General

  • Target

    1afb4979e4e6ff85fac9509f13d002adfce88da1a8cc716201996b616d8e9561

  • Size

    274KB

  • Sample

    250227-yq9xvaw1hs

  • MD5

    f6e66fd7f84923e880ae8b9ff186c82a

  • SHA1

    f553513fde4fb0a3c4c1ead2437e74a5ebe3c1f5

  • SHA256

    1afb4979e4e6ff85fac9509f13d002adfce88da1a8cc716201996b616d8e9561

  • SHA512

    ddad53423b4cf6ab3b1c5b5e9b275d89bd56a284e2ebafab8cd1c4b0e1c15ec8b77cf136f368cd6089958d7f1cc88f08e59ff7daf63e7238fb9de3450e7898c9

  • SSDEEP

    6144:ow9vteqJggn7oUfFcLWeGbfUTpYDDmu/+3fbc:oitgi7oUfavG+pG/Yc

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$rsIIyY2dx6y5j3gb1T189ee0VFXB.0ImN/bN2vbUcjxBTG7Q6ZNTy

Campaign

3810

Decoy

ki-lowroermond.nl

facettenreich27.de

tips.technology

sporthamper.com

ontrailsandboulevards.com

kidbucketlist.com.au

vesinhnha.com.vn

you-bysia.com.au

zimmerei-fl.de

blacksirius.de

sportsmassoren.com

lorenacarnero.com

citymax-cr.com

braffinjurylawfirm.com

caribbeansunpoker.com

atmos-show.com

webmaster-peloton.com

liveottelut.com

tanzschule-kieber.de

nancy-informatique.fr

Attributes
  • net

    false

  • pid

    $2a$10$rsIIyY2dx6y5j3gb1T189ee0VFXB.0ImN/bN2vbUcjxBTG7Q6ZNTy

  • prc

    powerpnt

    synctime

    wordpad

    firefox

    encsvc

    msaccess

    agntsvc

    xfssvccon

    ocssd

    mydesktopqos

    oracle

    visio

    sqbcoreservice

    winword

    infopath

    ocautoupds

    dbeng50

    thebat

    isqlplussvc

    dbsnmp

    thunderbird

    tbirdconfig

    mydesktopservice

    ocomm

    sql

    outlook

    excel

    onenote

    steam

    mspub

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    3810

  • svc

    sophos

    backup

    sql

    veeam

    memtas

    svc$

    vss

    mepocs

Extracted

Path

C:\Users\8c74h89-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 8c74h89. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/833F1609957E6161 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/833F1609957E6161 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: s/ixA8LOePAxjBVI57AJfEk4EMez8akArnKBcyHlQf0MKNPqCUQWXLV65cJ85AIK 3a2hSCCOVh98MPmxXhCM6ttSDZeOgwce1C2PaZvvRR3/9LteWoWo/HICMIkeeWPx /QmJo94oYuIC83OHxase/vu/YqRR58q2abIVyKq0k1fD6eHQShigbhHF0KrCXGgg zHnSCr2rnG5xP8ww1iLNIQU9XWRTv1N6MiIwy6GXd1rbTscZvcApZC7HpgTq8cW5 jADBhKgoErV+xbSqj4mkEW9E2K7tm6N50B13n3o3KNzBEsxRPEx9ETfMEBhSp8+C csMjdsMCpc0umEnFLKo+3f2HrLl2nlVTFrOC9A0bkOnDENIadgNx680xVTIv7SMY j+eqRfAnC8McOgcEKBRoA4HGOn4UkuWu9sO07tRyV9Eo9xwz6G7FnXdXW3yjrjmC S4pwOkI27pZY81ds04++RqZ2zyNYS8OMzpxLRynnTjLeWGF4KpKkc6M7WYm6u+eA 59hBbBawDCHEHH2Z508mKyzIbC/nAlrmes3usn2o0wPwcXb75cdvcKujFzk8Us8Y JzPjRMXvgAbDfjXv3XqmDqCDOfatlxI3YZoSpeybsf3lrIOyzvFfaT3H8HLdpxqU rlvVVGIT2wjNaDPx6b8zzE6u5Mik+sFzpbUDodp06oP5qlSf+dN3ImRJTnVxvZey XBT0grbE+phJYXS3OffJ7kHx911jE3sk82HtG+x8Gx4O8CbqKZWDTmVa3IIYZ4iA xWc1KOBcSGuQ/EWzPxDiAHMCgrzdHDHw5qO2bCkKlPl69zXPxyhr0Mo7ODvXM9FK Pb2qLJ9sy3vULpRISdwHO/TKYQSvw3P1XgIfy13eCDh9YNxbcRE5ldFHN5aIJK0F SfEREJTQ92X8I4lFLGo60pHwHnVzRgwGAu48I43zxqnuOroS15VkY8r1p9i3BK2+ pZq64/s7fGp2+7die3K2u6xXAFIvMbdHJWAt5jl2ybLVzk1qXosMXyyT5+jbXwlz kj/TxyC1M96MkIkYzBpmaSFuDUz1fsAsk7Ta5j98f6ArT5bE6ke07jZbSOGe0bip B6EOLdXo3Eg4K6audKlL6DReRr2qxYcy5AVEShJfHhyZ12xcjaIusP6EVW73vv8k V0KN+QKvOYWgqCEMpDPpVtespGPOtPZFccD+p/EVxBdBj1IRbQqiNraXk75M7M0t Unn9auJOUlo5BlYFdesMYQVR7plu4Rh2pgHI5s7WDdubL8dJoxlE9wFBICiYq4yH PLeMG4zeXFSQYzOMwIjgANhZCIIGfZVEiUuK2Y8rMMpcQRjUCAycCJWHaJYXBx1j ZoApd/ZOL89AGtf2xFqxhpcmkOa9uYROi6XXXvM4FehAMA== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/833F1609957E6161

http://decryptor.cc/833F1609957E6161

Extracted

Path

C:\Users\2us7rm2k-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 2us7rm2k. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B071C623D7E64A42 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/B071C623D7E64A42 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: z/RCAd+MbH4SmWysj6/fSb9XU3+gy9JddpEcqvjpOE17R6MiRWKgCTMig6Ii1uCc XbmhmapdaJDnOgyvcKHhitjgTPVgSBnJnjlgPwY4fh62QD3+vbwObRvcsDAeoNFK ZgoMIoXqSrsfrqb525mo3eeoeKjioi9n4rvYTM4fxvKrjy42gTWAAiu86uH8v3nE ZawuqoN7YJQd1ujfh40HTQhzDVlEUqHEvfMKeV5UxhhGVRn8eVmG1VWzODDJHcP/ w2x9PqszBiz75P8ORcAlg6u+Ny+WXL/B057Jt1J0Rl/qPrsFfUk8Odtb38HMMvLA vcmNjlT1mIbjXM9T9rtkgcoa4c8wXfBa4eRu/U+i6o0J7c9DVipA1NZniqSrBQMc 06UpwrIaWAwXVFwaeNf12xSgvMYAsQKtZO6cAZ6kPsA/1CDfKzamMsDaDgkN4d2h UDMEZCdbKn3qzClEwWeVRwW+hWSQWTn6GYH/QYjQ757txaiI8f1Vgwv5p3vRjh/F +kJXrMVCBGsThflyOw/LEcWsAVmh97gfDt6HN2qj1ujyQsb8Nau+IkvPVYRTqsQN aSmyLdmWw8gNEeUpl3/1UogN09ObRdsHtZwaF2deXU0csNnBMAc8BgrOcJqt7l1F maM8WDJNk/XcrVGCdVrPARWKlMxjVCwbPmqHpwd57vAoOgRoXtne/oCA72YWXPWk 6vg+4KkO2d750eiAr9BsouKw9Ez5pjcGqncFHAqRSPGNl7MZlEbAA8+yeI6VsTi0 2xCgAC3RCHF2W6wccyRwLup6eJ2WGGnjTogIcn9w2OmfiDZzEJiflvzBidkdMvJ6 p6BYGXcflLZ8w9/mylD3Ly0Ch7Ng2uLvUzZlmmLrqyKNHF3P470kuawI9u3H6xWs 990x4AJCVpmApbC0gIbV0EbtN65g3eXfcBUqihJlbgvNWOjNwNFSGM6GULvi3JHI OYNMV9IxCjU7bxldh4JE2yEuV2ezjJPn2mbP2OnYzAHWM753fwgOyFJCMlNptpNF TvsdfLyuYJwGUTIPsZXsjg9KjAlbR5zpZFZPRGGheABk7vMpf5hjz9C/q1TV4Xnf 7Z5l23lvEs1pvqtLQ385osiwaLeFEU4creW1ORk6xt13j39NOjNvZw2iAFo2JYcA UI+p7H/ZOdevxIHduuWL09T/4zHQ9fqdXyIgS1G0/Xck7SH8pFNUhkAsT2p0oCi2 TE53ViYz9A9kccFVeHz/jEra2jfSio6D+Xa0icJgNbQolZ6vdgs3o2QPvG5xmc7s 6YmRjkLVqh5GLGKZE6LWzg86ID4xNNCLCeGbUR9XMxyqqKFZsribDCHjgZWzzLLM KX4/vbGph9wo9z8gr6IObDN+Pi6Of0GZvY/i7hljt2yBfV8SS9GsEcDM ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B071C623D7E64A42

http://decryptor.cc/B071C623D7E64A42

Targets

    • Target

      1afb4979e4e6ff85fac9509f13d002adfce88da1a8cc716201996b616d8e9561

    • Size

      274KB

    • MD5

      f6e66fd7f84923e880ae8b9ff186c82a

    • SHA1

      f553513fde4fb0a3c4c1ead2437e74a5ebe3c1f5

    • SHA256

      1afb4979e4e6ff85fac9509f13d002adfce88da1a8cc716201996b616d8e9561

    • SHA512

      ddad53423b4cf6ab3b1c5b5e9b275d89bd56a284e2ebafab8cd1c4b0e1c15ec8b77cf136f368cd6089958d7f1cc88f08e59ff7daf63e7238fb9de3450e7898c9

    • SSDEEP

      6144:ow9vteqJggn7oUfFcLWeGbfUTpYDDmu/+3fbc:oitgi7oUfavG+pG/Yc

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

    • Ramnit family

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Sodinokibi family

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks