General

  • Target

    ZLe5gJKD.bat

  • Size

    193B

  • Sample

    191216-gz4p7974ja

  • MD5

    6e78ad45116b0543050facbe4f9d60ac

  • SHA1

    d61528fca930f327547794415a9982370c404ff0

  • SHA256

    3848fd0472f033fb4f6002ef45238e4fa23b13b88e6c84b2c28299ffb3015676

  • SHA512

    b6264000083c52c5a5d600716ad70df166dd67a45ab44e4e6ddd57d84a8a5b6b3dd66fa7a6736470ad8b60266c6b870381d3b67a913efdd75575d9fa198f256a

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/ZLe5gJKD

Extracted

Path

C:\118eyl-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 118eyl. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/633E6F2DA8E250CB 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/633E6F2DA8E250CB Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: zMqT4tEyfAzVGXgU9fukLZDVjF/Xi0gH4fL8Ws/3LYCFHuOkFwEuvHlzfOGjbGMJ pSgaBt8gSYleEhie2sv9y5aaUmUPMrHh8sDzfHaclPOVx2B00cNpwJ9UCWMP3LUQ bmaOLHzOiSd+mVkdZu5HYdwmqOhC7NZZp5AWXU5wTnOd4Na4yMXl+EB/E2O5j0Rz EnztawjhGwFxmx8HBZXeJQ8GlFCB8LUvAK5MFkjWEWRhdm+ScoElrK0vcFa8e26r 4hpqwH9sqwAmHzuAm/+LwsxS7Ta5sO4aExlCcdG+Ot00VmCwIE6dTzq5/Uf5UX6/ LZiOUjobKkkHu6SNiiMV9T0TJ1eO7TR1ktUi2UsJ6RVOOhAfyQ8O0MnYpiWkyAf7 a/yVDsQlTF7qblnCLcz+d1Ik9t1lr90rzP80ASLoP4eLA/L4VufPzJSTrFyaGWfZ GYnpZq4erzLSR57qyTC8zuG58Zr1frYNv7BY6MflQydumO8wGWQa2zSs9kPLehDF F7zwQgP8+LA6gVft9kKeuHuCxKbcMfdpU3N3XXzlDvWOpbxrqAlJIvjNl/Ipev1s 8TmsIOk0M2Z5EMpO8IKEnsTfpYasqyrKxNGO7yAUzmSPPHUSvm9LOYHJwqTj9R/D ngQcvmKXQsfBPFXbBbtJ4O07qj2yj+NwDCx3Jfppo2YhnHqgMpJpp/MwFnTrKls2 5xaloS7QqSqdfdXF/O4didJzgP7nYQ3jQHfqD9qPCE1N7XYUIJSv+w+TEGGsB/iP t1rYj1V5g0eMre/XrSBZFTOeyO/LJUd1mKFthcvoCKdYwZYi6MPZGwelDhSwfQgV x8Jk0q+GRNVt3MMhOSyGd60T9OzeqedFqovR1QEQXkpKTHqVus7K4wdqbUiYdHCE rtmPdt1QbBYtgZub+X97YtE9E3xNxsMzmH9j31ehkIibUMDdVp9K/VTQtxr64o63 3hYsocESnySC4/GkrxaLNIoH+W826HlFPLL55US9G2s4mVxu1EWR1zYD2fkIBo0z Q6QXAIS2f9/YslgWKz4mg0adO14uueA/rZE/JDZVREq1yM99W1Rcoixl+y/scG5B DXEY+WHS85wHoogcn+pV4kPN1IGJEzSbb5ucN7ovrQdPQkR2OVDrPcwIn3bELG8/ CrPgNZr785NxTZsc Extension name: 118eyl ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/633E6F2DA8E250CB

http://decryptor.top/633E6F2DA8E250CB

Targets

    • Target

      ZLe5gJKD.bat

    • Size

      193B

    • MD5

      6e78ad45116b0543050facbe4f9d60ac

    • SHA1

      d61528fca930f327547794415a9982370c404ff0

    • SHA256

      3848fd0472f033fb4f6002ef45238e4fa23b13b88e6c84b2c28299ffb3015676

    • SHA512

      b6264000083c52c5a5d600716ad70df166dd67a45ab44e4e6ddd57d84a8a5b6b3dd66fa7a6736470ad8b60266c6b870381d3b67a913efdd75575d9fa198f256a

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Program crash

    • Windows security modification

    • Checks for installed software on the system

    • Discovering connected drives

    • Modifies system certificate store

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks