW3sdlivjnazYBcAX8Q/Kf99Lg798SO Yb1xGU+2Sntgb+6P6mw2mBNehwter0aMmYsxhn2pv5iZ2gp9T1Z3ReewIUzIWEIh ShyRaVyPZplmLRj7/v9RCmz1p1PsSwBOdL0yCVBMGSwaa1fuPMw79CjLvKhOx690 XJmOoi6VYuhlHpayBhldxLMabpRwFOD0ucAy/HmUp8b9wURuvC3xB/as/6axInJl OPBrhR3Cj2RJ/dKNMi53phTYSFxKK7SLmerZ9X5ORS2rDoEGvZrGo/SgulaArTpN GdZD66xubLKAjcllo6oi7uCvVjPvv4q7nxef91gNZGCaGrIBj6+KEBew/BHJCeUV sXfjnqhgrVaeQ7VLdFKSELkmTuTXiaVRk1RTD7X3Vm2PQbtJEFQdS+tWG4tYlO2Q DBkvlqfx7BaCf6LrVLn0HFqUQ2KFtT/Jnwbw8MWfw6TLFAwRRjQq4CwywF7urw== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/824273BC99598056

http://decryptor.cc/824273BC99598056

Targets

    • Target

      d4b649fa835be5c08224c91ce20d8365_JaffaCakes118

    • Size

      116KB

    • MD5

      d4b649fa835be5c08224c91ce20d8365

    • SHA1

      85e111fdc51898b9057868f17a4a1496d00db689

    • SHA256

      f74c7a605588db80b0812de54ae0f5bf26fcaef8e7dce830a64cbeaddbac7673

    • SHA512

      62353357fa8f487502b7536fa5e4ac23d11116175d743f59a22eb05d10cf1a875d56f117a20afbc290037774b0d02be4c22b65675f442bc212eda1052b7735c7

    • SSDEEP

      1536:CPp8kFF4+utlznGEvCrUmUYwGOmpX2yaICS4Aa7AuJ/Opu5Sn1WTBmrQ0z0U4iq8:8vnuGqfGOqVBuJ2BWTN0VqaZn

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v15

Tasks