General

  • Target

    G1fL5LrD.bat

  • Size

    196B

  • Sample

    191216-v74pfwl2na

  • MD5

    66ede842f8dc1f852114abf9ba07651a

  • SHA1

    cbb018e1bf534f527b55e6cc691eeb495745c0d7

  • SHA256

    a73b3dcc9803bbdf3c270d7aafa2fc0bdfb3d9792123539fa62c722af0995a54

  • SHA512

    f1d7a175809019db1ae4a0b4f7fe5768b6c431096df48aed453e82e153c2d7cd410569da848a346b108b9bd12c375862edd10905e0463e788f3cb5dac39cb7d8

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/G1fL5LrD

Extracted

Path

C:\oev944-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension oev944. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E0BC9C9BFB0E8575 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/E0BC9C9BFB0E8575 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: p45Ow1mfll+Z+yY1gpBWHxygM0dbllNopaaQLIwKEpHwxjawNnP8cIgvPr1mEA+J IHAG8LGZSRE9lnkfahcBpqXk6xHW4KQlzAiBCaQAvXPfX5Ip2yoGBfp0GRKHkCu8 Vl8WMmHq9Bz9TikF84h46CMDiGdlLHLTy4Xc3x5+/IaYSsCRd6pHRQi1jK65fowk xmlEfQ8u+Y6m7X26W+uO9Peq6uUesA+6gl94Pw2jVbUnvchq+eY/71HicyWeakBa SP5ih/lsuLW0ZbSqdObQSPSKQ2xoyk5TGNPf4n8yyBN4XGl82lkvZieXaheBPVnk 6JTWz3BnDvvBr6jl18eJnbjGGak5QrZ7BFoEvVASDGlI3qQXu+EMQIo4RCKPsVUI 3FSqSTc6M260sjUqn2yHV2e8onB0fIJ57kCIPKnlbN6m52XMNH/OkTMIhBIWqis1 MUy57J6a+BIXprfJ/xidUXRaGNNlDaFBEaEEWrG3mnoAaHoFIuI9VfK2xQK7oZ/k QxpAnhRLf1OkvH+g1OH8xxo6oTE9Dntiqbf8dP/ZyKA1pfw0tBQkkbBNV022kQqj NS83jAd2EodI+y8vQrukiGo3wIiquXexhrtdmEXHZfIdxR3UpG+62v4qf6IhkIhA jg4BK8ACe/V/uAmIlN+irCj2JGKojOV6AWUAZTgQbK9g1VZD+0UQufKRA6XoMHhk 8GhlNmFHQsdyyMWBjkAT67mKeExy8OI0cRNXTUFdsrNE5koSNSezV9DyvsZIqQcR P/E2gp2Unl9vt1ynnPiNuO+YF4RDbBG1+ooqvHO/PoCYODCXa59ioMeFKt+Ds/Z4 hgvFWa5D2D9shU7tWnsCzZL3knVwerrN6ZetF8M022BZAW+ptPQRGQOrEzZo9Io7 +VE6SPrslE0fsOjjBF/7lC7NGfpXwlwPuUifIufb0/pcA38PMybkKaOh1lDnNh0Q UWCtf9c8BbjbOwUP9SDRUG8NOM8PKchG/IAWvjWsb4KVlvCYsEGxX86Vn97TOQl6 HQ4CNjxL1NaCsp+T0AyMKKi2fuOLsBwecS0yovjw9572mYDFijK0AQjeGz42Z3tQ uKdG0BEQTe67vrf8snKwgKL0t1tK/bMbnm6viISjhArEAxcSjngHZTuyIi2967xW fQ82qagp6W2Jerb8 Extension name: oev944 -------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E0BC9C9BFB0E8575

http://decryptor.top/E0BC9C9BFB0E8575

Targets

    • Target

      G1fL5LrD.bat

    • Size

      196B

    • MD5

      66ede842f8dc1f852114abf9ba07651a

    • SHA1

      cbb018e1bf534f527b55e6cc691eeb495745c0d7

    • SHA256

      a73b3dcc9803bbdf3c270d7aafa2fc0bdfb3d9792123539fa62c722af0995a54

    • SHA512

      f1d7a175809019db1ae4a0b4f7fe5768b6c431096df48aed453e82e153c2d7cd410569da848a346b108b9bd12c375862edd10905e0463e788f3cb5dac39cb7d8

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Program crash

    • Windows security modification

    • Adds Run entry to start application

    • Checks for installed software on the system

    • Discovering connected drives

    • Modifies system certificate store

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks