General

  • Target

    e8kSryaf.bat

  • Size

    196B

  • Sample

    191220-matk4mdz1j

  • MD5

    ed5addafaf214c9296d3c3be2138d501

  • SHA1

    20294ab7caea8ba78519b41e12359ed906c0c36d

  • SHA256

    632b25be71b19500300e6e3e404c0b3c7bc7f8538bc3db94fac827bb91ee848a

  • SHA512

    fc6853c3b1437b8461dedabd04d84cdb4069a24f74f3f2914626942c61abe7444371eb64130a4566b8177a0ada4229d03c2717695cc0252cde7620cb20b82ed8

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/e8kSryaf

Extracted

Path

C:\7khgp2z3-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 7khgp2z3. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/041FB4C15C08312C 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/041FB4C15C08312C Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: jLNvxkiCsDU96tNP+jdSNkcPED/nEUyL1PPEtpHPCVCzZp8bdGwY9sYyvwKMo4Ae QXohQ3f56IhrJQPrT5kI2DymerPLzDJuJJbFarQD1UAwLyUz06zaC1TXKmDkzkWF azfFl9jMVLdAOsoV1pc0J09JEZSMVZWPNJ+4M6+Tj2GsOkDUCVlT/bke3Q1KOp3j UcufmLPsC5psThJmIL/Qqieb3rUocN8p67o+oJqiPNnEeTVttsbHydFGfVe55ZSH BrGHsphpSGWPn5DJUlTBV8O6NlTUdKxq44Kt9Foe3QN/cGUItszetj9Y4AnAvKjW VY4Ixj7abFvWDtUxOLg7EkuZ+u6P6xlFc5LV4brAejj1RO/hBEEKwseh1TCEQvVv /MoYXeRMqD43AuKEqidLUdXS5b1LIQBT2RAApovLZcR0bticKG6ZQqS0/ulLceuc 1ToCS9CuMvJJ68qctgiwPgY0x6uBBB1/NaJu5eJcUUeoghhsRJ6MiFKW1Wih47wV wzlKw8FZnPxkUdvgVlgDNEXFS7j1xsVSsWvkSBipg5uUYI+fBuAN2eBfXj1KMy6U 0fnth5U5Ef6IHNxivXuc+DTa0gnGrhQ8B+vEUeY9zGVWJiiCk5LeEjMLoGSnUPuv +DY6+I6D9vgTaghR8zoIckMH5JNGkliM9VImOrlNBLkSiqXf+d6z6wQxdBT8p0a7 mxqGS71o2x1fTOHYiXFJnkk3rTYafWLVQFtBgrL2/Mczv2/GB/YH4teWPc5a+aK0 Q738Khb8yWb9kH4Mq1Pq70oTFzEE/oh31Jn7RecfjEzCGVkOOtY+DEe3crwZnOM5 5JzpGA/F+aFZAEVejr7dPpXGkdt6MeCnGR12CGa9Iw8U+65RCLKFamk4tHeuQn8X HLFLdN9LVOnMVRd+aqd9ogvmQikPSwyDmzGb234dd23xt3VN/l/nQf46o0RW0vKC 4w9l77cka8XvPAV3V1rx34FV5MUgvlid9Rzg23tgOqzMo085xK/61qKsEfQZeJjY jg/BFymgyOb3NEUC0s9wCGGmvieFN8NIbA2b0a4eHR+HvQeqqsh20odhfSy9G5v2 CdBQHkHnq327+z5+8RwH5yhGQ7otOPZmxYAO5RrfRom/G/PQPE83uFI33S4xHyFG mXGig0w7sn4emRpEICjBuA== Extension name: 7khgp2z3 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/041FB4C15C08312C

http://decryptor.top/041FB4C15C08312C

Targets

    • Target

      e8kSryaf.bat

    • Size

      196B

    • MD5

      ed5addafaf214c9296d3c3be2138d501

    • SHA1

      20294ab7caea8ba78519b41e12359ed906c0c36d

    • SHA256

      632b25be71b19500300e6e3e404c0b3c7bc7f8538bc3db94fac827bb91ee848a

    • SHA512

      fc6853c3b1437b8461dedabd04d84cdb4069a24f74f3f2914626942c61abe7444371eb64130a4566b8177a0ada4229d03c2717695cc0252cde7620cb20b82ed8

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality

    • Program crash

    • Discovering connected drives

    • Modifies system certificate store

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

2
T1112

Discovery

Query Registry

3
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

3
T1082

Impact

Defacement

1
T1491

Tasks