General

  • Target

    JaffaCakes118_c324b74a5fb1fdf9e34780cf3f6079b23cf3b2e52b422cf760d8bee7090b3e72

  • Size

    191KB

  • Sample

    241223-1h2bvaslgk

  • MD5

    2c2ca8ea86a6cad878a3e0cc8795119d

  • SHA1

    39abd770dd7984e01d58aea96b9da8b3aa71f39e

  • SHA256

    c324b74a5fb1fdf9e34780cf3f6079b23cf3b2e52b422cf760d8bee7090b3e72

  • SHA512

    4758ece6dbc5afec1f454bd959d236e7d1901344bcb0e16b6459ec905f5f1ff4432b328ed8fee01253949055b1b5be82e68ce1492ddc006667504aae5d574055

  • SSDEEP

    3072:AjXw4yfg4EfDfsrK09CMxxfViMLXdZc2AIo31qYINyxgYQ0bO/m7ybPHaTyewR+Q:CA4wg4Erfv07xf5HOIc1qN6LQ0bO/muT

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$3aLOaggUASU5QrJ8Y1pYZeU93mMQzM6yVgD7yb83aT6O21pMW2lCu

Campaign

51

Decoy

woodleyacademy.org

bookspeopleplaces.com

despedidascostablanca.es

lapinvihreat.fi

drfoyle.com

carolinepenn.com

abuelos.com

groupe-frayssinet.fr

tecnojobsnet.com

deoudedorpskernnoordwijk.nl

siluet-decor.ru

smessier.com

calxplus.eu

julis-lsa.de

aminaboutique247.com

pier40forall.org

coding-machine.com

longislandelderlaw.com

expandet.dk

blogdecachorros.com

Attributes
  • net

    true

  • pid

    $2a$10$3aLOaggUASU5QrJ8Y1pYZeU93mMQzM6yVgD7yb83aT6O21pMW2lCu

  • prc

    mysql

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! !!! !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    51

  • svc

    backup

    sql

    svc$

    mepocs

    vss

    memtas

    sophos

    veeam

Extracted

Path

C:\Users\hoc5p0yrb-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion hoc5p0yrb. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/99AC7F55857D1B6A 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/99AC7F55857D1B6A Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 7+pk/JLMDJ4VhGrKmFZ1ZaTVHl913R+438omAha6MtskVaTFIQ2FvbyDbvvmSGnr yy2LmTNOpdR2H9eCpG6fNlVqMCgFY08VGLtQqcd4hClrzvilRUM9pvvNHBPuTtQs JVTlmB9NsYAxpqKKQof3J7gcUOSFShFpMfyX3a3a2QKOQ/5GuPHPCk2Mb6oTGyQd sanoTl6PWX5PjL7lkml1AEfELoiofZgQvtFQ0hlSeBGbSJlk8HGtLnN/4HfZlDux SGYsu75eYokZbc0mKO36KRazNeHo0pM8PrgGIcV4wQPaAtDUSlhzSMp7zzoL4wBx vcIfTmoveZW5/0I2TOUL1qbCSlFHuiqcmbkNKEOpclNSfelR9qcl9a8Q4IDenuyG KdeMZgtyUMjOTSU0aV4zjfbmC4iDtfic8kXuHPjf+7PnueO+jPcxAOen6FnabAx7 yFwmHhhWtPbfbGLWimt8cpBAoAXFCIXFJkxGnvQz2yQwXWQSXcEo1e3ifd9wJLTU dDfnTB4BO2rxhd0tUUbNxmfq/UC8wt7zgLf4OzUcMmsQNDwy2nWhRBlIKKwUUkSQ f9XW8ydOs02akgtHSoN4eHGMh+Burk6k9HLWzv6c48NpUbHTC6t8tg6Q2+HvY308 uhlwukelbd1SvxsAgl88I982YF2qEkm+uYiIAlmA6AhQHEIyHzkBXSRPInrZTcWk mXYmzwWiBokWtdkvXSLzhzKD8UbV85SiFZ/DMglUdKUB1p8TUhav5kBAMyRueiYa FL1pZYTaGTV13IL95+7YkQwLKTFmAMzIjmz4+Dutx5rLUOiGMLRW1W/Rg3TVRttu oTYaSLjh0dxDfw+t+NdLFqwEaWZtiyGnAYip+EJX+HA3hsSVoBeJ94WNZO5ZeTAv mOw0mzFGRhj8L8Tzu/8b8/mlCuJIvr6fuYA9XPRgc7upwoteBMKuFfx101bT18eB CNVSTA8qRcSjQIfLylk/d96CdMS/SX+DhDpVQjD6oshuYoZfraOk21RFsV3UYyAt YGQlkilEQ+KlD3fVSbQLdnHViGxxuNjkfmpZLpMrmS2R46lI8miuSFuHxJfZk7N/ sZK4l7+aF/h09ZJthmzlYQSXS1Gbf2uDPkk1iYPaR+igNUBrogrcUFssgU9rfzFr QjNGpydEvLQd+m5IerFqYK1HfhY/vtc/MndtAzuBXMbHxWzBWs8Qzs8X/v/2CYO2 2SdWZtum5bjepU9IJmTZj1pMPaa/RpE1cfNlZCXgOOvVFPFsTxhQA/sz1axpzUw4 ScDCjJUBl3Ox5K8fMvyTVydzfhnPbfHSojcgDwUylECNqI+8afijUD3ueB7HuuAO gPOr77FqK5gtq67miXqoFFBpBsarYHXyUxM9ai+FN6W4Ew== Extension name: hoc5p0yrb ----------------------------------------------------------------------------------------- !!! !!! !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/99AC7F55857D1B6A

http://decryptor.cc/99AC7F55857D1B6A

Extracted

Path

C:\Users\w7ld957-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion w7ld957. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A47CE0FA1D542E07 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/A47CE0FA1D542E07 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: m0FiSL39am8s1SvYPZXif8r/g55ISo3EekKXB/wW/ykyMvXSILtBFioCEPwuBZLa dJtrH8nMVYIfZQZj+XgoUVchgzkBAyPaUTZ7mhMz3WOPRln+lf/yWcYz6oufEroq jBndyRCcK+j3jpqDhTr6KZI7q/ZLrNqV4Qm8LGDHjxdkdMz6SciDpRxXqptv8ZRG psM/jQi7PuJE5CS2R4IliUc0I7LOQzJF13vXoIeozH6XCktHFNBtal/PTIsde6cQ jHy9FItd3nj532jWHVkvMAdU/eU/947vj5fDfeJhCBvtoK7XgZ2LVJPS3QUAV88H ekgrmv0sz54Ge5/XlkLzK3/c4DYniq0Ds9eZ39CXOwAukE5/uw9scpkXMlMAkYfp ImXqjHbQbuM6JgUdrpZ5+ThqDjQ5u1zLpMMY9lDJLneKojPKBK2iWGbu/LapXPYV NPDr+UDFRYvEaoZnLCCTKkNiEJQSrNl53tJ2EIzhigJ7vZH5ZDJhsZL6xJV159sC vzVPOI66RXzvqyqMSwZKJ7CHnGwbegeF8CG8TO+Id3+gIvFn7a1PxdL9EZcWVL6H 5t0l46Td0eZ6blm3BBp5xZ92+CwPcrvAn/G18jOBuZ42MuUYd5P6Or2gnF8mMXLs ecuUgi8c5jbPT7dXclgZKmIsVeaOOE2edNPuL88K33EJhcLAsHRVmf/zGYbpylfU vC9otwbpAQVygfWh8N2UUkuwHpkw5TGe8uV+HwVbOrXJnzWuSBLh6GXmx1lkFPKQ Ocuh2Mnze//KoNUC6LJMTXc3K0VqCP+NxdGkhSXZ/FwK2fbWR5wyxRHFVBQJzHng 9bipx7iP2a+DvQjECJHrWgSV3kMeGKHLePdMS9OWg2Yq5pWnLcuxkBhd4nKspInO evJkW+xvT5jGyAf+eL3ERtt3Ke1pK7dcKRxTk/nYxPng0j9vNQ8grwhZ0E9BMzPt YflFnU3JhXAs2405rGUS2M6ZozKH1CxgJ3WHk90BWuk8ppEV9hjMQaIYWSdQt3TL Hvv6UH6xMesgH9DSFZqvhaVxjJJVkOetut64Jd8wrD/Ol4bG7cXAPVwUG6e5jG0w SdIp3q+rFRdmGeIaDsIX4UsUicnFA62FgZt6nxpMGDQkn4OMRKX0xwWgufpj5ulm LOYYd+r6JJf1KPU/pEtCEDlXo39tBJiDXjXydOhEsqGXbQMIQxI8CJfGxpreZF0Y +Ne8109Ys0Pyuzr/D9OjiXXSMnYmKbTTrFZfSwdAWNJRGmSJabilS1tGXuzAA4Xn GlXF5Zps3dTXyrD00UoooUhy97lVOAoi8U6r22yq88Rtfg2L75aCowro02giLxLp bSXFLDlXzN+Tg0xSdI+uWNidRYOkvf45FcNJBv+Oun4Gfee0 Extension name: w7ld957 ----------------------------------------------------------------------------------------- !!! !!! !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A47CE0FA1D542E07

http://decryptor.cc/A47CE0FA1D542E07

Targets

    • Target

      735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe

    • Size

      324KB

    • MD5

      20defcd42cabf5da27a21dd342e58068

    • SHA1

      408cfabc99c350ad28def5475cfff5dc2de02543

    • SHA256

      735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c

    • SHA512

      8a6a2f462b9e5ecccae13ecf176c8d2ec93e1c535f3541aa9a39151ea7874e730bdb627b422fbe2ba1c51c98c9c5a2b35da79433fbe9105038836ca33f31814d

    • SSDEEP

      6144:uhHmIZ1A3Lp5r8Xjv0PZNVhmN7r6PNkr1UT:iHdA3Lp5YzIH7mNyFqo

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Sodinokibi family

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks