General

  • Target

    YjMJd0LZ.bat

  • Size

    196B

  • Sample

    191216-md9taqrxs2

  • MD5

    ea83bac8ab910d95964fe3b27f75b1e5

  • SHA1

    aa6df9abe565ee1c5f2429d1abe1c771458374e4

  • SHA256

    36a5dfd5cdbe533f51c1aa94a69718240e70670d88d90827b7930fb49023a8e8

  • SHA512

    09d08aa66e57af9608fd30abbe1287762e2332f9cf55068afde87b4a627686e81df84df1696722c5bd3aeec44547b5b759b81535615d77209074c1cd7f6452a2

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/YjMJd0LZ

Extracted

Path

C:\7107r5v5d4-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 7107r5v5d4. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C9F148270743E1EA 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/C9F148270743E1EA Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: hfZjWX5COAEFKB/QJtbUrR+PvRhqy6z1OPNnKSYD4eKGtkxer12nogQc8xP/L/eQ ZBepb2X5APGy9cWmKUbz0n9oDQGU0M3+D3cojSAd6z7fINVVCTvYMgU49+zh601M Lx5rT0txxKL4JFBDCOH6/dNhkHeSsJctQh4xG1hCMYjuaFa37z0nfvmXFsMGUOet HYfXs2JlkEEpAlB0ZPRSg0CkpZoYLxwj/1jpNKoL5qRTk5ghXylf1n5iXpVujYcZ 0zV3YRyV8+p/UtrsmOxK/UBHgTbhq7IpgHeLsRIPRLHTKGt0XnYtg6JtrAtaqVE8 dXtFlI/57nnMyZ6dpzQdg+dXUnHOpLPr0jSn5IxJMmsq0NMkFo2fKPTRD8HxOCfr /xcz7uwQfhhV4u3aESOo2s1WhRvESQ35sBlbRPlUdhPp8r2HYb4wwB9kyeYvyA92 1JUfgANtMu7MBn0PzTH83WYLTgmiXJh0xvrcbxPB99509VbwGe/wjM6H1MI1fqFA 56VYqbEY3/I8hZ339JOFAhdHo1fKN83gbPTPvJ3eV2ZGq6ss7MeTgJX4/bAxJr5U AZGdhMUn6RYwv3hX/REoJvaZGmvakgAz/eOkNrhYh7ZPKCqN1JRh+63laB+kqWuJ sGIjkqu63NMsMpRX3E67Zjtr9RjNDzCfuhdE1loiBCoF7bDkz7HgVGcWeiA9SrAX YmruLZ+3egktYR4mRzf3e2r5Dni7soKn0kxNiPAHPZhyvWV7YWmwlSy/TUJGnbIr tquiv5DNMbXJdVGUr4h6tFjZjKZrhuEauOdg/r3EWhBENr7cK2K/Voj2yWWyTxTU 8jWKFV4Qx9I1VCEyZhhsGYaL5XL1vjzcd8V7k0SVgQUsPHrvt6SVO/RJ4oOqijM/ cUzjvTThGyZ5Srao/ik2/sZeC3l3GuWo9svJuf0oSRVbteIRNkIstVQiMewTdOLp Sjefb5SnLmHaXgQm242QkSglc8AwQLz1UvWfK1KFLdhhQlK7rlse5xpBCmESpz1G OPVMSOzwQ02sEy5SmaxJKs1eCIBYeuld9NuNljwMcrRUhIU3Dt8nC8A9QqzX8+at i361ZiVN8NjehxuX0soEyiB7xdSbLecvkr3t9xEta/WORoopfimeE3m08HDzgacC wFcXALkVzG66nGn8z57UeOAr980= Extension name: 7107r5v5d4 -------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C9F148270743E1EA

http://decryptor.top/C9F148270743E1EA

Targets

    • Target

      YjMJd0LZ.bat

    • Size

      196B

    • MD5

      ea83bac8ab910d95964fe3b27f75b1e5

    • SHA1

      aa6df9abe565ee1c5f2429d1abe1c771458374e4

    • SHA256

      36a5dfd5cdbe533f51c1aa94a69718240e70670d88d90827b7930fb49023a8e8

    • SHA512

      09d08aa66e57af9608fd30abbe1287762e2332f9cf55068afde87b4a627686e81df84df1696722c5bd3aeec44547b5b759b81535615d77209074c1cd7f6452a2

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Program crash

    • Windows security modification

    • Adds Run entry to start application

    • Checks for installed software on the system

    • Discovering connected drives

    • Modifies system certificate store

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks