General

  • Target

    gUSgtEef.bat

  • Size

    195B

  • Sample

    191216-ev456tmrps

  • MD5

    ff78055026f05e5b91c3023b89ac2678

  • SHA1

    5b8e27b16e0c2a25eca094ebaf99097c69d571c5

  • SHA256

    39d40bbbb11f2740a51d0c80e16c0b1896acf377b5ab45497c8b91efc365d1d3

  • SHA512

    7ffc3fe86b9f8c48094e16d853bdb95cb24073a48dd53ced412f3e8dc131c4fd1ed46310b5291063911768d906eb3153d6f281734ae537d366d511c01b391d2e

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/gUSgtEef

Extracted

Path

C:\5u85663-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 5u85663. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BFC8D962D0767B2E 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/BFC8D962D0767B2E Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: toXSimjdm+PF9EPT4UcZRbCWPs5KO7eitzsVujVp2sZ7r6hJNkAxehFPxXAYxQB3 UGovulgW5qSLs5WJ8ssL+LKDT89WmA3nULeEZaeNlq9mgTehvnA6gViWV3AdxF9w xuEl0Xym2Bfr51jDI4UxlVGurirLIhwIxxZ5DpWkw3XI+8ZqL36UNJVfO34XVo6U ccQjNVQgFXL5NpgTgCrimUCrhzfdQWg2+y9DLOJZ6afxydqtzXFQLNx1+YsJm2ET BM7M8s2kQAwIoup6QgpfMvYCUEMMdAv4PdVAQUXdAlfsypen0yxXbRsk8f1Wmf9N xvM7nG4yapRLyMynlV9e83dMvAWsiigJ6QmL9iS6cB6GV/ScfFZmSriqjSAHd6ye AxhZqsjygVjhwGxZyeqKaFm6ZAyHkaTybnqIGUti5CwqNn3tIv12E4E+TmSTcBd7 E4u05mR94dp0h1fb4x1LwOCYH/8u5SxTri/QiBOi0RXdQzM38kIEHZ1KbhXiXjYM 6DXuQTSGf1aLRZvWJXF46EsKpNClDWLg6XAVeJpPpRt9XSbsOax0bqlBRFAQPKxK Zn8BWgNDMPFnCNGHdtR5HIcnLji0kckACVKJBcdXEcKv4ltbaHz0uzWTFA6f2nOF jIUmPp/qSch+VdxRttl+CarPVDhmQx4UjSrjJLPgwvUS8Bm3ySenNo7YtyzqVh5C RKslPDAyqNbipZyVc9GzocQK/qw76ZHUvn8wK8Xe9k5WendWst9lWFMSmm6MgHQT SVJtSr/TNAjn5egjc5PB4MJqgjS6UUH/GfxPkCthPVzqozvI0xge9jmbMp8dA5nZ ZwPvG7RX2isY1C0asj2EULXGPfAPEouECMWEgXXBSddzfoQSrjYV10yESxScWHFx Pgl6wK9+tDhH4zRB+ghxSSUaEuC6zCZf2vghS6EWHnm6zdykRgyWAvDozZJrI35A 9EKLAcV9P2OKp7ZLFoxU61zxBbmQrqeKEEME8EHqDbcK89He/ZuN4P7b8RWGyN4W q0f+P+Ste4X5jdqK9aREC9x7x+zXTHl6L/zrHQhdT1jzNv9ut8ysGHYhBHTGMRbY E7RScm3/aUZ8R8nbhWwToznoRVU0WHeHHqeVoxaGckFJUkbTSysBei02woP5ZCSI uml/cS+t0hJ//kZVw70= Extension name: 5u85663 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BFC8D962D0767B2E

http://decryptor.top/BFC8D962D0767B2E

Targets

    • Target

      gUSgtEef.bat

    • Size

      195B

    • MD5

      ff78055026f05e5b91c3023b89ac2678

    • SHA1

      5b8e27b16e0c2a25eca094ebaf99097c69d571c5

    • SHA256

      39d40bbbb11f2740a51d0c80e16c0b1896acf377b5ab45497c8b91efc365d1d3

    • SHA512

      7ffc3fe86b9f8c48094e16d853bdb95cb24073a48dd53ced412f3e8dc131c4fd1ed46310b5291063911768d906eb3153d6f281734ae537d366d511c01b391d2e

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Program crash

    • Windows security modification

    • Checks for installed software on the system

    • Discovering connected drives

    • Modifies system certificate store

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks