General

  • Target

    ff6818d770e34c64c37e6a83a7b24be5_JaffaCakes118

  • Size

    165KB

  • Sample

    240929-2g3c7axejg

  • MD5

    ff6818d770e34c64c37e6a83a7b24be5

  • SHA1

    8af7c387cb323c180fd9c4fde99572a0af8fb228

  • SHA256

    47e05f24669a0ffd7ca461aaf7e76e0b6e17f6cf424e4d854ddc584ee26ef42c

  • SHA512

    b929fa19a51807605d6d05ae10d0362fe1c0b136eb087ac947637f57fa53811ebe2f58520a123587e9017e6ef66ac1622f59a743adf79751706c4f2982c5ea63

  • SSDEEP

    3072:dopp2Xda3yJQZiiykM2pngXEOkzob8AUXT3INq:dGp3zZiXkMEnSEVzoQFT8q

Malware Config

Extracted

Family

sodinokibi

Botnet

16

Campaign

2932

Decoy

premier-iowa.com

turing.academy

physio-lang.de

rarefoods.ro

palmecophilippines.com

ddmgen.com

omnicademy.com

baita.ac

cmascd.com

nationnewsroom.com

belofloripa.be

babysitting-hk.helpergo.co

tages-geldvergleich.de

iactechnologies.net

line-x.co.uk

richardiv.com

goeppinger-teppichreinigung.de

dinecorp.com

hawthornsretirement.co.uk

kerstliedjeszingen.nl

Attributes
  • net

    false

  • pid

    16

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    2932

Extracted

Path

C:\Users\08jhyhvy1-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 08jhyhvy1. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8FBAC3E418CA5F82 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/8FBAC3E418CA5F82 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: C8UDQMzpRarViWfvlh2El5gYZ4HZh1yVtDKUVaijMH24N9IBzSp4rzyWdhe4I2Jm TsnbMEvpxOjSpQQsgXeo7mklXucAeGFFh3ERvLBnHsuqgpAJFfvE77whheYBTBX2 B9LbEP+DHHvn9QdX0zAQw8siplkVos4tsD073/qOnmj0VdxAd+XbiFkQ1Dqw6o2Y 9O7cXSgJbNI4NwkYq04gllnY3pRe035oujXx1M7S8NUngeo0L/P9yNEQ7B6qrq7M t9EMLg1Ah35oSjS6bIkoM0ituUNqWqMf+2iM3ux6Ga9i4/Kc5flVKdmgnS648ef6 DJlJ2L959W2ecwudueaW8xKu04l5gd3zHHkp+wkPgiGd9sgStVbjYaEFjm5OFHDb BTKJ1avxZShNtLxmqQIXh1l9OtvGOKpelp4te1+0/sKEN2r6Sn8qKWR0U9BUfeys zHr8SV/QPybI8rsl5+DLWlIO43AG0zef9WRs9JjFUZ6Q5V+X2wnRf+xf0LTVpHLE 7aBXBGdwxxqy3p+fGSH6QorXKLVmiv1dRVPELfJHTMrQB+Bn5xKYjKA0hEwu4xZw dqH3+z5fwQ+l9tqeeyzI2xBc/Mwfhrfn34sGhuVFr1XUQoWjLklGiRCQHCmkAUda 3bbT0rbLcU4ZAKluruBtbJONbnPPPY9cADFLM1bdHsvRtI3mSza7zKOgcJgELNGv Z9tb65yMfxE7ybAFDXxx1VKJWNLKbhZExQ1pV1r0Nr3UbNtzLkCj1CIQ3ENcsfnn S0lgDqt/i5pltDx5eH4CjmgSKsQzu2E8F46TILG6+37veU/zird3J6L2pBL+Vqtr 6FjlQ5WEnExWLwzOShRUlYVMaL9H9OSUTSExOZbFpg9CB8jUK2PGfZKJB8qETtgT f4B+9rYil2hMLqPtKoqQSC0+DKnX4rfHtlVsz2wCvi6JYhJ2amMLxD5I0n38K2eM fLv9eRkrQc9SPc0gCECIk6ThcIPhvBtqhXJVnuqwwAgvNSrsBd9KhKGwkhOELwyX X1lCsVIaIlYPpGX0AiSNO5j/mX3y53PQYso2aV2PTlbbBW8cFI1DlU2F5AiVZHFv zMaTTTIUEywEAeDwN7k3sv4CAeqSL1XXa8tj15DiZ/tvotcDFnQnQH6RNEp+v+g6 UU7WQ9lLOuo8q3EVh+vmpbw3pPWq7RGaPeFkZtPuvXRpAcPicW23+ninHGYIWtP7 9QUQTgd0U2Lra8BqjlZzdDzU ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8FBAC3E418CA5F82

http://decryptor.cc/8FBAC3E418CA5F82

Extracted

Path

C:\Users\23tdzd366f-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 23tdzd366f. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CA244B4892B6571B 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/CA244B4892B6571B Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: +chjeCtVZngz2+GnfQd6SdtSQIyuiwtpu7iDCGZAMWRf/s9kCcUqwwPWH/VbhzbF AndmRr4mF1ksKZ9JeuhUQasZ+fuQ7t8zv544ApygxxEDEYqkvhCOOlFO3EdJ7YxP OjLgmMbGDjXB1Ox0JSRXKT3pOmar+Xn6RKo29VZydt57PKwv1M4nS5Uq2Isao+V5 ym1p4WapU+cf8whJAoUwC2l2pnekPYh2ceR3e2uA9+PNnmarpL0vUomoIobOebIB y0FJ6VkIjAkbkfUzuS65QSUrK5lP2JEOu2RL/Lg7BHV8XmO8uQp9tOio6X7rTrkS 9YRP+u/HsJ++nDerE43nqX1Njx94CvtrFF9XrNwf9MzrEUseIWmJcneKbY5MckU6 Zy/HPimOmC0Hyb1sVuNJaNLBByrG/avPnPbFjm3FDTxRMnhRc8EsZZzP7W5MVv8Z kJFUSkxAnw7FE/SLS01i+Sy0sw6mZMnWBcXxUCiR83PXJ/1u49IS0YAuhSeRg6E+ EULNB1WdaymNYHRsGULPGOZZptA9MJmb47dvHhwXNaOm4VXcFvHGdFpErmJOExEh Au4wfb3PRvi4OMzxQzW3KkvMLtfM7zTUNTo2ks07kMEZgj2NtnitybuX8OgSTvtq 6Dbb80BLIhLFWCwb9Jsbvghz+7OEcEKu9xWVFj1cz9HaVtzaCbxuPHEdiDZuZQLI ivJDXCjEOSvaAQMRdHikzG3J4cOeunuoeclW3x+Biym6elY+2aQmZpmLtieFx6Wr N27EZASE9fY4Kh+q7Q6uZBo5KwudOY1r15Ga0nYs3FXFAJnLUHRPe6/8RQLejnsE IN/PvOrNA58KxDQkVmfMg0ifBt1Q6NXXB5A0iDmxlLZz0ORQhD1Hcic4Cmg1l2L7 /ER6KTJ8i8Vevyc1bEIw9P+RVTyOX7dOwiwcqUUdJTsZ5llUi3cb35+3dCPcClq1 v0TChBprAnb1f/BZfVCrx17AZdXjCDZGs9HRPJToXybDKEwtVX5tSEEUaXRjU36N 1pc2kWrUZdjJrutGx37nXkZBsSkTxuNo5WkR7CMLegB0KF6zkjxQ8zU+EOSXZWYV 4K7CQAbaGAJzPVU8B1JhmH2c1MXe2ZxQ7fHnVbyN+lc5Jd/WoCrZDAyVUaFQtwbv UHd3NIx/afTLwBOeJEJqeicKz5qgZothYP8y4SOYs2kXrHOyx/J5Zp7cAlqfzMK/ 5jNpRvolTFtUxzaPCvKkLvxk3TeURP7qD70= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CA244B4892B6571B

http://decryptor.cc/CA244B4892B6571B

Targets

    • Target

      ff6818d770e34c64c37e6a83a7b24be5_JaffaCakes118

    • Size

      165KB

    • MD5

      ff6818d770e34c64c37e6a83a7b24be5

    • SHA1

      8af7c387cb323c180fd9c4fde99572a0af8fb228

    • SHA256

      47e05f24669a0ffd7ca461aaf7e76e0b6e17f6cf424e4d854ddc584ee26ef42c

    • SHA512

      b929fa19a51807605d6d05ae10d0362fe1c0b136eb087ac947637f57fa53811ebe2f58520a123587e9017e6ef66ac1622f59a743adf79751706c4f2982c5ea63

    • SSDEEP

      3072:dopp2Xda3yJQZiiykM2pngXEOkzob8AUXT3INq:dGp3zZiXkMEnSEVzoQFT8q

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks