General

  • Target

    ZrxYpNuy.bat

  • Size

    197B

  • Sample

    200101-gdmshj7yc6

  • MD5

    a65f56e966943ef2d288e253e69aca40

  • SHA1

    66dc4965aeaa154350d7dc78be79b359a62ba985

  • SHA256

    cc4308d9ba991039ebc6e0e8fbd42c941d669e4e71248290766da05390f18cff

  • SHA512

    f25c21d2272f811fca8952928ed375b03ee2232700552f829a5e31ab219f0effe502ba979899d1e4685c00572d2e05e7095d9b722697507c279e2ea804280c6d

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/ZrxYpNuy

Extracted

Path

C:\wm4l3l0-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension wm4l3l0. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BAD4040FE6406E97 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/BAD4040FE6406E97 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 1y0O16BqmnxuQsXbMlNNh3ddaFg/EIiMay8xQGc8EI4/60rf0VZuf57GPdp0YFtT h2OSPEODDOVAKERJk2swV1jssgdaZ9cehiPJDhWoAvtT1T5ALzswadus23e1ROMX l8LSVhn/FvvGLTP4Psw5aRC1veGj2swzrcVdnBqbCKoWTckdCN6wPG0wX+fOiShH BLVbOVtaUpcfgEYNGEyceX6Lmm2g7VkmqtjSdgMEPv+YjFIiG50X3Tqi499eLv75 Ht4noewGAfo004Jy8RXFWhAYiQ5a/SCKkg8vK3O5HIlhnumeKaXArE8ymFCbWaHz 9M4Dj04ANgq4Wd4lFegMMvCWSdv0B6ZWLpTTE+bGr7rIGFvPKh1izd3AVNoJ/hkO NyMDk8i8WiCvxEiUdW1aZQtNaAOUNeipmdMz6Gc5Aml9gUCkOQLMKx2YGM2t7/Ia VfA74r2KJygkzXJXhvj6Bu5/QV4EXNuxmgmwWheJijGzn4JMbKAPwcPObuYpbREX N98dlpcJWLyydzVepHkQMa8FMnaPGCEn9UKDJfKA4170CSzJGD4DAOKPUbb6dNm2 FF/9zcFz1b12h2IF1s3H0ONDzENm1DmDyPalKJu/djSwYZllg8rLCA7AwWp5sHqs NcDxZzhDA05LWZW5A9mEiPQwA251nIre62As9hHBmL/tNzOYeAgoXFZHSjUjWopB /EdLnsCT2p3Q88sOjB67X/fQEJpPXKH/D0nFPDauyiM8AXz6IlvbzKzAo2SQ1wwa WyzYvQxQSmwipdZyHNWpeZT34YKPPtHbpsddOtmi1hDwCn8YwhBnQeVM+ly15UmU ytOPzSsZxlJ6Pew82exycX1nyxXt20F/vNZwSxpmy775/yB4Df8ErUzvnmSHbIC5 fRYAweHDsxn0CID//DWynfXqjiPEv30E2xA4cDLFzVftdJCz9LaZkydKqLstvLnM OudmzAMrhHoGVRjXxE80qY3Z5oj4vh8xds8UbDaOycXaDQyBXYweNfD/yrCEfzlp qvc5yfyTXcj+rJG9OnUkHmrFGrGa3aq/Qj3AUAkzH0P9fkZ5DCrWP1GTBfK2jpjj 1aLIzQYDqm/JD6FEIaaI2nvzV6Snam+IqCVOMw7Gi7lXsKtZzAqpT58iyMLQLF6M T/O+PkLAvFHUVKzxSo8= Extension name: wm4l3l0 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BAD4040FE6406E97

http://decryptor.top/BAD4040FE6406E97

Targets

    • Target

      ZrxYpNuy.bat

    • Size

      197B

    • MD5

      a65f56e966943ef2d288e253e69aca40

    • SHA1

      66dc4965aeaa154350d7dc78be79b359a62ba985

    • SHA256

      cc4308d9ba991039ebc6e0e8fbd42c941d669e4e71248290766da05390f18cff

    • SHA512

      f25c21d2272f811fca8952928ed375b03ee2232700552f829a5e31ab219f0effe502ba979899d1e4685c00572d2e05e7095d9b722697507c279e2ea804280c6d

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality

    • Program crash

    • Discovering connected drives

    • Modifies system certificate store

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks