General

  • Target

    Za3T5yJk.bat

  • Size

    196B

  • Sample

    191216-h9j8npa5yn

  • MD5

    46f394eb1e96a9e997df949bc0a77c7c

  • SHA1

    c30408141672eb2dff2b270c60269e5ab8ea979a

  • SHA256

    5c782b58ddf8cc3df5b65372060b30f699e27c7a32adff8a14f826a49e0d7ac8

  • SHA512

    bac8632610b6ce3c00122f667fc87252450a80cc718394987c1336c179f06ae5d73c420d0cbc0c3c2fe486d817cc875dcf57e79a56324e886b68eb586ae447ff

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/Za3T5yJk

Extracted

Path

C:\56820rse-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 56820rse. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/87D82F91219E1402 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/87D82F91219E1402 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 5sfNG8TyKSjPibzLrj1F6BepAk/Njr+HaDqAdWk7pH7OA3gp717ItEv+QDIot4JP jsj9j+oPR2VZXvw717Rt4G8JXxZ6YfUaZ7jBP4TDV/DzHVTI1S2ZNZsRcHNIaZnw DIz4r7D71FQERwzIHPRTCG6R1vDBy4+qylFGmvvU5Zrl0MpZQJTkem1qHBylUTuD 6NTQgF8XepQg9vAXwASKN7rNru+KL13S8CwkeYrbVLRpGxcKgMM9QqZXmx1cdEj9 4O9GP2WaTBOdL0XURE0smlYXc3JsC++RXrN7KUTtILKWiKauz2qQX/Ed0O9oTISo BAublgGnDw0GRrk/HUsPQzHrAzNNIIzNTYV/uF71bu5cyUmPaSIvXb1qV0iDYD+T s/7krvCVC5Q6NgZt2r3W9BvUaXOnnFzUeKmldoKY72QealT21ESZicZS52xcm0bt JW1bGekIyCETJILILLCr0CbEoVKb3EGrfHIJwMvrotS8eS2aSwKAi7KXmruFHX29 BuUPo4e6k10ZmfSaK9dzU/mkzuXrhlVj7orLsgJ2z3MvJob0Dr6QMoaUANayjqqJ r5KqK82EWxEe3s392gVPPbhbbCnmxDIbkkrxOAskgixv6wdaXoUS/Mhrqk0ycrea Zf8dU8pq+YBa6YS9mVq6TkGWR6qGFTl2gLibEfT/zYiZ2euudFUflQ04vJ+ANTkh RqvvYhh7ej8HMC6zS/FWkcQEtSkTcz87Of7VLHRxpI7Vudqq04AgzA9ov8ZY5tM9 YmXqv2kP8S1LfGob/HrhyH0XIj6S0sSl8NmHaUdPLP9+1bgzZ8kneXq2asCgOmOS Y9S1Mc3S5jH+wjJvLTDPPeb8uaTCFHa5ruFIDs5FxUoMCr+MYLvtWkVTxaOdPD4u UEC/piCiLQ2/Sfg9ziveAIvQAuTNsE6dUPYy0dukVGVykUXArVwEI0KRi2m81+xb Go9+aJuYYFYXGAMlZO4b+Z+ew3rEEfnjF03VR0U0VRqvwqQoodftGSXJXPCGqWHR 4JgzOBL8dSKKXt5luwYZ5OnsXYBeKaIWbff/FUOU9gLu/0dML3+n7acezVr2nzDX n3Ih61oIuLnj/+lsz+L7zPmN/PnrXxycU4CtxhDfoF4EPH0GNqF23sO3hFqgSJcF yh/yS7vflYxgDZmbof5bGw== Extension name: 56820rse ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/87D82F91219E1402

http://decryptor.top/87D82F91219E1402

Targets

    • Target

      Za3T5yJk.bat

    • Size

      196B

    • MD5

      46f394eb1e96a9e997df949bc0a77c7c

    • SHA1

      c30408141672eb2dff2b270c60269e5ab8ea979a

    • SHA256

      5c782b58ddf8cc3df5b65372060b30f699e27c7a32adff8a14f826a49e0d7ac8

    • SHA512

      bac8632610b6ce3c00122f667fc87252450a80cc718394987c1336c179f06ae5d73c420d0cbc0c3c2fe486d817cc875dcf57e79a56324e886b68eb586ae447ff

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Program crash

    • Windows security modification

    • Checks for installed software on the system

    • Discovering connected drives

    • Modifies system certificate store

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks