General

  • Target

    e0f59603265d8e99b26a4fa1ba3cd3ab5184a9ae29334201cf65df827ac7019e

  • Size

    75KB

  • Sample

    240910-v358msxbmh

  • MD5

    d7a176a7e268b60cd23949a2e6daa143

  • SHA1

    70c5fc6cd5def4ca59c0ca8949f7e93e0be789db

  • SHA256

    e0f59603265d8e99b26a4fa1ba3cd3ab5184a9ae29334201cf65df827ac7019e

  • SHA512

    75a1fea76d650f4adb7a1a44882e73aa2ed76db84e33115341c2e12abe3e3057e6b5c16147024162761fe63929c73be46841910feb35645f0e0fd2c80981bc57

  • SSDEEP

    1536:HyOigpB2A341qOMsD3G+jhAN4avOgmBCrTB3Zz5OT7u7zVz:j5v2opOpD3G+j6N/OfCp3R5y6HB

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$9X0ij8YXhqjLO.H2cLhF2e3Fi/GoedSCGNJn/pT25k02Zpd70dBQm

Campaign

5079

Decoy

perbudget.com

balticdermatology.lt

dushka.ua

naturavetal.hr

directwindowco.com

aglend.com.au

teknoz.net

celeclub.org

kaminscy.com

gporf.fr

2ekeus.nl

chatizel-paysage.fr

sauschneider.info

nacktfalter.de

cactusthebrand.com

philippedebroca.com

katketytaanet.fi

haar-spange.com

uimaan.fi

nmiec.com

Attributes
  • net

    false

  • pid

    $2a$10$9X0ij8YXhqjLO.H2cLhF2e3Fi/GoedSCGNJn/pT25k02Zpd70dBQm

  • prc

    encsvc

    thebat

    agntsvc

    powerpnt

    xfssvccon

    steam

    ocautoupds

    synctime

    winword

    infopath

    mydesktopservice

    dbeng50

    outlook

    thunderbird

    mydesktopqos

    sqbcoreservice

    onenote

    ocssd

    ocomm

    isqlplussvc

    oracle

    visio

    firefox

    msaccess

    sql

    wordpad

    mspub

    excel

    tbirdconfig

    dbsnmp

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] WE ARE READY TO PUBLISH UR DATA TO PUBLIC ACCESS IF YOU NOT CONTACT US (USE TOR BROWSER TO VIEW) http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/posts/125?s=7ee0235fc7f67403393ad971dea5809e [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    5079

  • svc

    sql

    memtas

    sophos

    veeam

    svc$

    mepocs

    backup

    vss

Extracted

Path

C:\Users\062wu7hg09-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 062wu7hg09. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] WE ARE READY TO PUBLISH UR DATA TO PUBLIC ACCESS IF YOU NOT CONTACT US (USE TOR BROWSER TO VIEW) http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/posts/125?s=7ee0235fc7f67403393ad971dea5809e [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/694BD48044843E06 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/694BD48044843E06 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: mpCyHP7jTZPu2OV/Eh24bcHNQyJKaamlMRGUL83tuXObQKX3NJaDFDwY/QXJxAWd VJGDGwDgWbAjgzMQWXKuy0pMnRUMams1Ag+vk+m39Yvle2RhXPJh28iO5c/qgX6h LIJJ9fYFC3NMVNYNtaqrGS9tarCQ69feaBvLYkO/8R1pR8yLg5gybz00AV1j07FK c/3tmWrPHrwMbBfZiU7GEIoJ9ngD0Qz+upUr/+6v5vLEm/Wl1LLVSdgY3XT9yUPN ZMaN76MKHKf/RoQPRbRC9nUJjN0w+I/BJ+NERJjMujzQkQG2FujPiBcsmmym/nwA XLx0kaQ9oK9CLy/32+doYNIfJXNPWwAah1MIHn2yfSOPxK6JtgB5Cl/skIiAG0f7 GmlVroqzsFdD8vF959WaIpNxdt937IMOaCGUfdCbQZs6EwqSHgPEv+fSVwA9MtVV iq4wDNN8nWiDoNqSHv3cBESWmOt6QdxiGJuVPHrZFERYpirE3KZjy5l0vyfK8jHM lfCWokauRJHnloUPaYhdxFlgA01UdZNOAuFKK24LaG8d8JvRCl8X/gEZ3fzkcMPv /QIzCIOUw491oa63LG3R41MOg+UvlbQre2qsg4bc2D3oVTK4eDqo3Cch9mRVn2EU cjC0pLE37NE/WbLOpnDrThsL/gPqcRav48Fh+Kieub/rAbsNyijjaVp3GiAsEp6M wbY1ipmidgFdySsj54kvdCZbTuvhA/m8b1IxhYb2Cii4Sdz0ACvce7WTg/AqMI0t A0oAZ+PcpD96TzcT8ImqDpsQPV5DsyS2NPpj8ryTFejWp4CqrdIiAc6xrVM3Muv3 00V9a9k0O5ez+x5MyhdYPm9AXGuArg4rXwE2iGmH9Um44OgV+2sgGkEcILynf/N5 EtwhXkoUZR4Tdk15BlDqQl6mMoidu6X1zKaTCZCz4dC7ra+ukcWvB2A8Ix/G1UGx u6RSZv0TaTXwHLg+yCjKdZ7gyn7lYoUOCAv76+MkKyphjU7KlIy9uvCMSudu29OY eS8cxLsnFA8bQ45quJrgv4BfH6qpuDh2ityf3esZ5zuLorTERiiRr3elGo1btn9e Zzx8mRNnUP3KlaVPCj5W4Xa6yVxtWtA+3aWiLSvSMshKrObSR7F8VSazyP5KVtwO iSNGjlRpXAW1r+PIbnvUj0Ov5WrOXiLIkHLzK85H/ux1BQNt6yRFlOvrWCtyJZYU 9SceFcPyg2y7z2h7lSlNBXB4Ab8l8x+xxnwpteC4aBADvqmkYH/KJq3KS4zk9HXf bTbZKi6HrI9zm/O+kOHbi/deu710DyWr2t4L8+u0hgoXWKxfERWS6N6RlW2cq5In XR7s1okIaRBuVA9W2TL0x/cAMBc6lTCKAlie/8j6GDqnsWBL2qN4pQ== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/694BD48044843E06

http://decryptor.cc/694BD48044843E06

Extracted

Path

C:\Users\3805xd4j-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 3805xd4j. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] WE ARE READY TO PUBLISH UR DATA TO PUBLIC ACCESS IF YOU NOT CONTACT US (USE TOR BROWSER TO VIEW) http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/posts/125?s=7ee0235fc7f67403393ad971dea5809e [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/EE655257CD8F4ABD 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/EE655257CD8F4ABD Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 14yIEPlx6c+xr/NT7OT0lZ8z7O+ZJXKB8SFee1FfR5MBx5tUftJOuqnMGIFq+qkR hFnqtVTKt1zMQnoQ7gvE/9qmPLrIcg0GT8oV2NFpjdD7FY0dU9tg4uBvtw4Ki7VP l7MrSOozcLTTMWuaUn7k9Zuv48slKsALWFSelkDVCeYaw6xlZXBcM57fJq2r7XAQ zB+aGH6Aw6Y2OrXJzWgWcQ6P1dCVXp+ZX1uGjScFyTpmYK/+m+h6Fyzj4/jUpa5h MXrdEbszATP2lSFjdvVPmaByY/+VzxSJiJ4abcRnKEud0M66/sFVHtn4DrdvD74d XIrWXPs9DveTIR0VE/xKuF11r/f4axWXAIrJ/E2vPZ+fs/t4cyVtwB/IuTeRslAE RjhUlJpSIuRq0JsOEYbYXuDW2Qmmkn7fMRf3S2xxkXxuKglsYEUBZPOf0iRfruzO fMN4D6ve0nHS4518t4SCRHkcNtPXJbP5Y5tFl4Dyn2MT0GUpAC1QOv767FFDFIIm ORROxl36kyOHOvYQ58ZaX61NHPt1uFQxn+Boe1GqhFpnnniEtsA7/0jxlkj6l15x i2+Tl5P+8D/UibaayFSFGfjN8QfOo3sRn/k9Zw2F3aXLHVfEmDWxWBwsq6jwmgKC Fys3etwDcdqUXTc/ry/StE1h85jYKKEm0b/6186Ay7nD3BRE+FJAnJ6wym8uPuBI TlnyCWNvJc5aWu+xDOHkV+VO3K5mU+Z+oawvQpAt1ZSqLmmD5XXSAwMtF1HmaKtD +SuZlg238ivxQSMSanwzpbde4bCSrV0ERUqVxCRhSgNt0ot012z/rWAUE8GdzfYi EVJHxhtEEwKMKK3waxtDX/wORavyWadi8rH/qx4n9I5tPjpgIHtFmOTqxa4f0z1r 572wLdQ7aR9LZIoedOd2L5dsURdIn5pc8VyQzj6zqAI5oCGzYKI2FO/+7tq3vxlh 3pCdzJ8xCcux9MnINvGoj9UbffJ4wSVk3KwLExuBUi4iAyPy2uZeuDck3fmNLQr0 2GkvPgJpXSSpLbZFsXubzANw40CU4N51jdvEvY+GEhNYb2i3ZEoBAqJvic0XygXB Ov/uFg52sb1Wl5UzVmYwAMWHLqRSHvms9w6lgK6m4ZZddKiQ3VCzjLaWZ+f4A3k5 IQ8TpDWCH4sj4+DD8AluUT9b6CIRuBUhm8RpTeKJ3iWfQ5vHn7Hg4BzKPNE7ooIX KULKFvFm1QxpWZqYEZcDW16vBXuB/EEGZ5bkUbkcEqeOoKju71bTHWFSP+LIeUqu 0YwSaSQr7o2nokCrvCJY4ulgeATDjXrSmKkj6vW62NhrjcE6ffin6RftLhtvXqg0 FEGLl7E5xxnj9gmsIxVXr3t7oquMcE51dzCoeZ80YKenaC1cr6SyVd/U ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/EE655257CD8F4ABD

http://decryptor.cc/EE655257CD8F4ABD

Targets

    • Target

      14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708

    • Size

      116KB

    • MD5

      b86ad4241b01376b3924a380f6f4c934

    • SHA1

      10682d08a18715a79ee23b58fdb6ee44c4e28c61

    • SHA256

      14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708

    • SHA512

      54fd19cfc37255e7ddf3456d1a2989558522cf58e5eee6ca916c19542921fe3ba4e7a431a35e0e1edbfc37c5651d392e7c3c54eb408754c0488021b16fdf92c9

    • SSDEEP

      1536:aTZINbRh0SKws6KTUkmHlntMvfWhbpfCqeICS4AKvQIFlswOmZFS0cnwpIGmQwB:FRix3PWhNlOVFmw5q0cifmQ

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks