General

  • Target

    6727edbb5d6abee908851a8c5fd7b4aca6d664634fdcdfc15e04502b960abbc5.exe

  • Size

    161KB

  • Sample

    240910-cbwk1sshna

  • MD5

    aaca0b25fa85ab4507d3861697824343

  • SHA1

    527c1dc2a340dd48652aec14a6316c7af0ff74c0

  • SHA256

    6727edbb5d6abee908851a8c5fd7b4aca6d664634fdcdfc15e04502b960abbc5

  • SHA512

    4c1982d2781b174b33375f57716c89a425e2660dd40484566e1c56af2f00a258c14022a7eda76278cdb530ce67adc5f74dfc010651deaa14165dd54fb1add6f2

  • SSDEEP

    3072:Hp5SexkWi1Lbi4eTMlwDCnu/qfgh9zIeZGm:JvGWwbnWJ/RfI2G

Malware Config

Extracted

Family

sodinokibi

Botnet

33

Campaign

357

Decoy

parksideseniorliving.net

90nguyentuan.com

enactusnhlstenden.com

avisioninthedesert.com

lashandbrowenvy.com

satoblog.org

rsidesigns.com

pansionatblago.ru

magrinya.net

baikalflot.ru

bd2fly.com

business-basic.de

afbudsrejserallinclusive.dk

m2graph.fr

stanleyqualitysystems.com

altitudeboise.com

lexced.com

chainofhopeeurope.eu

bayshoreelite.com

mursall.de

Attributes
  • net

    true

  • pid

    33

  • prc

    thunderbird.exe

    synctime.exe

    dbsnmp.exe

    encsvc.exe

    isqlplussvc.exe

    ocautoupds.exe

    mydesktopqos.exe

    powerpnt.exe

    mysqld.exe

    mydesktopservice.exe

    outlook.exe

    mysqld_nt.exe

    firefoxconfig.exe

    sqbcoreservice.exe

    steam.exe

    sqlbrowser.exe

    infopath.exe

    thebat.exe

    msaccess.exe

    mysqld_opt.exe

    tbirdconfig.exe

    visio.exe

    msftesql.exe

    excel.exe

    oracle.exe

    mspub.exe

    sqlservr.exe

    agntsvc.exe

    onenote.exe

    winword.exe

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    357

Extracted

Path

C:\Users\u30dmlb-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion u30dmlb. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3E3E26F248429149 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/3E3E26F248429149 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: HHpkYRAp7ELA8F/JvQ+X+harEIi2bAagHisMJToD61j9vMk7bqeK+aO4T2YGWStw JOjdAJ2kJed3yCa6kpMht9+Fen22jolkgm69zY0wq/fPeFhX6lD4naLbnI36+2gd qpRYYTQ/k6DmJseev9LWwvyC7j7/sjAvMd/s5sPLsG6mpMCDZX5KYhZsdUjW+PYp EuLlG8wOGFLX0lT0Gbj0XUftfR4ITpWaO9uCSIDQS177mSwtY0cNBrNQm/7ejvkq DB8UkoXTiMoXJDvjIFRA3A+u4aZO2aSja6LlhfjZp1CYLgtSNeoxuwzkaJDy3CQ/ Q1APwCr4r0FWMaPaAxq2QJlI8cDLv4+b8oe/4aa1YA+YVaIpfAg4SMG39LfTDNbj sPooJm3tXT9wMbapUZSIOfUHSdRl4JIgQSZ7O5DFQcelfglxtrhEzOuZPuRQQ1cf 4YYHxpztSTEdtflt5J2vC3AT7y7rvXD6oIWxAirw6W1ip3kF/6GHJJfU5kuyrxin BAOq3oyBbi9sDjCbQXpg0Rf6xZR81qtkd2OJbxG+ozjuvyfNqBsPc01J6MkDbK8v u3S1IS7llN/+6UrvgxeH/J8zw0Gw1+1/jjbrPcTsX8ptRff5fQ4CO92cE4tgbS5m w8hb96SmRvL2ZwvzeDZCJlFtQMQkPLqR8vtTM1uShTXJbjzh8mfApTv4jpOSlqlj LLxGa0a4+bNHpOmxJyUAzKDiFOd41518pI/4/tvW8CZ/2k6oboOeFGTP/ifwly+7 oaLqUHjMOv6x9E6c5md4SSQVNwEHQU+k/CteKgJDMPRezp0GFy9zkthsfi493Dex 6vYZMvqmGbfgmveI5Sek9ZPAGgQGlPCKqd4ldJ4ZHtlxjH5Hc2NdKzwkWEsQMa5Q cxeVwq47IoSptQH4pQ2AgQ5e/56YwXpE7b3nVzipEKUYHsLm16HGXml/zaaDQ80m wN57Jc989N7T1d/aJo7Oxv6Gx618B5+rcmgVkjl2vyQ3S6hqZlWQQJhW8kf+bsXx 8pJX8vbVVGxfX2M0TWZ45/jxUq8Q99DiXK9Kdu5q2KQiHAR+iTuiAYOXML9q8UUO WcKx6/YChRbgrHjmC20iFrF6WOxyRtGr3aRtRmiUKBs/HyE68JYNXcCKKwLkd3s3 QHJmWgHaGfyE3hci1qOWIvM1Am+wyCQcTpxCjTm17XdtLNcDwWy7Y3XLDrgbZcu4 9qsyYwbpQSctjMzY Extension name: u30dmlb ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3E3E26F248429149

http://decryptor.top/3E3E26F248429149

Extracted

Path

C:\Users\613bo4vue0-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 613bo4vue0. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/ECBE2D33F52C643F 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/ECBE2D33F52C643F Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: z321p+mi96m2cKX0bno4ypmiD1a6MK0nSA+NvIQfmceCzTag/TwhqF+2LzzFlQOd 7Mj4EeqnoRHDA/ByLD+DGAz9/v8jPxn8jHNC8mOT5qRrIrosMXIPwXiCR9kMng9g o3giitMun42MmEkoC95VBThRP5hcGxwkLFLYWFtlZLnVirDhPAMzuCXyxmkGLjBg 7H+cutcAlrPgBJ57o5GeehRr04alJrdHJJUOTR48PCm2XhbznLRXYEU1USTGQQ+5 bo+0OKmEcE8a0TkxkHSXtPB93IkOENaKyxMVRPm4wKwk5xWJ9C0OobiCeaV2UK1e UFWpWqB50vTppx23IwtsBeXUxbTI+S3bnSt82EcwbtOlLou0HqXPfRRbq/5GkNlS 5suZLB6XxEHlWS9rjrePvzuEwBPXotFinGR+I25Oyk58RNN87sJyX2gRY43eJoyP eD9hndtSTwHihkZW7vnFuhVQ0ptWuFmPZelQ7oxWrMkeyKjd7Z22fR+gB/yUbJha 9gyMVEkmAwrdQXiaREE5I/BBYTzzsGP5Ndo2N4kfHysh1IV70jn03P+HWVXSfVXS khCpRf4ZhFFXMIzjreWfAJQd1j283f0DQ4P3Eqg62LFHUtBKh83qgMpI1fTHJ7g5 kjVP969LkQoewiDqmzrkXbn4xHfVxxNliAhZ8DjJZLilNYyNOedGsDCvlZW+tAUO P/fq3uNiCCtwKNdxKvyez7NObpXDsUdjYhEy65USP+to5la1E0TGNsTAO5idazQj rZVsah9c39cbMY7r0CzOVyZM9vsda47R9zhQgFOCMN7pxI6/ut30XpuKks+bIK+B nvXQrAvHSGq7/N9QP8riXbohrdhKSfWcsO+IQ0lSZPcjD3opO9S39wYhYEtLdABW mfhjFBunpjCLa+gYlMKUjhlTxudsmB3TkXzEG0L25yBm8XX3vE/c0BygWX5I5hhf SYoqv5ecQ7P2CBjUtC1NzZwUrEGPmnugxMnX+GuneZDnEb/PLHa3Zxw7+9Ma4nkh qNXjpeq6HNde6zsiEtsslIVKwKVleSZNfO6RSo78G54nqEOd6HXqAhazJlg/JM3K /trQqJdaiY/JLlNLfnCcmAfY8JEMn+UFR01lTfZatqTD/4AY+jP56RFh3FbNxJ4j 22gtH/y0jwH/Y2BbHTrtqaEPvwoUCaWZbJi1PDAKRCFWX/gUmYrbl0nL25E+J/b5 SVrycdEwyNFFTE+uylSRY5S8gflffgrp Extension name: 613bo4vue0 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/ECBE2D33F52C643F

http://decryptor.top/ECBE2D33F52C643F

Targets

    • Target

      6727edbb5d6abee908851a8c5fd7b4aca6d664634fdcdfc15e04502b960abbc5.exe

    • Size

      161KB

    • MD5

      aaca0b25fa85ab4507d3861697824343

    • SHA1

      527c1dc2a340dd48652aec14a6316c7af0ff74c0

    • SHA256

      6727edbb5d6abee908851a8c5fd7b4aca6d664634fdcdfc15e04502b960abbc5

    • SHA512

      4c1982d2781b174b33375f57716c89a425e2660dd40484566e1c56af2f00a258c14022a7eda76278cdb530ce67adc5f74dfc010651deaa14165dd54fb1add6f2

    • SSDEEP

      3072:Hp5SexkWi1Lbi4eTMlwDCnu/qfgh9zIeZGm:JvGWwbnWJ/RfI2G

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks