General

  • Target

    Za3T5yJk.bat

  • Size

    196B

  • Sample

    191202-jgvmtmfvls

  • MD5

    46f394eb1e96a9e997df949bc0a77c7c

  • SHA1

    c30408141672eb2dff2b270c60269e5ab8ea979a

  • SHA256

    5c782b58ddf8cc3df5b65372060b30f699e27c7a32adff8a14f826a49e0d7ac8

  • SHA512

    bac8632610b6ce3c00122f667fc87252450a80cc718394987c1336c179f06ae5d73c420d0cbc0c3c2fe486d817cc875dcf57e79a56324e886b68eb586ae447ff

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/Za3T5yJk

Extracted

Path

C:\1cj0s8-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 1cj0s8. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/375EF44F9DFADBCD 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/375EF44F9DFADBCD Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: bSthU/0r7Ewj1UryzURsrZK+pALEMXKit2LfJzo7B/2165JC6A7Q6l6jstP+tdTv /F5KozFtinTEd3azYJlO2pCTFv0LdJIycNPTmUpGJbvP/yqpEndk/wJcKRdutX6S Mtpcc2bVnApT6N0j9XMYotKG6OgnC7U+15K3APdukINEijHYSNJODEYKlBvWmqfr ic15VPJp9b/ZXAa5Yn611Kzl2HenWulwsgRRDnIlmV7qilcvNkKCrhMhtbjqCfdY qfrOhddzNEupIzmoklnG5CEH/xj2KuQf8QemMTboS0q3IMS4kVFntoMP2HQlHOGD ssqKMl0lxvLwa4xIoy1/Br3hQx32GmqhTUvB4RZ0l82wXfJD2wgxhMN35YbeWwEw IrLDhosXHRCTTH54R99MSe48i8lra5RWyunSlJQ+l+CAXCyf4x2/Jc6XlfmO0Yt5 Fxqg7iKkF8OZAWBWLSkBzlTBC+2HXeOU/fbHDbBp0PxEjulTr3BZSmtWNf47tYJy RXyuLni9jsS2CURA6/PlH2+lQSFEs88F9cL5K+frqt4tctaNGqp5ewttE78B9CxR bzUh1Wv2mR8anGU8IxNc6c9qwAkDy1Hm9xNdHGCUhhs6aID6m+pJzLniqR90/d8F 1BW0kAG8YHR7rr14XFgRnHfRdZXiAE7WveWVks/JpGAy6ArYaLAwZo336DAXaB17 WwMkwqnkUdLIXxvkpPWccSaS/cbeeHoA/uwKRkH97iSsyQsrSLVflac669S45nv/ A7hx1JstBlY/K3g5A/ejZYSaAEdCw+YGQn0uA6NqlUcgnRuA238C6kQS0Rn8qytq Pb2rRYm/rF9eL0gdoRxX2M62znYoO4eKRB6RvlHxH5H6MEt0l0Q+u+dU1yW2Y77N YK42PGUbLXb7f1GdP5YDA+bsFC4fahjBFmOocmrn7EIzNBGkp7pUkMO81Q0Y2jrC aUYJILAN871UCTxlY3eUb1BpGUKpWgeFUAOKD0k5Eb32T3kHCaBn+PHgXY1jawsh vK3N9zUtKZgv3xbDS9JsyWtQjs+PtYDnXjjvyad0m5DgyoyyOdkzIop6iSHlXQ8W Bmv1Y3Lqa4QB+Gd4WONUCnWVDV4wGh4nPlB/1QXiRkeFio2nvkuyRn/4TZKl3tYt iyRGbIBB0crlQPmx Extension name: 1cj0s8 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/375EF44F9DFADBCD

http://decryptor.top/375EF44F9DFADBCD

Targets

    • Target

      Za3T5yJk.bat

    • Size

      196B

    • MD5

      46f394eb1e96a9e997df949bc0a77c7c

    • SHA1

      c30408141672eb2dff2b270c60269e5ab8ea979a

    • SHA256

      5c782b58ddf8cc3df5b65372060b30f699e27c7a32adff8a14f826a49e0d7ac8

    • SHA512

      bac8632610b6ce3c00122f667fc87252450a80cc718394987c1336c179f06ae5d73c420d0cbc0c3c2fe486d817cc875dcf57e79a56324e886b68eb586ae447ff

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Program crash

    • Windows security modification

    • Checks for installed software on the system

    • Discovering connected drives

    • Modifies system certificate store

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks