General

  • Target

    LzkNcv75.bat

  • Size

    192B

  • Sample

    191216-hbth798x4j

  • MD5

    f12e57d2503bb305fca21321a799511d

  • SHA1

    fb4a05bd282eed9bd3d41a81afb313a72613f2b0

  • SHA256

    ceaa40264cb666d0b5eab3ed3492570aef8d3b8b87114a93236e714112c31355

  • SHA512

    fb9488055867806721438509844bb61c0911a9a05b747cdc4a216847864220aeb5a34c68e7632705f33214923402a410dc4f10e6b73dffc951e68c6ff391b529

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/LzkNcv75

Extracted

Path

C:\zvp605i-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension zvp605i. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3F99AA4EF76BBB5D 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/3F99AA4EF76BBB5D Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: sByC22a+Ewm49rbG79WjS3gr9y91G+i2OgWw3kkfcuST3Kf1omtj1wq632I5AQq1 3mulVoAtEaeYz5xr44InVsEjTjemQJSpMgO7i9iLWy/xgOo6o7xcQVGYwdNBbjro HqpaPvxFVu2Q+r9zxRXbfKhe6vufZWNsJAj0Oo86AoEHMt4yZQOMyHgdsgcDAdX6 eRjXzb2wX3FhkaSYg35G1xIFj1NucaI6OjfZelWCzNRkeZKa7D8yuDxBjpr5a/6y FFTpZH527HUOVodQRD1mwe2k2IcR/uQFQjztBgOPoonNELO2nmT71WfGo2+KcvzX 6dId3677myITcAqUL7Zdp86i+ycBnYBKdrBX0CbZZE2O6ukY+IBRkZqvoRmUXOW2 RXp98GnJOTeoZGh7VF8F64s7antL8MlP26HxVjBNaJfedASAHquwFe//AFrG/P0V fSKILWvST13yL3wy8Qscm5TpoAgI7YY2cFO43lXVMPUXi813HYRiH+gQwu/Z8Wnt 0iUVZIMvgCYvOFqTyif/ppiF8qSpCQj/AjbhnOlrAWsaA67tRuBH8IWfyu5CJJ1r gu6Bjwdc9zj3cYxVwwpYctVSjiUbBuzUWqpbQI+L96tWcacpbuUU7ujOl1iIfyKS rNNfwhQRxwVbRD/WJGhADalfq8aXspSCYzHGcHHj/LpLILAEqXJifXelw7iJVXay P2sy1hRHdHQtAW46N543d2A93XUpv+0QWz2TJPtMz6w9XYVELdhzIuTWSRfbKzLP tcZbEUb1Gdl6X9iYwc6HH1sRUZldc6RWedDyIhQUxDW9ZZN8iQ3OfkgXMs2VHkML Jdm46GKzEMzR8+nNmMskvu+KhF+PN3YWrXNpfSR00uJxWul1p6PMOL9xVxAilDA4 kByrkMmNdchcP7+JSeggmTuD4OEIdHGLCpO21/uZ/AnJxUxgs/ISM6ceikXRCXcU ez+yPdinoEEvxlxXSBenZmBQiXbsDbQm4Jn4gNkbHb1iyxuhqUBru1LIJUQ2cZ9y mrFK7AO4uh5/Og//IvXlLl6hKw8WjVCa8VQ36FUOGmmBpbr0IVSQhrrN8iYqCPMm 6t0sRHYOdJxo/hDs/k8v0lL3zpmu8HOuDGvLu2wBXM8IP5QVrMK6d/M6w5Vg9oX7 beldafG0/Lx8bwQ57Tk= Extension name: zvp605i ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3F99AA4EF76BBB5D

http://decryptor.top/3F99AA4EF76BBB5D

Targets

    • Target

      LzkNcv75.bat

    • Size

      192B

    • MD5

      f12e57d2503bb305fca21321a799511d

    • SHA1

      fb4a05bd282eed9bd3d41a81afb313a72613f2b0

    • SHA256

      ceaa40264cb666d0b5eab3ed3492570aef8d3b8b87114a93236e714112c31355

    • SHA512

      fb9488055867806721438509844bb61c0911a9a05b747cdc4a216847864220aeb5a34c68e7632705f33214923402a410dc4f10e6b73dffc951e68c6ff391b529

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Program crash

    • Windows security modification

    • Checks for installed software on the system

    • Discovering connected drives

    • Modifies system certificate store

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks