General

  • Target

    8rMenRPf.bat

  • Size

    189B

  • Sample

    191216-2a3hbnxk4x

  • MD5

    815c5b6000d8343fd01e383228b5f41f

  • SHA1

    a04e90b2010b425498e5af5b5ac3cf2ee1d49570

  • SHA256

    e4791efeba8103817e68714fd67ad9bcfd188a0e9bbf67bca422fb5554ac4165

  • SHA512

    117f10de8423e13aefc5ea29f029f4dd6e39d4b2fab2c987ec769def107ce2ac619a342ff3a75cb431717fec53f60d247be9e83a61b8568045cefd534dd245db

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/8rMenRPf

Extracted

Path

C:\dipl0cdxrh-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension dipl0cdxrh. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D4C71D26E67F8702 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/D4C71D26E67F8702 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: n9KoknCyk4qgakUwjJwBRnWjr27DATdn1bzvpdc/Wxgn2HGGIp7G/LFCT8BFILpA fMxfc9h4OoABlPDK2NsSbbnGTYw8YOL2g2qA34Z9+LfAHjBBOM7LSf+OIY/0MuNY PU9zXUq1P5OIiNCGbcGVZc2EMkMbwmxxVYcJbyzBaOtPd6fH2lQZz3Q3QM8fix9X zPBPPXykeVk1feJLXooDQj8FwtlnYyBCvo3o5yoIdJypzh+2rqtNAfTgUid2+a1G gN5LOILptIQe4drHpzSCDj6sa4Bj43USH+U7vhLF2b3zg85BcIan66BxIEVRhbyE iaplYeISXww5WmyqX8P1vzOMyM+KRovXWjzXWzdZgeNuxfjX0Kz6Tzg3/RVM0zNK JDKlKqjIB7slDRbBxv8Ne7fWN65p/rbdVhBiM0GqhaagtMtFyST+JAqPW3YmioAC jIatJDX8K0ei3I8hKqH5x5BTG+SUBsN02J85mXgyfL5cmzs1ybRp3Pd1BplCoh+F kPi/RwjU65eb9yRV1fUxDCu5ikaIIZnSF8rZdJK5naEM3Ep0H8D86nLL2nT2mVyp trSyithnuSTT+db+p8viRQsDtuvGHzEBx6m+zxNzrWFCRw5BjDudMvJdoazeEcX4 zLkIvre6Gd1YN+29V2DWxI6q9lzFYbWPJamJ7mtYzo4CfbMQNLo5wTUmCqxDHbSJ JUUNBRF/HKsSfX5QbJ8t2cr90DwfWfVmx08m7z+L0/6OacWPEWYZrL77R2UOkLEH PWROC59U/NWuVrfXSVLgGzea+mC28m1aL+LdL9fhv1ppxyIYD4m5SYp/aXZW6gmy x0dzhadRlsv19wO1OLL6Ai8rGYy3Q2jcmsPgumPnIDYYWOlixD8Td5NoE694N8Dn 8NsuGTbuw9iJeKhJYq4txl1Z6LbsxCPFKxU4ug7BQgj5g2pbREvp3aJAnuFNahcM HvxCISbxpCvxJz5vPmtyGLQ/5DdgObPeruq3Az4CImmYGmvh5rSfISefRYL6end6 m1LvorGwE9CmKDZ+R7DLg4tTSpyj8cbK3/m1GGe52DF64L5XgWiD2oR6qz0tTrAa EtYlPHqP7EzhfaHPjWN8JtnVwrC+RMheJjXsvvbprCcTQQLuwMWd78XETY+8ljMm gOLzx97wXMyIs8dBitjumuqV/FU= Extension name: dipl0cdxrh ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D4C71D26E67F8702

http://decryptor.top/D4C71D26E67F8702

Targets

    • Target

      8rMenRPf.bat

    • Size

      189B

    • MD5

      815c5b6000d8343fd01e383228b5f41f

    • SHA1

      a04e90b2010b425498e5af5b5ac3cf2ee1d49570

    • SHA256

      e4791efeba8103817e68714fd67ad9bcfd188a0e9bbf67bca422fb5554ac4165

    • SHA512

      117f10de8423e13aefc5ea29f029f4dd6e39d4b2fab2c987ec769def107ce2ac619a342ff3a75cb431717fec53f60d247be9e83a61b8568045cefd534dd245db

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Program crash

    • Windows security modification

    • Checks for installed software on the system

    • Discovering connected drives

    • Modifies system certificate store

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks