Resubmissions

05-02-2025 10:46

250205-mt1ykavjhm 10

14-12-2024 14:16

241214-rle4cawnfn 10

General

  • Target

    malware_006F0000_dump_SCY.exe

  • Size

    143KB

  • Sample

    250205-mt1ykavjhm

  • MD5

    b3b9befbd8753ac8dab26e4d4e5727f6

  • SHA1

    18e1221cf431f52310f5c459bbb013600e8d55ce

  • SHA256

    c293a4033debde88239a7dfbb5fdce91da96dafeccbeb785a7cf83c7aa769091

  • SHA512

    0bbdb8746193370e3dab8dbf5442112b217ea07b57aabb8cc550a4b270e84b33e49f314d0db53f5aa5571746d33ac790e424479f558bfc7255cd6b8a94508642

  • SSDEEP

    3072:2D5BbEKoxWlcLbi4eTMlwDCnu/YGB96W/y1cL:2DTb3UWubnWJ/RB9wcL

Malware Config

Extracted

Family

sodinokibi

Botnet

5

Campaign

367

Decoy

craftingalegacy.com

g2mediainc.com

brinkdoepke.eu

vipcarrental.ae

autoteamlast.de

hostastay.com

gavelmasters.com

ronaldhendriks.nl

successcolony.com.ng

medicalsupportco.com

kompresory-opravy.com

sveneulberg.de

oththukaruva.com

voetbalhoogeveen.nl

selected-minds.de

log-barn.co.uk

fsbforsale.com

jobkiwi.com.ng

ivancacu.com

11.in.ua

Attributes
  • net

    true

  • pid

    5

  • prc

    wordpad.exe

    outlook.exe

    tbirdconfig.exe

    agntsvc.exe

    thebat.exe

    mydesktopservice.exe

    sqbcoreservice.exe

    thunderbird.exe

    ocomm.exe

    excel.exe

    thebat64.exe

    steam.exe

    xfssvccon.exe

    firefoxconfig.exe

    sqlagent.exe

    ocssd.exe

    mydesktopqos.exe

    msaccess.exe

    isqlplussvc.exe

    mspub.exe

    winword.exe

    sqlbrowser.exe

    dbeng50.exe

    sqlservr.exe

    oracle.exe

    encsvc.exe

    powerpnt.exe

    dbsnmp.exe

    infopath.exe

    ocautoupds.exe

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    367

Extracted

Path

C:\Users\Admin\lx6t6q7jd0-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion lx6t6q7jd0. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/2337298C8EF3771F 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/2337298C8EF3771F Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: cWps1VqNnVEOC3jKkt3bM8x+MfSyc0dN0/FWGKIS0WnHGKV8v0T3eMhnpZPTCowS BUEMIDxzCHpiK6Qa5jYHGja1MI44icj++9uyZAJCVHgTgErGIE73vsa5t8iZccw/ mhSiNUVvKz6p3EOEBbqtt5hLVlOrGsTYBtp47e/wWeQAzdc5O2qLr0KkY98IXu6m YjbL2Ambkh8pz1WuJX5IZfwsqRAMtEd+NQjS2zZRtu+f0618jICjuBxvi89w9OOD OjacDtpc7vU5BbaqqlqiEbYuVINlTP8s56kjC1PM8mT0+Kn2dWtTb2LnJxUE4U8O bDWql83iqhAMhYCpbXh5WNoX313VjLNngpzYC3C4dgr9jS1Gf64i8pZKJ0O7064I TLCspp5JDtzcrIxCyFLuHfAHzz73SHyp3ksMKu9Kp5Uf1OUqoJGyNmUnBMBwBw1Q w+iW/H9UdmgJQckWHt8mME+bY8Z00WbT0fqaLMgggRgaclMC29bWieJb3mgvwVZl ZvTjH/HKAp4/8mJA4j7kQaeY3DSyUeAf1mvOytJvLfKa6QT7O1JaqGEOLJfRUfwV BK0geN/oCJgf5aIuwJGZIJ8rPfBzokm/bQq/zUScA3uyLjfolzYoOR62Ie6ozw6I 6bDuQH3Kietr6noGITjH0CD0rQoJ3DRox7Nah3SLAhr68erh0yR/rAYJUbKl5/uf 8wTA2p+YXGnd+CA9xexAYlgq9Z6/4XcACl1AJq7dlXmMd/pJuw1DkkqW0vokG2Y+ XQnvbpFmJ4EhKU3WtAiIeEmuyCHaB9TGqRv7EABFonGJB6xmkNkQi7ocAWOwcy5y +/Bt5Kk21nLQQbDzq4awvaufnaSEcvUQ6kakFuAD1xmyvkvcQudKgce6+BKZKyDo c0awBYQCxnoCNuVpDqTlYwsawmv9gyyvbpI7mSaUhm1B0vzFzZ+8EN4vbTrTgsms b5zi3CF0iNQl3n8Hk4CbqvBN2Va85ecqoDi1r/aKlq+oNrq1JeltFx6CwAdHhtoj mpebRG5D8cSdNW87wYGO3uaqhTDczm9qmcwekSfGXLhxZPHvieDuGZ5EraRdIuZS nKFJfvNpIUBysP3eHI5le/b1dQkDcUMoIaiNkbPBqWcZ/rJ0ms6QY4odZq+NjesF nTx8dqHpXTF3Vg3wep8AzdkiNS8g4pOWPwswO59b58YSMCTaiQUguVc9OQK91MWk JysvybgHIjiwKO/8/PvIsQ== Extension name: lx6t6q7jd0 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/2337298C8EF3771F

http://decryptor.top/2337298C8EF3771F

Extracted

Path

C:\Users\qe9tzu-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion qe9tzu. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F8B24C8F9C45B6E1 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/F8B24C8F9C45B6E1 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 8liftp0kbmM3FyL7et3Sl8NL4bb/rTNtrCoIWVd3YiRAYMNJtjO6YLe0uOcxbx0S o+hZJqw9RpmaYzeaUCAtuPl7qqQNYjmbllGJVeG+rQ/unMATJIVhe26VoRNKz1ct fCw9Fl2QUW7OHZENqvHnSSPHHa7YIz4tnm0vzJebI1aIpH1c6dY98eqr+N+Vha9n 3XHOrqVYoWFc8Xkf3n3qjWCH+g13gv0sm7BYgREtmUsYYjL17AqQkkYFHl1SNFjb Ag4Qz6qjfPUPGj3s4VdrPzdvw1R7KhJrBYbcDZWRva9R15sv8NetZ43lQZla24F6 6Ub/pNqYbIfFgrIb8oYuHmSF9q93IgG3BQOH5MfTlHDED2sw4mTj6Aaphm04jmBV +Ql1deQhovZWi1jse+d8yLqs2exq9Uism115FyXazueQZL/3fovplIwLpQ4ZP9QS DRpe7UzcBkaXSWbIZNs1CUFxjhmBp6/bYtc06tARHOqLLAY6C/4ifrJWf4EfUmN7 9NeW6HsJDdn2zWW+w8s7q7Z2tG3gu4afgH8M7KzTgWgDpKDQQm5fwIOT9cWW+OyW IX2Mfs3JPVmJOGSPEoe1LsKuiDOgvctJbIKd6/ZBgFSJmliUTMe4gcppwZWLb5XS xSClDl6VBywo/0n94YKvKizhkzgxZD7cQbwvmCeN/V7W+7EMbYMwvSm6JfvNOAmE 5oRwEXZlGAiuoh4S/GgzLk5LUIeRyHXC2vWa5zzpfcbfx9APvpsDsjNrrINAwwUb 8UqAHxiYwKqzoq9iOF8FPaHjp/5fAzemzI1fNCavkCForpNtOptpfgVbz0iN1GTU QxbD0zPF30xngcgTtppmnwPxSzd4bW2h4vr3CBtyLz/R5pAHU0RK5gimwPtuSTzT y6wSz+xnmFD/bSLHJ5GQvEfHsaYe5lH0IKhwqW8E+/vBq1/qOzEtMJP9jEKt5KR7 A+3ItXGtR/TPbw3Ptvh1JhWjShsKCrknamnXzgA6dYK8maMoHDelyPTQTHdvxnI2 Mn9gAL4TAQMsA8HpGOFYFUz6KvM8KON4baoChcMvFf8JzSP143PqiWH0VcG2R/Nx Tt8w14/HB9Jq7PUwUvQdO8n4q5AVuvCwqF4S+BKuMLvr/MMk2vmLnjEgmc8rTWlW N6kaAhLu2rsMFEpAUZOI1UNW+W0PwxW/W6JhAVyfcivRKMf/LT5eJB8rUZPdbpAw oFIlOJYnRjqD/v5/jPM= Extension name: qe9tzu ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F8B24C8F9C45B6E1

http://decryptor.top/F8B24C8F9C45B6E1

Targets

MITRE ATT&CK Enterprise v15

Tasks