General

  • Target

    pRGiJZE2.bat

  • Size

    189B

  • Sample

    191216-m49vymh516

  • MD5

    7de4a8d57db460ef3d2d733558cd5874

  • SHA1

    47500e03b81c3a18d8d79769c082a76cbb1566dd

  • SHA256

    2d37f42015e8465ca0b781a56385c0b4a90e131b8a7fef6fa43afb8e7821f662

  • SHA512

    b1df3f38def62aa84c48579afe78f1282dc8c1a88172cf6f93642897b98b55f2b312c88391a4709744d04470f3e3f467320974ac8c45d3b3ddd9caca565c23d6

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/pRGiJZE2

Extracted

Path

C:\dqjmu8-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension dqjmu8. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/2890C6739DAB4D4D 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/2890C6739DAB4D4D Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: kJurB2jWyVDDQ8LoShTNXz628MvNBz73GQQNzmKlQ6mQhKTi9GHa7bev0AJaABut K1hTqcvviYw4E+aesWQRPUyc2D7av2C60h7kfq6WK6M345zBinh9aWccqEdQBbfb 6Fc5gGqkyl0NUbWyZ+crBp4PhBn85lHKoYw+3ea08RLrjJuj0EGwwB/Q4XxeYg4Y lzcK1HLt2WOUup4BdnrjOwKq3FqkNJZ3IPUfiR75ujv83sRB2glDxKa1SwqQBN1J OvvY1hcFTND8s8xaWO33+3gJefbAnZhlOIF4vqkdYVk97eSfSiXqZlTZG/E/fh8e cFKqS0/bW2TeY4Fsx4NoUQbZTJeILUua9buWwDTDFoGyiLO5/RgpSOx37C1lenGa LbmAxO2/zued1dDb/NOAa8pPtmctFID+dH3PJzJXXKi2HgQZGOTXfEDbT/XNmScz FeLH/ZGrU0WPDDwZhANLUQXBPVjbj3REtadTWRi2StgOFZL3vFJZhI6CWtkSDe7y t4x0uJDttCdZ/C7J2grgECr3V8zwvssJc8CN9FpUbhaauoiYPvf+hBDdhxU7rct2 FXUxiHLd2k7dqabXfSrhB/yom8zXc8D1NzNbmp/ZzLMmbuTcNG0NtuOS41gYTFqo mkNn/Y1D31lCjta6x9y6fwOd/pRRJss6fFv8kOrjGFpUvzy5zkQctXDjCQETqMrZ pWWlTpFY+x2qhe29xTAIHe/gJOYOmdfJLtLm0JKNPQybSx6RMp/ztRtjAQOp5QPq xV/oLDrDonlqGWb5kP4swyHyrpvWkMV/5mrZStK63ZsbtLucwVmAEkQv26leh39D a5rt3uotGuj1vK8u6e091Os9USgA6A9f4S4Ya6K1LqTAJhMA8wR4kkZdAGQXF3p/ 8v+Y4c99iagbTtY9TEOgJVK7QVkWqznYd3Ux9qJdaFLOmyZRjP5FkQfpwdeTv93+ joLCgB3SkU+H3IehsRskjPsoyW1C30zeK4Q1HzmUi1JDZ97QoS5S7zSNz39fS5Dn 3gO3xd63nQxMMWHHuLoLoH7BhFEKAH6pqzbVixOC48WF59aguJ/65Iek8ymUtlGq PKBSAseHtyzmPLWJl18pQA7fv4gtFErsBk0w36Jcyh2iAGeOMCHObsDen220eq1D YdSJ3Cr/GSY9dEEB Extension name: dqjmu8 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/2890C6739DAB4D4D

http://decryptor.top/2890C6739DAB4D4D

Targets

    • Target

      pRGiJZE2.bat

    • Size

      189B

    • MD5

      7de4a8d57db460ef3d2d733558cd5874

    • SHA1

      47500e03b81c3a18d8d79769c082a76cbb1566dd

    • SHA256

      2d37f42015e8465ca0b781a56385c0b4a90e131b8a7fef6fa43afb8e7821f662

    • SHA512

      b1df3f38def62aa84c48579afe78f1282dc8c1a88172cf6f93642897b98b55f2b312c88391a4709744d04470f3e3f467320974ac8c45d3b3ddd9caca565c23d6

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Program crash

    • Windows security modification

    • Checks for installed software on the system

    • Discovering connected drives

    • Modifies system certificate store

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks