General

  • Target

    JaffaCakes118_fbeb086471d10f63943f5e7b4812ed274d1b25a78f23899f1cd8c3d9e612d4af

  • Size

    73KB

  • Sample

    241230-z76r7askez

  • MD5

    486f822fb601d6c390d5a1ee51816300

  • SHA1

    db86f5870e8d32840e4c122c1b160bc42b9fdb27

  • SHA256

    fbeb086471d10f63943f5e7b4812ed274d1b25a78f23899f1cd8c3d9e612d4af

  • SHA512

    c6800b0e9aa0d81356414839a3a15ba5069911f2dcc1cd9d67dee38cb1ac725201de24661c6a011c8937c707c966f0e717101c3310719da466f384ea73d8e4ef

  • SSDEEP

    1536:sonow6GwVyEG1laDe0CUA26HaQXCoFTz/+c69vSp:sNFNgaqvx27QXtFTz21E

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$44TA1mrRKSxiSZTXjU.mW.1c.dtaZADRkww2unQ8Amfranh2NarCu

Campaign

5490

Decoy

praxis-foerderdiagnostik.de

eraorastudio.com

strategicstatements.com

asteriag.com

mylovelybluesky.com

upplandsspar.se

castillobalduz.es

bodyforwife.com

ymca-cw.org.uk

iqbalscientific.com

bigbaguettes.eu

ligiercenter-sachsen.de

connectedace.com

mdk-mediadesign.de

gantungankunciakrilikbandung.com

ceid.info.tr

puertamatic.es

smhydro.com.pl

nestor-swiss.ch

kirkepartner.dk

Attributes
  • net

    false

  • pid

    $2a$10$44TA1mrRKSxiSZTXjU.mW.1c.dtaZADRkww2unQ8Amfranh2NarCu

  • prc

    ocomm

    DellSystemDetect

    beserver

    tbirdconfig

    wordpad

    thunderbird

    xfssvccon

    excel

    synctime

    sql

    tv_w32.exe

    benetns

    bedbh

    TeamViewer_Service.exe

    disk+work

    ocautoupds

    CVMountd

    avagent

    cvd

    ocssd

    msaccess

    vsnapvss

    tv_x64.exe

    powerpnt

    bengien

    infopath

    onenote

    oracle

    SAP

    QBDBMgrN

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome Dear MARTIN ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] Downloaded your data! Public information! [+] We downloaded 260Gb of your information. If you don't pay, we publish full archive here: http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/posts/170?s=9e10e7edc84e0c11efa28c245cca0f4c [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    5490

  • svc

    saposcol

    dbsnmp

    raw_agent_svc

    outlook

    thunderbird

    mydesktopservice

    vxmon

    ocautoupds

    xfssvccon

    EnterpriseClient

    VeeamTransportSvc

    benetns

    QBIDPService

    bedbh

    vsnapvss

    ocomm

    wordpad

    avagent

    ocssd

    QBCFMonitorService

    dbeng50

    onenote

    SAP

    cvd

    mspub

    isqlplussvc

    mydesktopqos

    pvlsvr

    powerpnt

    beserver

Extracted

Path

C:\Users\uj8kxm2vn-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome Dear MARTIN ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension uj8kxm2vn. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] Downloaded your data! Public information! [+] We downloaded 260Gb of your information. If you don't pay, we publish full archive here: http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/posts/170?s=9e10e7edc84e0c11efa28c245cca0f4c [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E3F78E6416179243 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/E3F78E6416179243 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: vHtLBInqoL5eQ4hDW3wQhLIbytLo/7WiFr0kERtJTaqFCTqPEgFfJtQKy2KoKoDw WrerCForwfmjYDnyE2DxGeOaRmiJ2D20kykVCgDYXeUcY0ejthe2TZn1e5a/Q6HK TdTK0bEtYn3zcEBaK/NdJwMLiVtkVV3vgdXm2eMqXAVP4oSb37XQWE7AILGI2l5x 1cHgZo+OhY4Nb/R7/IR06PqVpNkytkW/nFc8X7HDsHMNYW8kyX6Hl9atpTabW9Vr wvh1j9uCisGJ7T1oX4/mWSdJ5Z5bNdF/kbf12tLSkoOvLF6YUt/ydni7/0CLbQt1 QIGy0Rp94pEVYrn0PGaRaGJbq/56675zpE3tBJpvWUa/qwTR6hv6Wzkxiq8JU+mg 1XkDFq4GW2TTlJRTSdWooe06lc57RHxm2VJyQrQBRohrqY+5mFQYKIa2apdaX5vH OEXbUIES2t5Vq0rLsnZLQzTcqVn+uT51wXZo6aeL5qB5JjPNPXubeRYxEUDLOSBl z11oQp3evtby+DdS9OfOGbBae7PK/OzN8lFuy6pnWajWcw6JHzvF9GvH0oD1fNUO N/hATrcW0gJcMDxr6dcTyANoQZcQk4lqJorsUH9wPcRNWceD2W7g7nHz8GplP1Gt TpgA/3kXVFjqcT7iqPAkWXuwRgfs2Fhsy3ElPcRajDpi7cUu2O03tMucwwKRnPpL /ND21A2gDlFIk5flEQNzBoIHWCXIHpa9ajeu4it8LNyHR8x2xFnRx4OZjeHbrRIa OZQMQJbPs+oDur0eryK1bGwN5U02jTR4yakDb0EIgrMKmicUCFdR6qHS6Sshv3Yc HylOavMVb+cagLoFiwSdwEm5WjADYNL2jP7iBjZUuZ4m8+Zdbf6EsZL6KgElK+2+ +DRQnFy3gX5OBpO7jpfSMiusi0cw6rBwgFD1tPKyUfsKQEZi4l/0o3KRldcY6fpV AMw9tZjnIGD400ygMl6e6SRw783o25SN6OLYmg0YNlKTXrmkPMRpMNV/1SF/pofy u8SStP5YCVHBhatT9Hp13Kjq8kNfu4AyReMPZQMkaBt1UhSA5Ka6GkeKDdF5BC6O 96IqEhkDwTgpY8KoS6w0qdfdr8gM/exhrm4X812RXP8AjSitNYy/0eG7xIpDP3rq a26wBcEAofcwjMl10EFNupjVhz+N8HJBxG2xa/jpX1RlSpQG6RFsXmbo2sH9H6Tm diPFj9ufM8FJ0fPkBESHLo+0X/JkoWMgPhY615M8L88/YWJpGP29ocWkEjqKlrIt twEWLGB5xVir4bbuuvNgWbu03naJNPvM/5XKK4V6LVD5Sqq3dGkaa4wcX+DjGs4Y JYyoQHXo9ek4DzJtAZKb5SUPtjth+Plb4nm4HeQLzp4+6jacyno= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E3F78E6416179243

http://decryptor.cc/E3F78E6416179243

Extracted

Path

C:\Users\6w898as-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome Dear MARTIN ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 6w898as. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] Downloaded your data! Public information! [+] We downloaded 260Gb of your information. If you don't pay, we publish full archive here: http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/posts/170?s=9e10e7edc84e0c11efa28c245cca0f4c [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/284CA2684B8B5A77 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/284CA2684B8B5A77 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: dYjpWxamfgk+klH+Q98ORAPmvg4QK7VxU77sm3Pg21u/Jvx4QiEpzDQ42I24XPRN +Y71OdWqMuiwZVWcMQPcZgWC9+qIwI6QKouZoML7TUkS2SQhzSgK+aw5NC3xZGpg 8yiGGPQGoDmv2NEwshp+Ju2VxB/aZXoWB/jbgxpFSTvl63SZy0wA6vAqfnpOGVI2 DSVh9umLJ92GIr2y8/faQ/EUQlB6x7IS6dRhe2pUUQq4rXdW2lB7yCVY7L1yJlnK fwQ6SRIE6370IQNA2vM5mnoiSdi3f8dXFbB26RYsNTLUI0DoLimmi5WHFFUriI9s RTE6Ii3SsclKgOV5yNjfpkHxmzd4USeJfZo2a0t94sVg+kOOFaqbF3aBfpVf6G5o QeaPaFC0SqmZoFc/B5ZTJfFckGj4R5dxdCmz5A/bgJ0AwyGX2RdaPH8J+5tVYkzS ekUZLfS1SzqCLgD4SXz19VdALn8vOLWNak8BgHMk0xOJdigmg6ysP7DwT7ln8+Dd pCEgLWvK3HLqdFc74LgVLy+nbJYdqGzkWD/WiprhGnqopBwkifT6jfDz0dM5+Ut8 O+rsw89CS6N9wklzeL0t+oWVTYRBuvUWJmn/99T7uLvJmOIlTsigji4dJJhxfKUs 2oDC73uIw2CufQZ1/++AZn4Oxab3GluFhSr5QiZBWXFfKAEnw/nCGHEmJqxniI/Z Rvo8tIGoUlwjEetVjW4PtbYv9U5VNOweWgKWQzIZ2wQ4CUD1h40+kkRvVKAp7xkj lYFNcP99WewulcfnnshKDq5ZdKbzyn9/d7AwIc9kW0MwHyuQX2MNKGSs4lKHuQdv vYEIlOz9BzPM3aQhoMBcfYCDqkjsGnIfw2GVXt6oiwUFK37MtUjk600/gWsiYdVk WS02Oh+L+yTGqAFaYo8G0dbX753e/WtUaPQx8uVfcJ0C6f9H2V3i+e5OQqWRHTI9 lpSkGO4O2r3TKzgjnsb3Ur7hsrAQWxe8Ya3cbfp8dKyH4jfDX4lnax306VL74JgL vV2Nf3A6nSH02sYhPNF4qm1qvV0H7g/wFwuricMijREl5m4eWpTy1PHnGawuCRyS SOGbGdcdvru9zZxHzF2Yr0am/C8ygRIA+/ZMEfVcwLneXMNJSYW31hlbuyGC6uxn wtuO5L6+EnE24VWpICD3EFd+JtBD/PegT3eW/cH9z/IWdZcmOkSLANNwE+7NAUp0 Twl0Z37iEUKHEWy8jcocapCaR5QuOv8t0Ga7CGQhNGRMgySxx2IhmOHMiVW/2xwJ oFN/Zqe6pcFuXFhiuHOXc9Z5PpisEjXlYJf60rclitJC5RvHyeNlhEep2lWXQZ1s Z9DdLom9olO/kvt+qK0qdV71cCNgNFQwvtHxYeKGh3bAEI0vRt+F6w== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/284CA2684B8B5A77

http://decryptor.cc/284CA2684B8B5A77

Targets

    • Target

      mrt.bin

    • Size

      117KB

    • MD5

      eb27b1f8be971d6dd9ff8a41f6075995

    • SHA1

      07a610e3da08d7be94c849d75b2672935610a919

    • SHA256

      f5761b03f6541c1e407eed46f02c32f24adbc1e75682b1093e7e08684df31ac6

    • SHA512

      f24c9699be2d8ae3cca9b839224ea5f88b26f9102be16492cb759449a749a3df5d4a810e9b7eb36947629e0238fea5019d985a5220a3c677f301f7877adaf737

    • SSDEEP

      3072:6h/v/aqIQhwIgM4spJgFzCVeWkZlS69se:o/vf9hZgMFpeFWVeW+p

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Sodinokibi family

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks