General

  • Target

    wKmecP8k.bat

  • Size

    198B

  • Sample

    191216-t3y4krh43n

  • MD5

    ae956bed6eeab863c79e3cb580bd0134

  • SHA1

    aed4786822253bbe27f96ab4c02edbcb01af5304

  • SHA256

    a2d1bfcdf15107fc32cacf9b39a4eb453610f20fc79328e3428c1551cf03e356

  • SHA512

    2f6c713b6c9e76f9b0172c6e3597eae5915060d40f2a0a9776dfb41358d2c934c14c367351029824fac76f3162ec42f95a31e4ce57151aaa6d5e606bd6c626cb

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/wKmecP8k

Extracted

Path

C:\o0371501r-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension o0371501r. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/EC6570002F081545 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/EC6570002F081545 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: X++vTsZZ5SfmX1BKxZ5AMUlnfCvA6AuSfbHI07L7VA2DfW0omuBF2MLAjT/rQomj Qa6qCZoHTaQkXlLzuJcXoubejwGPHl9gKuMObZg4GRVRNo4VdRsQ3oHK7GviIL/K l/bJziz/ntyvcNSzsMh0Qps7WmaBkFb5DPdPjc2OKvxU1jDDxltFmI5Oxe/vISqO GoN37FTbJqXRU+NLNlPn5rhBqdu/oKFRgZssy8sU5fZKM0Vw2xcQ/OZAwyhPUgSz 4J+sK9OUNpBDMSD74ZaLvmLVoenSVU0KF5Zj8MMSljP1maUbgCu7/+K9yf0AZjYj oWh9V2YZiadQ5IvsuGoEuyVDM57nXLa8c6OFYpTrHmPHqwQxM7sKiteUSFRzz95O xLWAAG9W8PrA7VSwZQbZxlsvewwwOaB4TqVDJ5VIJ1mwRSCq4IqT5sYpWWGqXlnW QyYNjWhyH8DF8QdMdlWtUenZqdOFYUIzvJwVzDsyAEhuzY4YyRUFeJb3tGgcsVUP TLSgISrh7QH/djTb+qTdiwYL2Mu76yTW0jll82Zvs8rblxRbPtczMpE9eWBTcdJe 8N5BckxMeoqwgEzrRb18tSmtnywPiDyRYqmn+UbQWV3SUK3RSdE7EcGOplqw8g3t 0N4FpGo4cr6PaST7kicgGQhhZ4ECBg18hTeiWOdw+xzOQNvlCcnnUHK7P4NfG/tM usW2gzuwGK4NyibMO0ygPxBHiBxmp7cFxF70YPPpWBmllzrWzbBDJigHxvKsVZpT j5po74WRjj1nZ6EsOa9stlqAu6YddhhzA/+87uP3+JvPo8+XOEd35S3PSK7+pQSX IDPxRSdtkDv9O6cPQ7rfCI5v0jci2dIaQzEOhIE1v+ogXGFm0IwJdVYYS+p3Wyi0 iROoJTs88ZSYln36O/Hm/ge2PD9m2HNq8rAWpQLMZRnKMFgaCLtD2s7kIo6yjfwm 5tz0BguJP64naa8SUOh0JNDjt/dKSF1rO2zcrwyD+zey894uNA7Trn26fPNtdBIv 50jfdcdiXyfEYKJB3+O63r2R6tWCT3gpuWXG635qC7uIK9Y0VfOowCSiHtzMVqap YwtwaWJF8ZJm1yHnU5ubukkxPStTwD52UQocvELGdyZM4/6oDsgRY/+TnJEAXxvQ BR9Uf8LV5xNr/PIKLJ4bEog6 Extension name: o0371501r -------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/EC6570002F081545

http://decryptor.top/EC6570002F081545

Targets

    • Target

      wKmecP8k.bat

    • Size

      198B

    • MD5

      ae956bed6eeab863c79e3cb580bd0134

    • SHA1

      aed4786822253bbe27f96ab4c02edbcb01af5304

    • SHA256

      a2d1bfcdf15107fc32cacf9b39a4eb453610f20fc79328e3428c1551cf03e356

    • SHA512

      2f6c713b6c9e76f9b0172c6e3597eae5915060d40f2a0a9776dfb41358d2c934c14c367351029824fac76f3162ec42f95a31e4ce57151aaa6d5e606bd6c626cb

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Program crash

    • Windows security modification

    • Adds Run entry to start application

    • Checks for installed software on the system

    • Discovering connected drives

    • Modifies system certificate store

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks