General

  • Target

    06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe

  • Size

    252KB

  • Sample

    191216-4zdx1n374x

  • MD5

    1ce1ca85bff4517a1ef7e8f9a7c22b16

  • SHA1

    f35f0cd23692e5f5d0a3be7aefc8b01dfdd4e614

  • SHA256

    06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851

  • SHA512

    6e67fa01a8792453b148074fe027def90e1d3f6042037216986ee9e3d0c436c177764bc5e5900dbbab91e10d8a3c86a2ea04ef547149bfc92a33ec0236759949

Malware Config

Extracted

Path

C:\05vb6je9-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 05vb6je9. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/566484711914F5F1 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/566484711914F5F1 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: rxaK53ALfFGy4622EI7nauMFpFvcU1PxDem3WfU4QyAJmXwkVspAsecIliVlENVp ifrBlPOSfnI1YRS3ax8jcweiLJrpA4g5HCKC+hyd2P485bMkPzI0O+AcQl8lbJda NNO8Xdh5XCZ/Dd/w6r7CHOgs13AD2YmxTn/dCR5huuXX7msfVT9nHqZg0HH4faS7 XSyPg+IQXQsci5jfAOLTvx4OZ3rdQWYC/sEvJM2dxW7Y1eQozPQfU22fw2CrBf+i K20DunLT+L8SH82Wa4r/SMb7R/b10ha/zoEIu3I0jn9oEc9Jp+VrXn4B7rpuGkOU 8QzXUMZhrhgydgkxGFSNGCTcGmgKYio+2Qhc5zEpfzD3X3aMR0wKIlxwVpHjhMCQ kkEcQM2Etri2wz03mKU0gI+TGpo12E0Rvv4xT/VjK6nBMgNfD+GM6zTYfjMqTSxy cJfu7aW1ctfR2e5VFDppYqHKc98K/LHHIi834pSjEBpAT63HiWLBw3Yc/AtPm2Pb FYPrOIKxvEauTwVfnIFo/hXB/Hmm9Wh8tK/trgQ9entkLyA4a5+T5Wn8n3zWndQI mUTD2pXx4VOG7WfKDZhmEBhuQRnc+Ekh6xTYkCekYn2HGCN/Dvf2uiRdXfX/m2Er jzjcwj9ZRYFBeWDXc3R2b+8P0bqRpjuB2jsgbkC6WfrRVwLlJ7sUtUnuqnpbghl4 Zn6Cv6T0y55vm1HDhBKOcISF8H4oA9XYnFYH8ZxOqt9rKy4q+8Rq5a+Lubbq1aJ8 F6NEjxl2yoL5cp1vXT3+5NEQOoydzweabnZ65PwNFHXw7jRw6jCByoMkh2wgavAN uff56lUgaCvLoR6bzKcLRLcQMs3TfPTZxkY6SXSRL7G9Xtt2gmInVoAiD3XOVIkY +CXOdZQbDlCvmpEu7gqRHX4gpUQrEVMJzGChTXxxz7HAAKK1R7Ol5ajUiaUMUIL6 WIbmmIYP6uwM2Eb1JX18y7mgdJwoCWT0I5Loq6XzgF8PBNpjS76dpZI20CBOXLVg dv15ir6+UvG/39aItCb0BEDQ+UpaTIboQqecYe9oo6OYoTbezd5/gtEMLWHsf/xG Fw6x63qzop68tsJrPO7xgeZL2I89XvAK+FuRkBo9QlXpDniEvcPceVh8qw6BSg+Y zsscBy8PDwWG+NAm Extension name: 05vb6je9 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/566484711914F5F1

http://decryptor.top/566484711914F5F1

Extracted

Path

C:\39y4ps-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 39y4ps. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/081AC0D763E84FAE 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/081AC0D763E84FAE Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: VqWt7lVK2ZjcvUHxxx3RZixAICt+qRrhH0FNKOzv7p6AdIg9PR4OtHRTDyK4K7WU Uom6GhvIg2baiNZ9/ndfq5UJadTN2HqTq7HuK94ZHhY7wnp94Kq2qbUmqsghIJtb ktMCE8bRr9utOqWSRb+DJtFf3sTRcwQW7eMP8s0OtTpU68BAhAu0zsdZqsTyb7JB hVOg9cZmJb8fLebT4BiLI49CgI8MIXQNi7NcyW3HQZlW9Q3udnZ/5EfKUdJvoUk3 WrfqCX8p6krCFlO1E01QUSET3GsHjoCwPh05AOQMXNrLMVPpnD2CQ+VKTCNV8AoB KlJlbMWywE5rE6Y3cLyhejZZJAtgwdRTP6Z6NZqFQGNG+SKPKQS78G+52ML762iJ MJPby/DHrBtua3G1VUhidn2ToOY0Rki2sTY/k4ssyU+5TbqMH7B0nnN1WzNaph83 RhCGU4bGOZjald2P2MGVjUFnucI5TSvYrQUhNGDPNLeYGu9eB6yDDYp8JVlZpWQt Feau1hUdi+XC7+d0Iijljt70zIejqx+1AN5jeheogY1sRrqjzKlMQJzoYcDDyX2l ekry9FLojB0gmIBpSvGbi3CuCViXmZjHjrfwlKYhoss0V+Q6i7cMrdtsgmfCvjwT ydk+ZOvRK9BdUm1oagjvAuZabPAGoBAcnezueF8OhCFW2klrYbK5fqitnQew2YIy oGiTRCABy/kww03zNpvvQie8UPNRzIQnPazOf8P5A8D/Tbf9zUV9Tc5XCvkFt/Ny 4cGdnLkayhzt8erQ62hOqx7oNz/xVVgXdiLQNJa2BZnMpEk5fMlAbz1Y+R11Xvf4 b3o/E1oLtOgq3ERtr/v6GnEbBRzqqxnl6NwmArLUyxq0EY17v8CG7YVNydxPqwh2 z3ijcJ/AU2lKRX9DxMQRSrTTtLDsnOONLCwUWoptb4u71p8m0nHbrVYNj7ZiYDuh AqFib8V8JcL55BbC4TXAelw7WdG+FQA3JqlPEOdmBmRcGu0G0ZEtU3C/6+6wz+DI /a7xYwCJ/ymYi4wqrtU0O///Wi9FpbIES3X0AUt6PGwzdqtLl3/YBRI7Oyz4y7L3 o/NvbbVwBx3f294KIAesKfNFwFatqwhzyDSOVoBRCNbes6Rt0paitw== Extension name: 39y4ps ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/081AC0D763E84FAE

http://decryptor.top/081AC0D763E84FAE

Targets

    • Target

      06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe

    • Size

      252KB

    • MD5

      1ce1ca85bff4517a1ef7e8f9a7c22b16

    • SHA1

      f35f0cd23692e5f5d0a3be7aefc8b01dfdd4e614

    • SHA256

      06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851

    • SHA512

      6e67fa01a8792453b148074fe027def90e1d3f6042037216986ee9e3d0c436c177764bc5e5900dbbab91e10d8a3c86a2ea04ef547149bfc92a33ec0236759949

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality

    • Deletes shadow copies

    • Windows security modification

    • Discovering connected drives

    • Modifies system certificate store

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

File Deletion

1
T1107

Disabling Security Tools

1
T1089

Modify Registry

3
T1112

Install Root Certificate

1
T1130

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Impact

Inhibit System Recovery

1
T1490

Defacement

1
T1491

Tasks