General

  • Target

    phS7sDeA.bat

  • Size

    189B

  • Sample

    191225-l9n5txl4f2

  • MD5

    739ed59779986e9ce7401753ff7b9213

  • SHA1

    6898185ac808e53a4b559399ab0398d1bf03f1a4

  • SHA256

    0d92c7aceb162dd4ca758f9336c3b8ddcfb23ddf8401d5e0512fc8475dbdf629

  • SHA512

    bce4e2227738b03007fdbad88bd46b8cf725b16921a6ddda0f6c42d0ac95f4d000f7d7a9ddfae7c40fc08f5cc6b3aaf852dbbdf3541429fd4448a6f8efef778b

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/phS7sDeA

Extracted

Path

C:\mm7rg-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension mm7rg. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/55E8C7ABB7EBAF59 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/55E8C7ABB7EBAF59 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: RmPYQUi/pgkcMwKm4qemneCFmlUZo7oA3srOpB6ea0ZME5WPDZKWc8Mw8mfQS7f0 2NGzSARk4wdj4UUtF4folUbVx+FchtG5mam5KL9/zEaR7NC4+x5AZQlWAenu97lk 83t7mbS0DH+pQho0DAscGfBMXmX0NTu2TikHpA/WmFykVgHKduan6DDqT/9ipcXZ QoWz0bQ/7ayecnion4VVD5xhDyi6CI9AdoRGYkgkdj47kpo/Q3hH7nABPfK3HIEh a6gClLsUu3DerDWvpr8MDAcyLvR97ADCzFgmq1wABpzl5DCaBHW0+HWdxQcsj9SD 9LR9n2WyvuSzPFVgLjfexd4RtdZBzyhoLnAVL9BKpE3Q+n2sx50rMLIbKGRO0QCP GisL1GavQFMuchJhwXQ9A9oofLIz5Ijw69jhXB45pk2VbCDwftX0n4uhQq8etnM8 yM1ZJ8ma6/7kXHrP4/vJfcZ9/6mfqwmWohb/PhRu/Jrn1kqEdMc2v83eDiy60x7b ZCDDV/A/ncJuPfVV8akq04dMz9NUVvGlALE/GZ8bn4xsPNnCD9RHVzVjqiOy27et fHy3YnjXucLrxjzXX7ii8DhHUomI1hrVKd1zfLq8CX9eOViveG83d2eBGaTGHPiC pOUA63Hj3O5zTS2BIU1y8MkzvDg6zBuzj2kOl1pgOH+zr7OlugXMlA6CioOFbCv2 xOJa4bCVb8O0u8XT9oVDmgfVMtjhiknm2BTvflWHEl8/VqMoFclTF/vYwS7ym2XZ Y2Kz6Cfw52byAMknlJF471MjlZJrELdb783phvxdd1H9ABlLEnz3xgLJaMTb8sak 20nq4S1TFwla+ooxVZh21rJ06887lgF+XmJiilXvEHSWX4dOHtUhXWtc+OgdpwAG jVKplvvEn5n+mk8cOga6d4U0OHQ+6BU7EE1HfkhIBY6yLjHgFDQjH7+uYYqY8gwQ YPq6PuHKjeiWMC9KRu+vVFUM/B4DlTiya5rC7ywAI9U21EEWpdNlFUaiJwN1F/27 qmLTkF6WmVBRC6xC6HIVUmajdZ8hBLvnBUjnNNVevEE6XgW1YyN9gVXpQv/uH94c aj3a4son9uiW/tp8ZyT1i3p7tiJSe0Tsmlm1swQinsSNKP/3pCPZdUr2T+9n8Qn3 giKDkiqZnXO+5Q== Extension name: mm7rg ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/55E8C7ABB7EBAF59

http://decryptor.top/55E8C7ABB7EBAF59

Targets

    • Target

      phS7sDeA.bat

    • Size

      189B

    • MD5

      739ed59779986e9ce7401753ff7b9213

    • SHA1

      6898185ac808e53a4b559399ab0398d1bf03f1a4

    • SHA256

      0d92c7aceb162dd4ca758f9336c3b8ddcfb23ddf8401d5e0512fc8475dbdf629

    • SHA512

      bce4e2227738b03007fdbad88bd46b8cf725b16921a6ddda0f6c42d0ac95f4d000f7d7a9ddfae7c40fc08f5cc6b3aaf852dbbdf3541429fd4448a6f8efef778b

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality

    • Program crash

    • Discovering connected drives

    • Modifies system certificate store

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks