General

  • Target

    SbbpUVLZ.bat

  • Size

    198B

  • Sample

    191216-sww42m789e

  • MD5

    b831e77e31e8944c1121adfa2ea34746

  • SHA1

    dbda47cca23dce93d69f4d12af7c690bd29f8442

  • SHA256

    600cfe34a4db54318db70d3cc036a50e63d7b7bb50f7f3983de8ef03c9f5d718

  • SHA512

    b57067a88cb41efecbfaa07a258b40e52ad090f1d818ccf4b950aa1ce6939459549afe3fab16828ee9de8c523782838c7e5c0f214edd1d041859702c69edd158

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/SbbpUVLZ

Extracted

Path

C:\8532gv9y-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 8532gv9y. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D6FA3048D6662B83 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/D6FA3048D6662B83 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: tql8LbWp3P9NONT8CAKj0o7bfEiRY92dZUJZK7iOD0QQzq1aGVL2T//9MYwwcJiG MNPGlOZf0kTfD1RjnfEMO8Wt8xRjIKOatGkmK72ZuVXrFxW/A1VzARf8vIoJN5NF hG/xW5dewfIQaCNfjBpHCP6LZ2mtO0rZXoVV2JBEZpNpn6b6lQy9D+eJgc1d2EPU mbTQmF6aCJA9gQ2R9xkng4uqdwYFvFg7W2QvSxlDoYDsXK/Y3aZJHFZU99syJb6J S1aiOWY4SjD2pMbZpMghFImYkIkIlU2qo19aLUF/6mK/AqgnJ4X9ij2D7l/PysST FiezJuCaaJVQR0xe2v/RB4HUlg3Av0il4haINe0h/ynl/WFgUvjsLqI6Rzd3CDcx jHYMpDyhSTAt9gfjSrixIFaxfRSnjeTIe3BXboOEyLifMUSES025Hye4KKc9T/6N ZDX+7wP9410IOAOUlvzbRDIIdn2oR7ANR43mlRDNSYOEDrj/RabBIrJ3l9AkTqKg Ux+e/C3NZi4TLQyIjzyCAvian3ocr+MlAS1hzC16OCYIQFCATK/sEK//na0v+qSL uEz1zIWdMRHR76NVqzAPG617Vnfi/h7O63cCduLt9qPnr9/+m44GKxsZ5+IMniHC CgFAwL8+xl3MV/B7kcGELko4yRfmNTTO2Bzar1+Tim55+LCmKTlkL+0p04sO1LpI vjWFbH66jEyeEt5gTNPIJn4WPM5m3JSdtPQ90i0vYx+Pwz/P55w7P16bz8xKTCd9 aFyxwQU+ZbGAeMWpQLV40nK1cGv4qIAsUvAFklC8RrnHvGANyPUn4p9hxljTwBOA 7ttIVHchwFKoeQxFkIJsa/wNN9ScP9lzRPfuHeA/3zwN2eLUCIo8ZyPYAlW43tCp VrqjM0oAB5ZR6AaDQkw4kxmEBZyt83LR3dR5CAlDI8U1y54PEUS8pRozdMiibruO N1895DWEv5FyGkzm96+G45vVr4q7Z148vInNFewCrrXWzjRAE2cY+y0nvt3EdC8r NHTEj11JiU9A/5PZodGhbF5MKBNmrpxY8cbbvFBxZUH5rrST9jcVzvSjQgDxpwWz PFOAQHHbmHmz7mBMhFL8wJkVSViRLpjZ8RXqtV80T/qz+hJ3Tt99O5RyS2abK/Dn CXxHVXpR7A9M9OE867xE5A== Extension name: 8532gv9y ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D6FA3048D6662B83

http://decryptor.top/D6FA3048D6662B83

Targets

    • Target

      SbbpUVLZ.bat

    • Size

      198B

    • MD5

      b831e77e31e8944c1121adfa2ea34746

    • SHA1

      dbda47cca23dce93d69f4d12af7c690bd29f8442

    • SHA256

      600cfe34a4db54318db70d3cc036a50e63d7b7bb50f7f3983de8ef03c9f5d718

    • SHA512

      b57067a88cb41efecbfaa07a258b40e52ad090f1d818ccf4b950aa1ce6939459549afe3fab16828ee9de8c523782838c7e5c0f214edd1d041859702c69edd158

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Program crash

    • Windows security modification

    • Checks for installed software on the system

    • Discovering connected drives

    • Modifies system certificate store

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks