General

  • Target

    JaffaCakes118_c1bd164d64f45a036ef5fa99bef568119d5b4e90bfe9dcc8b89a4019cce61da8

  • Size

    2.0MB

  • Sample

    241227-b626lsylhs

  • MD5

    9628bd785e93046d488fac58f8eff877

  • SHA1

    906f09b48ef0190db2af394c712d8e4fbe6e6ea0

  • SHA256

    c1bd164d64f45a036ef5fa99bef568119d5b4e90bfe9dcc8b89a4019cce61da8

  • SHA512

    56867952350c277aecbd0c4a9d47700d082a8fd4cbad7e260c0bb4cf49a98d36720e16bcd6098043254c48f060e1a37ba594770b1a7a1246d5047b007414c5cf

  • SSDEEP

    49152:2IUWUa9oVgzjFNZ0Weda9oVgzjF5LkzjFF:OWleL

Malware Config

Extracted

Family

sodinokibi

Botnet

19

Campaign

29

Decoy

schluesseldienste-hannover.de

alpesiberie.com

bratek-immobilien.de

bcmets.info

log-barn.co.uk

diverfiestas.com.es

nexstagefinancial.com

mundo-pieces-auto.fr

marmarabasin.com

walterman.es

juergenblaetz.de

centuryvisionglobal.com

witraz.pl

aslog.fr

qandmmusiccenter.com

awag-blog.de

domilivefurniture.com

penumbuhrambutkeiskei.com

from02pro.com

teamsegeln.ch

Attributes
  • net

    true

  • pid

    19

  • prc

    mysql.exe

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    29

Extracted

Path

C:\Users\Default\u4x57r1-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion u4x57r1. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/343D1088F14E270F 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/343D1088F14E270F Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: ySEkjBF/hSxe3yhQBoTBrTh4UYgG1jY4E3tBdg7PWTk2uc84ALvH0G8NbNGPfZlR V3seunRnjGJRB2b4vvO0uKt865ODbVlS8r4/AuH3pWAg8x5Gc0SPAJRA9UlZ9c4+ +0PVBreARO8YmeULUQolFPxHrfCTSTaoSar0cw6kclQAeSlwJS4TpuXb5s0MyVy1 huLBZFdzhDXogyvH0MzAgZT8o+OCBzkiXffct3V/v+T0zvZH23nbptr1WqCVDIVU D9E4GRgcOB4c29LH4UmZZWFBolvqG8FimeD3nlQoPB8tcD3V3SU/vvJfjh1OIloc 5cnVBces98ZzKjQ7o7LQviBHO75rVSVKicnYC/xV2OikFZjvcq3USHjUolqHrVXG pvvxfVr3JYVg1hN+u4ePlz2qBd4szSXIk8OmGhcFqa9ibkiTVTf6BB/nb4p1zLZD slc71g2Vlz5b+mEgP/C09X5XmG7MpMEW/qIHjPnXhKqgsZAg9XT6iU6opdKqEuCB vg6y21hayz1D3Q9lyLg+6JKZoNNecoFhB2M7PLmtrVIYSJYaMGR4rZ+XVzqORYme 1LotjQdlPYBN+6x6NG+SPvuNZ2B27htKINupiYyy+SWKDA7OT5fgD0xaN+nYq2Pr 8DuyACc7JxFpUXxugCKjsIdjUsnjXD3Zl8GQQph6Gvy76byQTv+zAIZf5OWPIlcM 6moVBM7LXhDr41biGxH03jOs8fWA7bbXA7csQrAqG0BdEcbP9ZsX9iqO0sDfx2k/ eOsDA1mcLm69s/1asR4h2gMdTBRCWoQfSau9C1/nPLuaZVJH/4f9OfQ23vVKwmA4 QqV1GAsbWfE9yrnrCitfl4onlD1zF/Zm7KorFzXuPLe/7yKZXzq7YV9L3Az3VrG8 Akl/Y3FAasR9uMMYYV8mwlalORUp/9WBPhyNo4L3C8EiT5JpH8sem2EWjy0n1sZ9 J9D7ekdwmXMVzWPCROLgXKy/O8pTM2O744DKERhK8fTiI3iKfrQdgad3D9MaZvKF VS0Z1QgDfwYD7DSiXYoyCCeCZt6ttLgAnoWf2LfjgVMdPVeo6/6gKtsfMAQrMW5I PczGT/zEMV9HcjYA6rB1SQLD4TXGRhSb1k9VieVcpJG6mxCXGeYymUwFppa5WLhr oQ+hm6EembN8cnLHPdrPyDgNG/XHwyZ2H64= Extension name: u4x57r1 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/343D1088F14E270F

http://decryptor.top/343D1088F14E270F

Extracted

Path

C:\Users\Default\2013g94-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 2013g94. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/6C7EFFF2385B9BF4 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/6C7EFFF2385B9BF4 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: G4qaDgo69NnyBjivSea4XXEHIKZZMahJ168EIMGPsagkWA7gjvdtdAzJ1Kg8Gd7t y1GF5kzvO4Lb3j/ogyVJ/giOpp2IPjvG9885bobUN7bvD406uQhsK6Zz7KIV+yvO ryQb6VJKvoVQszqMheIpVgsXdU0GlVQShgiv1b5m7qVQLJodDjijt6fdzJ1J6TiM BHak3qu9BN5ol7PKdOFAmGiyB2UncLJfCn/lIEvWMob5wKJ6HiaI3OY4UI+ZlDTN F6hjFj/Hu3RBC/BVDPi2A/GcSE2aHYYTcdP6J3T+GYCrVJwQWcwHwA83qr+8oUTL 5Sdpw4jwTWWG7g6tfwmKhb3BvM1xODknydZf82oDvXBNL3jDHp9ZHvQPMXctQ9DV qbMDjRvP7sU3snWF8H/SGrg4N43k/oEhVTjhFMmhflRZL7//8V3S6YHUnza+GVAj 0qXFQzHbeW8+sWCo9KhgrtgXvM6OeSiNed/CjZZOjS5+gFlQGYX9QiTwy7sv06+/ MqetA07o2078x54I/Jac9CanAicDPjhkRCli1xFnZz8geu7eC9NiRCdU+1R2oYFp 9H8YuczvsTSZCwemThMcxsu0780LDlygpa8xY2zzW85oUTCZ5vSWfbSHImIimg4Y 7VR9qVhtki+mXXZRlKSP4oiiADYGALfK2RkxSDZJNK0d+Tf3Few/sdW7QDmWF/Dj s7wS4UbUJCiDCmR5jchdbKrcnaeQlpyKFJTj+MQFboFAaycaBPDqbPY3pThW83rs 3ilK7zF8QuRlarg62qGNnmUst1c4eCjJ0pxTOyNBZfRyP1lIp37I6VHq+v7bRs5U 2cy2tI3A0nRzvFiKcZIEDsr7TgXN4Hjn4GpOU0Gslp2eRyLONZigSfACFTtBr5lw +kMmvFxQzkUnLVEQzQU1heVUQthdvuHqDYw8IxW2Qqae62YVatj08DwY1ar1clsb qu+ESfgROpLOgzWaZGGw9qyrNuJjClvCgwnaaCoupBJT/hGyd0Ov7SES7CNu1GwK 81IfJqJgraFT4ezuZ/ouHFnnHE6FJy1dAWTfajk4ii4aTyJDQ7IHKwmVojiUxnSh C63kPS1toVHpJyB5aP839xJMz0rkl6AWoT4JoFtst//czjKvlNxh7PyItWI2INwv MUHTDIhTKhLE58JQ1Wwv9+3bM3tTZTUZQkiTfk4nDHo= Extension name: 2013g94 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/6C7EFFF2385B9BF4

http://decryptor.top/6C7EFFF2385B9BF4

Targets

    • Target

      JaffaCakes118_c1bd164d64f45a036ef5fa99bef568119d5b4e90bfe9dcc8b89a4019cce61da8

    • Size

      2.0MB

    • MD5

      9628bd785e93046d488fac58f8eff877

    • SHA1

      906f09b48ef0190db2af394c712d8e4fbe6e6ea0

    • SHA256

      c1bd164d64f45a036ef5fa99bef568119d5b4e90bfe9dcc8b89a4019cce61da8

    • SHA512

      56867952350c277aecbd0c4a9d47700d082a8fd4cbad7e260c0bb4cf49a98d36720e16bcd6098043254c48f060e1a37ba594770b1a7a1246d5047b007414c5cf

    • SSDEEP

      49152:2IUWUa9oVgzjFNZ0Weda9oVgzjF5LkzjFF:OWleL

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Sodinokibi family

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Renames multiple (204) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks