General

  • Target

    eS3LEzgJ.bat

  • Size

    196B

  • Sample

    191216-87thmf9mhs

  • MD5

    4759c162d886ac609edbbdf3f4dc7297

  • SHA1

    595255da1663d4d97dff4fb62729c24de46d5f9f

  • SHA256

    c0fe6faa05b37d2a0464a4b68fd986229cd2bdc8f0441dd447fe225f03826388

  • SHA512

    f16cd0dc697a2afcbeb1001255d19d0236eeeb9f2dfd5202f9dab4364504d11e1bfae8b4c845c5be10a6cf478a1670eabceb9b311303330473aa32c45b203d9a

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/eS3LEzgJ

Extracted

Path

C:\5itcc8u855-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 5itcc8u855. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/2AECAA3C385BA7A3 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/2AECAA3C385BA7A3 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 3Njwny5HRU66Xzgsa7cwIhhQus9dRvRp6gm2CSemjcrXVdXV+jEq8wpGbOxq9lOo j7+agDi92IdRK5U2ttaaVpxGoPuoanqBod5/LCckXLF7wLqbMpbUrrRVJyyDapoC ynhKr1AvQaO8YAoZlPedQOm8S29tDzOPh/vauJP7MzHBEIJCVLBjScQiz6zc4XWF QTGx0HM6S06K0WtEwIydKbEQwnIzgHV3pasRLnTUUSVlcehHzQoHwaWgRJkxvjOW ZPRMRjal9z+Iuk/cGAgLf1Y64i6/lULfzN4THKDaXJM2pB5htA9dx6+YUCDinGH7 /Clemx5RJEZfDd0FFVzb5UCNpieoQiWJhB6HEIbt/TfNN5GohyGFK+f6Mt2SM9/P u8RPgu1pzoAcrW4UOhBjEGW/BSaMtsCzFg5J7Q8xlVV/KHzIyCgXGMzmRiuwoOO9 I5zoVM7WlsSYZZ/ble1S5qLrz3ddUAQitPwpFxyeFw2TYqzoi+5VNUkXS60Ts1Zi kH88p7MWBMRl7zNwZ7sOl7BCF6k2mgKXz5DGt41IbYJUmoT94vI58lww1LpR5Rju jY4EHoGvEQ+naNdI0sirXefMVwotZMZLgQSWBtFqrpiRCCrPTBfPD5uS5dWlQV9n qpFNp6lTf/aUaNcugzfQch1beSUNMQizGkadciSCTUJ5Rdc6vsENvauJcy++F+gC +wo1adlrObIkWDbb8h+RC1Pc4RY97u/O1/9RA/sU9EasvwvEqCjRzLa+yL7DhtWG m129R8hA7nbrLSvwSp/hI21HQSbh7GxDzQZgjsiKPPhK2HFk6vB/3zRdaiZfsJ6G CGXOdOMtcr24ogZm6xI1ljhhIg835+ZXXbFS27yWeUP86hupBBueyDzh9QzE885p s4vr2Wy/nferfv9spAdpbPQfM6E4aK7ejRMC0IKSZmieb8CNyRePMPbDJK0RNq8Z E3oRM8sb1p7AV1fl8D1SqwTWuo1GIndMgCYdv7oj9KigTNNDqn+keiIeG5tfU0Uq JAkSDALwids6aNGTdK8G8eh6SH/X8TG6hZ5uwdAM6ZR7KC60aE4YzW4S645Cqf3f UtDhPV2Tr4MyCQYP7MGMEvh5H34Zp8pTl9vnRyd2PZZPcRNmCRCl1Z5dymlY2sQl GXCITzRP454udH+0zI7tCJUIPoo= Extension name: 5itcc8u855 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/2AECAA3C385BA7A3

http://decryptor.top/2AECAA3C385BA7A3

Targets

    • Target

      eS3LEzgJ.bat

    • Size

      196B

    • MD5

      4759c162d886ac609edbbdf3f4dc7297

    • SHA1

      595255da1663d4d97dff4fb62729c24de46d5f9f

    • SHA256

      c0fe6faa05b37d2a0464a4b68fd986229cd2bdc8f0441dd447fe225f03826388

    • SHA512

      f16cd0dc697a2afcbeb1001255d19d0236eeeb9f2dfd5202f9dab4364504d11e1bfae8b4c845c5be10a6cf478a1670eabceb9b311303330473aa32c45b203d9a

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Program crash

    • Windows security modification

    • Adds Run entry to start application

    • Checks for installed software on the system

    • Discovering connected drives

    • Modifies system certificate store

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks