General

  • Target

    0ee7783213426a5e46bc11a91acf5f2d73890bb09bbf4f3b932a4b79eeb6b820.dll

  • Size

    166KB

  • Sample

    240927-x3mgmsxerd

  • MD5

    9e9b0ef4fc739c3eb36a762122451992

  • SHA1

    035fe67a3d04f0a678724851cabc917b28416fe1

  • SHA256

    0ee7783213426a5e46bc11a91acf5f2d73890bb09bbf4f3b932a4b79eeb6b820

  • SHA512

    01435694c0941b004584d40c3d11866e8f319445ed937095d9777911bd6f36c6bd9449b4effa369120cf6ded9de9a375719e256c6f8380bd5fbd4f4ca0c6d715

  • SSDEEP

    3072:JLFrb30BRtBZZg+i2ayyYOCWGPyLydrkxMT3Q7FTivJ:NJ0BXScFyfC3Hd4yg7Fu

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$8BXnqAuzPokOViNkLJ4z7uiL96FqZKvCKlSlnBLYrdhDDjvGQWHCy

Campaign

2937

Decoy

tstaffing.nl

tanciu.com

plv.media

ziegler-praezisionsteile.de

marathonerpaolo.com

paulisdogshop.de

hardinggroup.com

dirittosanitario.biz

bbsmobler.se

mbxvii.com

vox-surveys.com

ohidesign.com

jeanlouissibomana.com

run4study.com

groupe-frayssinet.fr

maryloutaylor.com

charlottepoudroux-photographie.fr

brevitempore.net

sporthamper.com

glennroberts.co.nz

Attributes
  • net

    true

  • pid

    $2a$10$8BXnqAuzPokOViNkLJ4z7uiL96FqZKvCKlSlnBLYrdhDDjvGQWHCy

  • prc

    wordpad

    sql$

    xfssvccon

    mydesktopservice

    dbeng50

    outlook

    java

    excel

    thunderbird

    veeam

    sqbcoreservice

    ocomm

    sqlservr

    ocssd

    synctime

    msaccess

    isqlplussvc

    oracle

    steam

    thebat

    tbirdconfig

    visio

    mydesktopqos

    infopath

    encsvc

    mspub

    winword

    dbsnmp

    firefox

    onenote

  • ransom_oneliner

    Sir, its just a business. Just read and follow all instructions and you get your data back. Find {EXT}-readme.txt and follow instructions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} -------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!! A system of morality which is based on relative emotional values is a mere illusion, a thoroughly vulgar conception which has nothing sound in it and nothing true. Socrates

  • sub

    2937

  • svc

    svc$

    vss

    sql

    sophos$

    veeam

    wrsa

    webroot$

    sophos

    memtas

    altaro

    mepocs

    backup

Extracted

Path

C:\Recovery\z517k7wdx-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension z517k7wdx. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/76C73EA563E92E09 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/76C73EA563E92E09 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: s6dE5hwvEfZ0Bl/c58Nd+Du+LEsrh0kEVbvTM0ei2l/yqCBoyWcdM2IAp6udDQR8 bPMBfHyiydnGwAHuC07Zh1CrCJnoA5sPphJ1yA+1yBt6uF0yvRsPhD+ypItybbrV gYx62kYH5EFuhk9wWbnmGm+AU4epylC3Jes2dCXpKZJERziHUqsj/mKjJSRtvhq9 QuTCIv4HL2a0GiUIrrkovfuWWBrkwWaVKzkWp2dJKiUXW5uJFSnYLfhFUyFJ2hok 6veioLm2yiZTlJNmff3+saQpylYWg3hO0XtuM7esjZTR78yigyvtj9aujIB4Hc5h EUfd3OXDKVbybD2Gan1lnZeBTlIcdhHapHtTEucqLiYpxoj6pLpkkAOBC4hp7Jmc KrKZTY4R9yPwfiO+kQdOCvAk31IM6rAAQ6RzYLd0iWbnxqRw08ucv/dbVNf7Jwev O3sDp9xiA6EyG4kFucMaipWes0CXkcqlQ/0L7R0ynFXFUH4NPz2LhdeXiDIVzeEJ RSEM9ap/tjbsywBqy3FTcRVdJ3EzCtuuSn+0SsA23QLAv7UGafcwsGzxN1lRhcLW sBb/mLGouirHDkPIgPekmGdAxYnc6DK+A9zXIYtXSzLgDXtIkcWBSTxjWyE28rcQ XHSvjdrWHsnCmzQcHo/ZJaI3C4iyuuSSIWIfZdosp6bO28KSG+nhLOztIrvkVxpD dxHGmUE3Kbg9riF2AYbOl9DVdo9IXCAjZb1Egnpuy1VmczDV2P27GGDdq7C0IjPl o9dfiYxmDTyf2gO6ymknmT5bKcmNmkYTAXKgx5S+q0lY2zMuCpUWrWmcqg6YeZXd MpN7S51y+h0h0gCce0r/R2gh+eBhCAifg2+I39S6z5031ue+V3VUvwRniG+MLF/n 3bJSfXkjE9wKdHRU3ZonSvhV1pBbuFS9g2ZRy1sb+NApTn9vSQRp4xtjbvJIXPhF MvTJg5uY/RLO6SMzJYwUfo6eFWiMzf3tqmfjN344gFb3irBGh7hXsiIhyJWirdpe zxoXo8TOCk+ExNpvGTOV5UAqDrt2lNPLm6JHcdXpVN8Eb41snDH/NNqcvTrqXmwE YrzORAu2Knp+sdhMzHH8NLIR+O/+8e8O0MG5t8CMwpfHVekhZknTluq/LuqKMlfD pu+pwY9miznWPSHRvADWALy12e8q4AJsO9bcjmiqlY38yjmORIeSNqvKlXcTTltK A7YlrAN7qyyZk/tftXCQhR0zxcYiwLPFYmey4k4aHn/66a4DMA++aKx3eJD0pslD A037pLfbjtMJnWGP9EgXnydtpRqm36dOdEjgeyf8RA9kcPXcfpQuJwFeWOcCeLLY ViEH+PVmcvQCjmqpZpshDDUtrxB+KOYf6WesYvG3e8HYmKnqDfU= Extension name: z517k7wdx -------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!! A system of morality which is based on relative emotional values is a mere illusion, a thoroughly vulgar conception which has nothing sound in it and nothing true. Socrates
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/76C73EA563E92E09

http://decryptor.cc/76C73EA563E92E09

Extracted

Path

C:\Recovery\t6pmlq6-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension t6pmlq6. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CE9EFC64681F54EC 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/CE9EFC64681F54EC Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 14X1PMzEXfA3mUrKTLUINQubRe/zyBWXBU7hdP6buBCCi0X9HKhGO9GD0XM5bJdZ 0puUApf6P0D+lnKHrpcMvlrSbmFqL7t1dwrLCGRoCe9U49wsiGFfDJYEQr+b5AWd zJTWbAY+hI1vALyBe54VC8g+U4uG6oIB5bVtHggtwGZBPij1OJcQKttktTbkonxi sBd5KPmuiyOSs45z4/BBt7QnIUNqz1Kli2ghJn+UazLEwJupwtBEw+1Ofq+hdhN8 M5/B0h2St8SttqxlQhC47qlDSaIQi6wq5YMQtkpd23N3bHaqaaRZSRqhCUOgcJZ+ vt33XIyAJsqSokjSElT414Aw24KtYOCCqtl4q4tntx7vD3hwbW0/c3+5BVInel9A NAvcctol5p/eziaFlc/mcbYCUe3dAjdDviCtHejduFxA2MEtLZR8AIG9dV6IcHhQ tVTVwhoxscnuwfwsH+s0N5jabNfnkm1dX/aqhmBqvgWpw+b8b+smtt2SbYrVabxH +as7I65OkVROu3Paqa3NnyFc6AfVSuh79XWdvAQxntCfI3MfcpLo/vqOvEyxoojn +1qPR3k1eJMaeTybXQQki5/Vp9jcWT824Wbvu/XjrPq78fFCR/BiOedCHCHeD4uB 4GqvN4EWEo39yaB/dOh5s0UNae7YrZXgFCw7OuXX0yvVY4pr8dvrqf/AmAflb8hq ZvXQKcuD/CHJnBAkRhvkHwR8LluhwrWvNLLoFhdV3AsUOPtAnEDCezHvzLc5M6qj BjnFW3iJrZcg/Ggkx9AF7sCM0mn9V5NIAsvVOxytStgP8f8dodYI4GLohxpov+1C gi9VvQgBiQ+w+UfnicPp+lz4duVwAU0rM2cZyRh5ppKEyeY8mTBioLPIDoRte8Tl NTswTQ3K4v3h3l/OqdS91ly9qTAKAggVv9BLw5PUB0OqqoTvKx1mG1puUNNie+TP GST3Ss8sMiwj+6Sv7gqtVr7SyjlzpjpXZxs6sfX/QjtWaevR8Cwl2nN8ke5dosdm k0oA9+8869ljUkRLvlYsQZzvc5I6uO8QsxyDg2w8PsCY7yL8bciQ0WjhUQ80EwkQ OstP97NbN14LuC2MqVL3iTy8TIqARoMyaHKiH0l7L0MvW+SLvtuejJ0hQxr5iAGM lR3Mu20Dq/N1sByAgB3rguRTlC919I2hakL8pfQhncbOp8KgvsDN9N2qQM3zBLMd nfyQOooKGs8A9pkK4natuZ64qQ+guCJu+O7kEKiYkC5FEqf/3QKBenqWfNqiYcXI KAWW2ZXon2rbrvDa6UW1f80sVuSUzYbTtYzBratWFNljWm85WZM/vk1IHADOddTL gHpGDVr9SFOOGUOprV6eH36YtQs3rtzgA95qJr4XseDwwcdzwoRb0A== Extension name: t6pmlq6 -------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!! A system of morality which is based on relative emotional values is a mere illusion, a thoroughly vulgar conception which has nothing sound in it and nothing true. Socrates
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CE9EFC64681F54EC

http://decryptor.cc/CE9EFC64681F54EC

Targets

    • Target

      0ee7783213426a5e46bc11a91acf5f2d73890bb09bbf4f3b932a4b79eeb6b820.dll

    • Size

      166KB

    • MD5

      9e9b0ef4fc739c3eb36a762122451992

    • SHA1

      035fe67a3d04f0a678724851cabc917b28416fe1

    • SHA256

      0ee7783213426a5e46bc11a91acf5f2d73890bb09bbf4f3b932a4b79eeb6b820

    • SHA512

      01435694c0941b004584d40c3d11866e8f319445ed937095d9777911bd6f36c6bd9449b4effa369120cf6ded9de9a375719e256c6f8380bd5fbd4f4ca0c6d715

    • SSDEEP

      3072:JLFrb30BRtBZZg+i2ayyYOCWGPyLydrkxMT3Q7FTivJ:NJ0BXScFyfC3Hd4yg7Fu

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v15

Tasks