General

  • Target

    139a7d6656feebe539b2cb94b0729602f6218f54fb5b7531b58cfe040f180548

  • Size

    157KB

  • Sample

    191216-4rcmytrrka

  • MD5

    b488bdeeaeda94a273e4746db0082841

  • SHA1

    5dac89d5ecc2794b3fc084416a78c965c2be0d2a

  • SHA256

    139a7d6656feebe539b2cb94b0729602f6218f54fb5b7531b58cfe040f180548

  • SHA512

    2b62f0e0b017ed3d2dc7103d2020604f15f95449ba842bba18f886f9e1dcc977c459c53d1e6e7abfe6b99fc3dde24f5cc7a848c92443d1daf3574ef6f0263284

Malware Config

Extracted

Path

C:\Recovery\43s40i71l.info.txt

Family

sodinokibi

Ransom Note
Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got 43s40i71l extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B4D1C7A1B00D6DFF Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/B4D1C7A1B00D6DFF Page will ask you for the key, here it is: w9Autyu791gDcgvJa88bZEMg0tYQX4sIbUfcHkGQUMeWFlK6N9VP/PgmIpE3YxRM ohzlunC1jHPFBOdG8RQH5MFeSpaYJbff7dmrp0Sa/AMxs3Z58AtfTxxtpeASEXJa YSuteCc0crrZMVRrla9rHduzsA/Hxb9ZD15zLSkGZoDH1T9bcYhlDN4cX6bLJsFl Euap6XWWIQMNIXySYnG/MUylyFPkq/La2BAwmdqLsmXVntg/rRvfWEWj2WkbFHKQ dXGi3fkprUaMh6C5kiyLS8Lr4uY3pymcRlPD4Js45f88q4XXKoYdX4QiFv2Fu4pF 0GiQByslCAww57WYLXF8xDTp+cGUUIMiKVcUDXj35BgZEWo2Vwii9LstTbI0DaDL 8HpAZ5rirtV8GyQsSwjg2qtZ+FuE8AM5YQ6owC2vCGKqKG/C582gl3dBHtfP/6gv YYb5NKLnjY2hi6N8K3HJnWIqj7b7T8dWGIOmk1qnm7BlLzRumMkzXv3QTbtNH1C0 58g6J/bu6ZnlEnru6VCJE/dIz6SBxU97uzxvlS/huie2dDK1JPpzShBWA7tz3qBx 5ATFVR5uW8Na2dJ7zJeJItOPDaSHy6/tqxi5AwE36xosIIMh4ARJh+gbI4LTcdJ5 +2AmtIUf5K1SW6vatp2SJSEQqUOAjhagyVb2MxaU0MrHpTc0a2cmLJAvFe5qFnZv wp1fbuFTCNvDCLZkNXx756is/qnKsX7UbzIDFZ/tz6i54Kfr7RdLikAf3VoKfE1n 8CH4WM3RVy6w3rV6x/zQRfIk3rTprcGipbnCBLyV4kTA1G5ctaDpSj825FSTQ/gs NTNQEPFOEyZPkLiTm6eu3TxxrtL/lfMCiKx5tGuKyAYHDgQe7fO6PsBXSPbbu9o/ HbPeysq5oP0lWSVzZfFLYaAiUukw4ux0747ahw5WqF3esJPYrZQEWptLQILabRsI JEhTSiyCoJVn2pm4gk7pub+b5IIfskP5DNixAFAM6w1cAZndhgj89M9PkawMY9X+ Y/TGxatmIpdh/v4JusSEST6BTBd4WHeOd1x9QJhyyXDErIrfbl56xRZSd0nxAszP Gp+fK74qHGJ1oeJA7HBBa1ipf9pG8083
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B4D1C7A1B00D6DFF

http://decryptor.top/B4D1C7A1B00D6DFF

Extracted

Path

C:\odt\0c82fz.info.txt

Family

sodinokibi

Ransom Note
Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got 0c82fz extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9071BEAE98BFF0B5 Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/9071BEAE98BFF0B5 Page will ask you for the key, here it is: e9sQ0AC6dLlu9XCkIJ3uqyP84i4Nq659fDiTSzUBcI3zh9GLggkQSRJw97HFyigA ImRyJK0Kfs+jDWQ7qdp5wGh2w08vt/181VmYnf5LSbM9zgjchVdXfZ/GuSGimKw7 AaBCPU8ynYn/o8CoeVBhc44Io5TyuDWZ2kl+V4PtXGpQiCmzfvyAkjAD9+/3vtBo LKOu4+sK1I8bvwFALFEmLdECoTJ+sDLb1LVn+h8iFGwcwPaa2Xt82R3gjm7PmRl+ DOpIS3yKF/ji/nR85uQgdfOg+KIGG22+JGOhK+GNsqaf+WwQyuJPw/+4Q22+Ev7W o0LEO3gauJzv0jsrxshwDjpTnK5pH6ZI5Q5Ykmn7oVmri6L493P5uEiBMkplgZcT 66/Ohws7HocRdpHnevIqN7j/7YSKVzsvn6bUr894XQHqx/dXDoqTd/2xMVwVMBA3 YOeH+9hrPbqkx/rv1o+cqZXZ5hFUtfeeJqkrIALfF6DVyi7KzOAFowgBjH5L89CZ i1U1qXwPhUeEB6UImmBB53nR1FI2H1BEIiUolBuuK5kP9BpxH4znvuItMCZmNlIL MuZhZpMc8mtb9yMAg/8GnggpU1WOL+rpn4evJtzy67yK/Ioi0eXzhCYP5C6hhpp6 Zw5hqlIdXy6FjgIhIU8fdIdJMa0BZt+9HGKRIMIfxDkNLMwhi4zhUG/hUao34PON tkgKkxpht8S/JjYVHUwdW9lvFwY4bd8X+/v0zJp8vOnPmylsJVyada+ZXX/0d27v 4msX4T5uPYecfoALX7DSCzQuu/Q6pGpZks/HHwwUGA+fMgMYewce6pKQ9lwlW91F 487tO32cYN7tzL928FHnw/uPRyHq/806IKmHdGjmIT3i692aLgY9qitL63dpim8F jwG/9Vz5TBEEnIfrASRVg3ftO2cBjNFAd+GwzH5RYjeF1JXoyGuTMDgrggZUPMD7 rfnIarRFge2x1YFnKs2WK9XXtfCIUtSXxf5TZjfXrKkjbnPC6Ca+e/ptXt23js8D dLmfZ2pW+YEgf4qaMYrMpRhH5VNEBnGVjY1VpPyRVIknL3cj9W5kwtY30rUFJIX/ 5X3l8zTBg+U=
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9071BEAE98BFF0B5

http://decryptor.top/9071BEAE98BFF0B5

Targets

    • Target

      139a7d6656feebe539b2cb94b0729602f6218f54fb5b7531b58cfe040f180548

    • Size

      157KB

    • MD5

      b488bdeeaeda94a273e4746db0082841

    • SHA1

      5dac89d5ecc2794b3fc084416a78c965c2be0d2a

    • SHA256

      139a7d6656feebe539b2cb94b0729602f6218f54fb5b7531b58cfe040f180548

    • SHA512

      2b62f0e0b017ed3d2dc7103d2020604f15f95449ba842bba18f886f9e1dcc977c459c53d1e6e7abfe6b99fc3dde24f5cc7a848c92443d1daf3574ef6f0263284

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality

    • Deletes shadow copies

    • Windows security modification

    • Discovering connected drives

    • Modifies system certificate store

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

File Deletion

1
T1107

Disabling Security Tools

1
T1089

Modify Registry

3
T1112

Install Root Certificate

1
T1130

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Impact

Inhibit System Recovery

1
T1490

Defacement

1
T1491

Tasks