General

  • Target

    DeL27X4Q.bat

  • Size

    194B

  • Sample

    191216-e9a8fk11t6

  • MD5

    303e548c5add71a1424c0db22e8dba9a

  • SHA1

    35efd5dcb57d6e779d757eb2053fc1302e2f82c3

  • SHA256

    5e992a45564e3f6dd3ae2a7027a07afd4452e9ac58fe46b4bb0fe300849417ce

  • SHA512

    852e6140da4d270af3ed62eb76cf9dc325cd1fe4c62845d0c390b4ee0f1e6c50749b7cb4e9d66ca106446736eecb6ff1d126ded76ee135734007ba3fc8931931

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/DeL27X4Q

Extracted

Path

C:\w6y6241-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension w6y6241. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F5AE2F84B6FAC163 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/F5AE2F84B6FAC163 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: PwBtxGDV5NmEnmi6shjmOxIkEZkcHrl5bAqC/63BEc4Vdg1EGlXi39ihtRkKvOvZ o6Cl9ohZN4Q+hNasJniy/REyGCK8hTrm+qBL8jv8QzhXXzOtO2zsMsKcCgJKx3h5 auP9TVX0rnMJovXAfVibNqKrSUAuB24z91NkpPzVu7/zhmu9wOtgOiaZ+fUgALfv TeVU/DENk0AncroJnThUL52LLXyoy+xU3oFbhKPGpKH6EE+LfNXp/E2IsnOjRmX2 LPZ8elOBVTscQeFO4HQa+3nWUsSPP0vcZRai/4SNXl54QtUzFl5B9bRMy205wD0B w+sD4/6TKVQfwQBXNUHsbGKaUz2aaS7idPVmI8GJxvHHK5ZayVHBC4jAWbIVFkru ztHybV7P9SJ+BIm/FLh2+5HkdBXtY+qZGNGzdWZKtIKW9UOddUsfuZHAp52078wH A4KwbKe+1eAGdQSDMQIR5zCNksuBMUhFWep7U1QeOtZpNCRei6bVirdOPcJ62nDp XD3VZ8ATsUqKgmTr+ud+0hBBps3K3ET43r2/xRMd+SF95VjjetdXXN6RhUkf8JrZ g57bHN84W5abB9F3bTKXuLc7YzxciKvFwFKE98DmLR/gdch7u74qBmg3eoNdhqYS nertqkiBnuykhejRfixeVjd1Va62BmgpxWcZqVg8sX9ZK99m/DQMswsw5Gd+/I6/ XBBUYF/whRMtdj6cN2pNNSBe1j0l2kGO7BXAI/ZC46FtV6l25dY53bDuKjbvGyuU CIeLKtMcCa5hjqis9l0ne/qXxvrVmrEnLfHeKB0ag5sm3An2CHNd5VZwWNMHjt25 5QOPk+sgFA+LbqjXp8JE9qupYjS9BrwnhD+KoyklTAgkQfCPEfiMaO3jfxU+DhjS VPAuXMF/6mO69vAO0KHfT9pDa8oanY5GU+KPEYWdbZ5mMvPfO6JyxitgoI3cR+TV DpRWctORwMAPcRGwkinDzRf8EKfcLoUItAiDvuK8oa8CA1gJv7m2IVjiN52Vw8jN i/SC+zFFQ24Oq839jNRHXSCWc0R4oejQaXwiFFXPaZhfl7+XI8dZGArQ/M4XHlkY f75+zHbweGsMb3S3yKsnlXon+i9Prvg4krJ0ckezEVDaRJSDKIp43DMYjxKlbEIh HyaiDy0YsZ2z4K34kfY= Extension name: w6y6241 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F5AE2F84B6FAC163

http://decryptor.top/F5AE2F84B6FAC163

Targets

    • Target

      DeL27X4Q.bat

    • Size

      194B

    • MD5

      303e548c5add71a1424c0db22e8dba9a

    • SHA1

      35efd5dcb57d6e779d757eb2053fc1302e2f82c3

    • SHA256

      5e992a45564e3f6dd3ae2a7027a07afd4452e9ac58fe46b4bb0fe300849417ce

    • SHA512

      852e6140da4d270af3ed62eb76cf9dc325cd1fe4c62845d0c390b4ee0f1e6c50749b7cb4e9d66ca106446736eecb6ff1d126ded76ee135734007ba3fc8931931

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Program crash

    • Windows security modification

    • Checks for installed software on the system

    • Discovering connected drives

    • Modifies system certificate store

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks