General

  • Target

    FXjmVaAr.bat

  • Size

    191B

  • Sample

    191216-9wp86eee42

  • MD5

    ebad7b94b99fb3386465e77210c54f52

  • SHA1

    61750cae595d1c2e1dd2e0f8c555591fda091f01

  • SHA256

    9c515a50aaef088617ac6f3f9396df6b091bcaa4ada69b8f9e265a22cba70fc8

  • SHA512

    ae401bd8d48905954a295f53f151b13384f60ec54e5d63e0f444bcb0e64d88e42bada9d19bde9cb0d44e3762362abd6fd4b9dcad8baaf0622f097f82c3ea8b08

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/FXjmVaAr

Extracted

Path

C:\7m13v0-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 7m13v0. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9E4C9A8D522314F7 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/9E4C9A8D522314F7 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 630ldf8RYtFFu4307Sc4/E6geLEUG7BvtUKG1Glfi9Mrh2aDkVYpcAV0EgSWF4Um XxB84aprOiUw2lVwNj4/h5nlE8NX96xAR8A9gwZ2daIs/1AOVgX3tTwq8vgLhstd KwbyK8oOa8dVpg/WYhhUUhTmQ5v748pfJYaw81/OcBjIVe/ilewKIfyogFb8wU26 ItmOybRxPkBD6ZNf+U8qvbStSK+BPYjPKMVYflQ3y4l+nLCl1M8NoW7yzwx+OlEE iNaBeYNuaxce8WCrtd4Fj0rsMkZTN/oPunxomVh38Xbb/8qot8Z8mqnvM17h3hkK HyxPTjjJnX8ceQ7nHte8uOvGtE5W/vdkMaQ7PRypXBqoiSbteo0vFkU1yLMh4xph o2Z7ciA/sFapFsxoqy78A5a/HhARBZHK/u9nNBHwGRa1VbGwwQ9wUt554y+03o62 iWw9GqZEnY6fRPMjGzQbxnIHp/z8tPNnWwQn9iU68txV0bvYJRE3hSngh4375mhA /nqfvBdhJfQFEd/ybmChEgZwz8fbbKPPqvHmHUB6RNQxUBy5zRj4FQzrwe5uxb0/ cHqnVP9YRYQC27ZS/U1NpWZIL8H+x+73ByO3owyfk8Aw/sWx1lPhqbO/9Ri1oJ3M iizpw028Tt/XVl8Af6qlSIOise7vloszFgsr3Zv+8VpuTS1TfI44dbHtGhzqZ62T cQlQQtY1A517x/tiV/E/Oj73OWq7OfCRhcKWxL5mCYjWfqakm9J4rWq0xghqdRZP q6qlt0oHXSVzpOM2SbbwNVuina09BimUHViQPRMC2IpDMcUaXmBRpEtn3u+DwBn3 ApwEX18oYHS0W3uNLrjKBnoSqvWs4vb62Rlyrkgjlwg2lu7YmA1lmKzsZ2CqTwtc MwTadMegd1Om32uUZwZV22usGcx9PN71T3KodLo9FT7ffQYoIcqLlAVoVTDL2I+x 1lWlj8lz4BhxpcvVD/GA4dB06PYqAZHIrjTJ73VCOwO6mWi15zPreeMTnIbQTsNV dtfwszs6yc+Sc5bSwfsi5d4qDLsgyr5nIquYfWIJOu7mhKYi4h6d9d5V2FBpztF6 1pN8Eluh/dvvLWs1i3NLwBVHyw/tbett68IRrIat2rq72yu1pAaoKscQdukY1dAZ FRrAUnlP8ErNF9QK Extension name: 7m13v0 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9E4C9A8D522314F7

http://decryptor.top/9E4C9A8D522314F7

Targets

    • Target

      FXjmVaAr.bat

    • Size

      191B

    • MD5

      ebad7b94b99fb3386465e77210c54f52

    • SHA1

      61750cae595d1c2e1dd2e0f8c555591fda091f01

    • SHA256

      9c515a50aaef088617ac6f3f9396df6b091bcaa4ada69b8f9e265a22cba70fc8

    • SHA512

      ae401bd8d48905954a295f53f151b13384f60ec54e5d63e0f444bcb0e64d88e42bada9d19bde9cb0d44e3762362abd6fd4b9dcad8baaf0622f097f82c3ea8b08

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Program crash

    • Windows security modification

    • Checks for installed software on the system

    • Discovering connected drives

    • Modifies system certificate store

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks