General

  • Target

    7cff6af120a8c228777d75ae8dce959a0c611715c5b1a01c40845061510f1d3b

  • Size

    399KB

  • Sample

    250301-b58a8svzay

  • MD5

    c7cc6b74e2b01924d490620d9ded6b8b

  • SHA1

    f59da50335fdd501cc2978a387d4bb25beb9fa1c

  • SHA256

    7cff6af120a8c228777d75ae8dce959a0c611715c5b1a01c40845061510f1d3b

  • SHA512

    543cc5ef18577545e96fc8270fd31fce8521c055345d12aeb9d01ae23eb44e85373d1f3f4826f82935b4f36c5ad4112afcc5afd47b6b50f048dc2081ef5cbd7a

  • SSDEEP

    6144:0WriEm+ITKwayXwXd2AcG/dUFQto2mYaTev7/VvaICSLLTYl2JQynr:vriEm1TvFkCqtoxYv/ViIrHHnr

Malware Config

Extracted

Family

sodinokibi

Botnet

25

Campaign

1226

Decoy

goodherbalhealth.com

kerstliedjeszingen.nl

mjk.digital

zwemofficial.nl

sachainchiuk.com

global-migrate.com

slideevents.be

eafx.pro

klapanvent.ru

teethinadaydentalimplants.com

motocrossplace.co.uk

b3b.ch

fotoslubna.com

bavovrienden.nl

espaciopolitica.com

ivancacu.com

breakluckrecords.com

goddardleadership.org

ya-elka.ru

line-x.co.uk

Attributes
  • net

    true

  • pid

    25

  • prc

    outlook

    isqlplussvc

    mspub

    encsvc

    onenote

    sql

    visio

    ocautoupds

    dbsnmp

    thebat

    dbeng50

    agntsvc

    mydesktopservice

    wordpa

    xfssvccon

    infopath

    ocssd

    tbirdconfig

    firefox

    steam

    winword

    synctime

    excel

    powerpnt

    msaccess

    mydesktopqos

    sqbcoreservice

    ocomm

    thunderbird

    oracle

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    1226

  • svc

    vss

    backup

    memtas

    mepocs

    veeam

    sophos

    sql

    svc$

Extracted

Path

C:\Users\e71f5-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension e71f5. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7AAFCDDB6C021947 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/7AAFCDDB6C021947 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: lmWAtgAlzJFRFt7MW/hOZ4VO1ijbwp8hEj3gge98P7L5qZO2Yv5dcBPYEcCzhJnT teyrSzQRpdIhpM1v2nlArfY7d3kQSY0IDcsP0RPB4ao4/vyLsT5U83ctWLdL2iRs mgbqxY033/Jj+qghODawk3mIvJ+GHiw5W4vFUTwBdpZU+Gv9G/AlsFkf7AuSewrH OCE81oLOgcxnwihpVhBZ+UtswMEkOGoRmL7CdKP7qMO5L0d0n/qc9VR5jx2ZNS35 Ta7RFm2LlXQUoxxw0NDWnLYTuBYSwgvKhjz01c8EIi9vh4CVMghQOuG0LmhXGUhH fPrZ3AG2DXK2Jmip9ttgJbP6Chat7pRGLeyS4N1MN3HW/cl0qZlxt/rGNwZGV/Aa XN/q1cM+ScD8jW9muxLRC7ZNIhMFCN3B+8t4GRN3eBg22p27QReZOB3ht1YawfFg P/u1fSR64feIRtBcp4o3HnV1cnc37o7CprHU1qzbHRvIveuSKnYLyMuKClsoVfY1 lJEylMjc/BMyVXf2aaseNlsCz79VPSuM+qrH0mYcw7yyo5kMnFvQZdzzbAO5Usie 8cmQ+QE2ElBa43LmP4GHJW3eYvQ6R3KEP76BM5gWjTOe8atDcdse0G9rUBBO2+Uy b96i4icPj0kCMh7He3WUGqvIVOaWYYu+ZvJf7iuDm3S2tTQ9854m65TPWmWHnndX v4wGNGxyvUwAXH2+7FCdtoif+YJcHy11rG/nQ7e3fWQR83sHcR/b8tsk+/F641uc BvBVIyDzIURJ2qHyfaFOWVGd77k0VJgtFWUTLErcV+m26vGGYIGIO8PSEL6oBJo9 jJIs4QOGDjKFDjh4Crk9A4ocLS4xWWEH5PcwXEKFfN5mDZ1URnBfS+j4Sms92IDN ORpAFwVGQSmAKDWda4PTgaidNyajb2SHPTH86x1wEu2+9urp7n7YtsyxBLvcvi3J ZMMV2LUYCowuS9XNlCwlxcjwIAATMaE6Je8mppm8recHV3x9PIPp5wV4p0gd1GkR 88UTChbGoitw9bbavk/redQxjvs+UYF5I28NHJuoC5BGbmMCmuKZLYLIqyxjHj9N 2CeLozXLeDvEzwupS6MYl2nfyMHm7bGQmg9IoMprcdYN3M2wNke+37yHoK7x0nlm A4WhyI9NX9E/CgK2Qi/qMtzBwiYzEqSE2q5ITunguvHjIP27MHJ8j8D0Iw+9UT9L s0DWyMcbKzRKEg== Extension name: e71f5 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7AAFCDDB6C021947

http://decryptor.top/7AAFCDDB6C021947

Extracted

Path

C:\Users\23ki283-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 23ki283. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/17B52F073E35B825 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/17B52F073E35B825 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: sf1V/zgdxcI1Xth4j8QhsGUhrHzztWneW931EofMWqu/HHCaXBbPJFIMhhtDWX6/ FCJZHKbAhiO5ie0PIXh3ts9ubhngexPXfjPkyjhHW4lDDZPE187GwunhjwleVPPV ihN6LlrsoHvIWqcfGtD+nUnotNIsuY26ly48CrF6nzenNv0BtYaGe2rLuqh2t+IW 5jqJKKQhzK6ubT3PXum58cMqoI4XLvhhZyQvKo3cDqn261T5DiJPWPzGDnXRZaJC mHU9Q9r7HJjln/BcWfZyCCiOR7xVWGbgHB6EeEMERaat/JAUCZpmMPElFjybkVuY KYRSY4kRmA3sYg6Cf4j0iz64Q6OQ8Rqx9/S5qnwCEPuOfaRTtWbx+3WsuS0pulwr U5sq2tVioy1toEzPAxEhUFQIsOj/x9AI0yGmwsTceiZKq3PGh78CPvR77YsrvHp1 KUK0r/Z/tqFs2m2AiiCFCL2IKYFLIj4NOVUtyVfED68upFnwcxVWuG+S08XTuPEB O8Z7U2h7AgsBX7srp/91/3DD3ADtuJp2tHNj/Hnq5Dl7ekxHHZB/ncacHBdlq/Sq 4TJXUp8Dtkft+/rDsmWMeItVGZVMoOWwe5H+fYD3MSaB2p2fm2h657UzqTkR0Lqd CDSFBGn+CCuSMtXnEkBHN9+6qEmV2tH8yUOwvjrIIY8X17HfT8Qk4Z0jCsiRHcGd cjGuEcqJxtZTWNYCWHZ4wh6DSItMBgLBW3qhxn6eI+Cn+uHi3Jj3JGhOCrZl024p whs3arNm47eyHpd9Fmc8Y0qNO9XlEAwYO+yKDnElHyASQCXOPj50C8WNajW0XKLA 4AZwE/rEzZaSLsizDarS4FAWV7kSGbcehi1MP3wUNC/lznhf/dS7KCN6fAU2vSX8 mvn7VSmjnaEwW7T+GpdmJmQub9BgmUTS+DLSG5Uqxetx/CbEzAjFsbeb6dyaFnW+ 5GZRUhi1bBNIEBqqmzX3yvFSqs3Hqm1XPtugCsw/+Sv3zD89jfSaY4HSTMi0Jmnn hwyiBaEE7/NWBaYzZtcKqufTGWUCYNtSnXwQZ5OrMSK2nszbxD5105afMx1Mf+UP ScKqERTGHbo3eYL45Szb1ZTO+t2OOg18FX3+gy5/v1xDsZx1iuft0+vcMs0ATVLZ KfSU7g7TMiT3PRZPq7GMIGAXQRGzCR98LSa3eqwGAJZlV7+z8R3PuiP+LsLB0dZ1 jz+natJeCJCrpzsdphuF1H/dJjI= Extension name: 23ki283 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/17B52F073E35B825

http://decryptor.top/17B52F073E35B825

Targets

    • Target

      7cff6af120a8c228777d75ae8dce959a0c611715c5b1a01c40845061510f1d3b

    • Size

      399KB

    • MD5

      c7cc6b74e2b01924d490620d9ded6b8b

    • SHA1

      f59da50335fdd501cc2978a387d4bb25beb9fa1c

    • SHA256

      7cff6af120a8c228777d75ae8dce959a0c611715c5b1a01c40845061510f1d3b

    • SHA512

      543cc5ef18577545e96fc8270fd31fce8521c055345d12aeb9d01ae23eb44e85373d1f3f4826f82935b4f36c5ad4112afcc5afd47b6b50f048dc2081ef5cbd7a

    • SSDEEP

      6144:0WriEm+ITKwayXwXd2AcG/dUFQto2mYaTev7/VvaICSLLTYl2JQynr:vriEm1TvFkCqtoxYv/ViIrHHnr

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Sodinokibi family

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks