General

  • Target

    RKSMMKvy.bat

  • Size

    193B

  • Sample

    191216-8e2x7afq6x

  • MD5

    35818e3d4c0b214106de897863a58fbc

  • SHA1

    80162eb2b61656eb95a4cb0443b7df68fdf05a48

  • SHA256

    b9269af79a7cd80e9d3f2d664b6ca4290dd45c34a17e274f97b15c16f96d6bbe

  • SHA512

    826dd0496081d5e5cd294b5d02be64d6c959326b49f353e54a2956f0e507ea291ce653b178d4eff35896fe4f5c860a2592f72906475f4529a6af1695d9c64314

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/RKSMMKvy

Extracted

Path

C:\8pw8hwno77-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 8pw8hwno77. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/30C76631120F4269 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/30C76631120F4269 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: wDSxKNcXaD/pMSL/XYGCIKlJWAKuZ0HliBB5A4kyvbCyEK2NnigUocrrxy29wW9c 1QevaPK3T31C8FilGk01FGFpfWrSxWUOws7vBaBeTzp/rtAT/CvjYssmpavQgMhJ +VdNPbiL8GCa5wy3EgF8yMPkVtRtrCiOaVSEEkdvqnanP5dqmzGxvfJJ+a0efYPk E2u0vGTrxc5hrZwC2xZhFfNXNalH9OsKoVCFuFISwDc9n+kKIiYNdvuwKDI9sKaL u9BK5zjG0AcXaE6P3nFwkyTdfvD6rOInIzLSnnp3950qgL/3o7d7I3hZCFtUGAMD 9IKrbuQfLgUyg7dc9pUCQrvvgpGoGqUlIUP3vqFDABUooGg5XWth77h3WrhaTAvk n19rNjfsBP+sVQR+1uv0SysddL1mc7XA09PPvIwPw7HulfM/Yzu4N6NEUzXHl+Ez X9/pKVQLw86ONutwrFMW2vSGcBHq//r2ohrKsNCIWgGEYUXLDoLyEupOBw4kfvZv QlmtVeh4Y97juwVcN2edNMB/fCEM23ZUiPiTN1t9R7fO8XxNjCqhVYoDI8ihX4+v v1FYsZSv6HY4/UXG+KLtDsm44HKH2BXSViwQJAimGp3gP1YTfFmeiVo9XP3PtjBc 1Nyps1hFv6uuWN+HBCHUkElUKtSzYMSvEAxIdnK0IbcrTXv+z6VwtBDIE2EPwRTF A1CHyszxzhcpnk5xJqWFk9Z0pvcLmxFaVS870olpZpm/nzlc/Q0ws1eGeKqDI33V KjgWTnv8cQMB1cB38xjaCEq4bAM7qP023Q/et+ku7Rzmxa+gF1Hj8FU3KMyUxFnS ezU3ERu5AEGAPntgpRP6/HIR63B2JoTaY5SqWNc/CIvv7kf6FyM2rlkg59StecCd YasUA4rrhCvaDjVPopFZlG5Y6rZXdAXbCpyKyQXExxyiCaI5qGlswteICbLzI4vl Hwf7I9RBclODkAo9AiEwpsTIdqc6z9M39rWfC9EsWbnWN3dPXExMWyThB7hkZDgn n0i2nU7I710OVKAJcKN51LxIw8sOJthTVym5+3WlOEeOClyXDIFMgrTF9Yv4wFsd yQw0LHDr1kSij5aFNsUHwtYum7m1dSYk+dIfwqwMZ/M4zt0NnrCWpFsFCdmoyNge 6iA5UtLXLhSpja1bjNkDY/6ojGE= Extension name: 8pw8hwno77 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/30C76631120F4269

http://decryptor.top/30C76631120F4269

Targets

    • Target

      RKSMMKvy.bat

    • Size

      193B

    • MD5

      35818e3d4c0b214106de897863a58fbc

    • SHA1

      80162eb2b61656eb95a4cb0443b7df68fdf05a48

    • SHA256

      b9269af79a7cd80e9d3f2d664b6ca4290dd45c34a17e274f97b15c16f96d6bbe

    • SHA512

      826dd0496081d5e5cd294b5d02be64d6c959326b49f353e54a2956f0e507ea291ce653b178d4eff35896fe4f5c860a2592f72906475f4529a6af1695d9c64314

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Program crash

    • Windows security modification

    • Adds Run entry to start application

    • Checks for installed software on the system

    • Discovering connected drives

    • Modifies system certificate store

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks