General

  • Target

    JaffaCakes118_bef5e19dd521e73f355fecd74f9a174a75f6d61e8fc8e6e738f8e1444ef597ee

  • Size

    148KB

  • Sample

    241223-txh1gsvkg1

  • MD5

    eb4362ed266cc7d0e076d81517f4c79c

  • SHA1

    76b745bb1ec9ba54a4c1021a95cd238962c382aa

  • SHA256

    bef5e19dd521e73f355fecd74f9a174a75f6d61e8fc8e6e738f8e1444ef597ee

  • SHA512

    42184ca86a64ff53715cc1ec41560c7bdf48e47378f98620c56718b082aa24e6e9d8592bdb47f8be5ae99cba796f181d4f544c2a453612b60d4850fceb97496e

  • SSDEEP

    3072:gcMsZURJZhuZrcFsoU6abHPREkNrdTAgKbDHNRtJjB04611:jZUXZhnK9rREQdTAgKbDHNRXB9611

Malware Config

Extracted

Path

C:\Users\r0585-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Hi there! We wish you to have a good day during these difficult times! We have to notify you that we have completed the downloading all sensitive data, including personal data about your clients, projects, databases, reports etc. Ask us - we will provide you with proofs. We will public all the data in case you refuse to pay. Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension r0585. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). In your interests to contact with us ASAP. Otherwise all your valuable information will be published and sold. Believe us, it's gonna cause way more expenses, than the price we ask. [+] What guarantees? [+] It's just a business. We absolutely do not care about you and your deals, besides receiving advantages. If we do not make our work and obligations - no one will cooperate with us. This is not in our interests. To check the ability to return files, you must go to our website. There you can decrypt one file for free. This is our warranty. If you do not cooperate with our service - for us, it does not matter. But you lose your time and data, because we have a private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/1FA62D7B3336B464 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/1FA62D7B3336B464 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: ojNjXx/XTcKWoq9/UC8d1LDI2BONnh1UAxriUPFX2uzyBdZ/+r9z14jW6D0ZlmHD d46/RmwPpAlyAUa5AAug8HOwx9gOlEOAzLS3X1f8tfA5GJHd4EYHPUj6IfyTRQdN aTQ2tctI586h9BBBW5JsrxFRSL5xUjDyohZYVwLuBCEIecYwhqV4JJ6Hduu8z9zv ErU7sGfBp/iZKptBhpoU0cDdtZ999hpu+TIKM7F7eWP8df0bzCSEZMbagbBO/m8N DuR+YM1qV+ayk6ya7rHktzTDrGhkNLef8TqF63vZGpFCfWn8dImHyvgzMm08QSEk fDxxSYCHFmVd7wu6hNAcZJyQvAdOId5XvcjW+lrLSMFrR4o01yBrTiMGUeWcyeNm MdYrrgwuBjoqbdySGfMFXe1As/lWpMDH5jwoI/KolXFtuuTVmIIR3ItQCqnfeDys XNaHkppaRyJka0kMX1LZjqguEVO4jm3ATk02dzXcs5mTH4PlcJnYSUNka7NrS+FB XI+RJJkF/xRE2yxEwz1DosGFIZql2bwB9KbpM1mFjhkvJ38F6lDYEBkrk4J2uINp 5znV63QraNodEy1yD3MMQl6tgg2SL/48rcib6aPO5gXqgKsaxafrneVJth8TBwry yAToBCEX9KBFVwrT1aiDKz13Qb7Kmwzee+5Iiri8wDDDHkys59gb8LjmWEgGkoyy RykmfflXZY8lZIIGN6AvmlkwqkOgnKzESpP08YFMgGnZ7PLgV4oZkZ3B4ihNCXWX vug+vxkEzcK4V14YztJo9gHYpI8TTID7WTQsPgjOI3n24OY+9XY81rrbn16AvC4s nnb5HB3a3WZhL22dSXV0josusneseJrjKL4wyncqxOIvxeeZJiN69Ct2V3zIvsU4 K8KGhzSf1bawdaV8J6ZCOCR4AW2q3vpf80TCXKa6Ab7fGZh1W3EkZ0Iu5flp4IZv zAV0y85Vqx/DG/Wq9ki1zm9fWRbWlhg30wFgV+CnppirMRCsVkkFPBb7fNmZOy8i v1Pt2AuPQ+JzkomdR8Uh2ge7sVtA37XiN7cc9/VgVgt1vea04XkAtC1enwITJNL5 K2NEWmkQBqIciPGoOdthtHbQrlPeS8xZcNkGvQFGOY+Gi3yONQw88sUFvrqQfHEl YHLkKPA68PYRXQX1ilUuhiprhNt9B2sI6YNnBQQvweTNSq8O+5O4gYBEGpEA2g0P ZghUa+eEc2v+DNoj62jdhcnlQO+yHCNDwkKC8PUhWoVDi0zHzJ4C/Jbw66FtRyKk 1/N0OAMQujYaJn7AHCD0I++wZiotzHHmwjVnf+fTkQ9+tdkQnOxvgMYmo5pH0WEZ 6U9getGc46BTWlabDcSdWTVUIY0= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!! [+] Attention!!! [+] Also your private data was downloaded. We will publish it in case you will not get in touch with us asap.
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/1FA62D7B3336B464

http://decoder.re/1FA62D7B3336B464

Extracted

Path

C:\Users\be8jl4u-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Hi there! We wish you to have a good day during these difficult times! We have to notify you that we have completed the downloading all sensitive data, including personal data about your clients, projects, databases, reports etc. Ask us - we will provide you with proofs. We will public all the data in case you refuse to pay. Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension be8jl4u. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). In your interests to contact with us ASAP. Otherwise all your valuable information will be published and sold. Believe us, it's gonna cause way more expenses, than the price we ask. [+] What guarantees? [+] It's just a business. We absolutely do not care about you and your deals, besides receiving advantages. If we do not make our work and obligations - no one will cooperate with us. This is not in our interests. To check the ability to return files, you must go to our website. There you can decrypt one file for free. This is our warranty. If you do not cooperate with our service - for us, it does not matter. But you lose your time and data, because we have a private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/06A63B3A7B795213 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/06A63B3A7B795213 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: XoszJwUc8sGgCguy1SZWHnry/LqyXgsGEjDm8y+MJbXhoQNJddrS4GqFSJ1cWUvW j69MLOwV2e3f7bDB8Hu7BTPjW94T+UH4g0pAjaxXR23ySyxenPKnNI5JDMkgKERl Tl6fthzRr6r7fzZyH/FBHBFIjYHczzHLz3YRNqXeFfcqtI1IOj2ORn2ga6OhadwO SAaktEDqdNuokfgd/4mdu5Lpk65ikwLCIa2+MgSjZHO26Z2IqL45tkc6fmyLVVFl tFMSX8IW9zX8C1WFpIHsTPgbbq4HwIGWcpccWBW2EEWPuGOPMzfDovvNEhJJ4dBg fx5m1aZc2KJRsQ9x/dbcgNwEHhWnVp4W3EIaZgVyUvie6SUvIFp5ix9oViibFm16 25BrNP9pInj6e0RP9w1o3lIoeiMoP8IoCmhsIfSPvSbLq3YeF0ScxnQaXM460fnF Rg75Fi+jR/cYPivvAFXMPB7KvwZn4rx9KCkBNZsTZzMihKakyWlk+NdnoQoA/ldH +UgLXeFczkAQkPGgtqBQTeIwHPR3Kyv7euG2l2C2zZsg53dKeTYEdbcUEGjAH4x8 ozcCF75bmWGyqfcLYWthqgrcY6Nnfus5zDLp9ZiHXKcWUVYin6rzCtEiVguGVjxR 6FTrcwqK+m8cVts8Wm+zpOOnSAj+pomKezp7DINJiQNe+O/ocZ8JaxPJi7WlBIAP HLqeTmn3B5EExoTTzNEiCLjiMjRmItTIR6ucpHXM7u9sHy3+e1lPDaEbSVmmQpqc zjZ2go29ZSA+SeDP+TCi6Rv899atZLtFwtUUazwcEqt7Z8ilUedQ8nn/OYBuKZbi W4BTn177Um6b+QRA7CbZyJSPZ9z76rbPhBVSXPEodfEEWNsLAtN+J/ETcjRyT9BF IV3ob8zJM1hPGAtAfd5qaaoDegIRYWHZYB5pOepSJr0hAirvoVebQJAFKL3UfbMA ONjyfy3TWc00eYbea3UGwRihkmkI4cdrkvWLF8jChxGFj1yG0L5sAwWR64vHWCgk DSIVFMamkxAQT38fu4GJwQz1PbB3Rg6+oR1Bv+bkvQ56N3LurVmmdP54S5K1qW8/ P8Ub9B7z9GVDANlpPwHJgDMiP97bWe7uGaiYQRqXbS/81LA8WMd5bT94uM7aIJ+Q xgBMvK5oKvuPlqXQyE1fKi/atWef+cYVoZtexE0ZD9tZ7leafbL3qPsQFO3tNzj6 y/y807umKZBLUsqF8p0yMjRt1TpL0A1Qa/iOmNKAw65fSXtyjB4TCpzfCOwkfLUb xgz8O8i9GpZkoxUPYzgFA/fPRQpVdXo+dAEbu3oHNSZaVObP5L39yXK1NPePWtva 0je6bCWLE2FMcJbeoE8I0CBE9Qcj8fhKeL8aXm9N ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!! [+] Attention!!! [+] Also your private data was downloaded. We will publish it in case you will not get in touch with us asap.
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/06A63B3A7B795213

http://decoder.re/06A63B3A7B795213

Targets

    • Target

      7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA

    • Size

      282KB

    • MD5

      1e7cc3701e8b0266529709e24cd2f6fa

    • SHA1

      5efac9cd4bd5bc67d3898280046967a2cdc5e547

    • SHA256

      7d5e6782e91871fd6fd5adbd61901443f5b5a18a7bffdf56426924a1c117c0ca

    • SHA512

      4ffcce0f25d7b3fdde59c0e73a4416fc538af9b3ef96f43c15267a7bafad0df372cbcd21aa4f36f0632465fe61e28b9d65c4a2e7bf180affb5b0e4799ca72841

    • SSDEEP

      6144:Lyjv5Cf5wXjj6O4QYmm2b2sqWI0wYF/Ie:mv5CfewQ82blqWIYAe

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Sodinokibi family

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks