General

  • Target

    KMEknABL.bat

  • Size

    195B

  • Sample

    200101-l8648xkvye

  • MD5

    b31aeb87df5a931d437ea87673c47056

  • SHA1

    f00e5818beaa44176fa1799aba328098e65e45e2

  • SHA256

    85fa65ad29ef62077ff5fbb0289138bfa40467a804a5a73eecd2d25ad9db1ccf

  • SHA512

    817d539f853cbd09f94dbba112f0a973ea4a6a9078b40faaf9c75d39c3906d8ea3be1b9e6ed15a7fc841a84a44af98dc2ea15b8522e448dd52a02f26a96e71c9

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/KMEknABL

Extracted

Path

C:\93zefhpw8s-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 93zefhpw8s. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/03460156E7C74522 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/03460156E7C74522 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: L3i3hG1MLf2SztTRK14JnwNXD/RE6oTmV0zq3LmdetHRxYEOwPBQFdFyv8eyOhAm raqNXIvnOdAmOszdDJ5a9+dm51RU6rw5LSz59r977U/HPThTII5oDvLbZT5EGGHr dV9OL2Y3fmnLOOLJ7SMTKywoMQHiIvQqEjYA+MoE3I7sA5aeJg6W9abVRf3CxRIi szOJ0oR/Y9L2qJPE0wHAbqvqAYftI0fvvmLJfp7WeiXq9/y3vxjk1yDW8cNxHG19 xa8gS1DQ8yN3ugljx/thql9OLYi5bGUqP1slO0oKTxB55PnQee09aMp1198lt4r7 1iyN7eUNqpfTbMy1O1zjoSYrlfitj0+SKZf0cLSQ+lgTTuI45lL/j7kF7ws4zjiZ 27PJ94dxgJsKxb150WCWy54QLgBmzO+xQ/sASD9aJeLSep0jNthIZofApOG3xvh+ JyKJhjJGhtM7VPzqYAsk73ck3ZTF7yyGyPeUm7NDb9QoSaFdJaBI/1qnYavrW/bK 9XlVM7hVc3FNcXrbJV6gT+UxEZw0hrU5xuu4TL4Jiy+kMQoIBK87I+avL4/btrnb /C89rmXvinpOPuJAmyFPl1opsISdaoPCpvUcgcllwLnVkBEJlMwtSfG407I1ydkS E2aF8rZUEVcShnDSX7ddV8CpNwa5U0c4q55jw6+YlSnCKow8ilfxvuT1zBK1yQX5 yCsgEgzGrg0U6HFrvhhMNIFBkVnxU0ZBouHeuKm+seVgp3BfhOcNzKgHIZxJV3YI 83MD3WSPftYb8G/OUyFaFuG1U6lqCnhFEbX/cIzsyflYafP9fbtmcjWFMDTlfBfJ X+JgXooo40UtwSFyuEbwGlZ2mfHXGihvQfPdkR7z8OqP65Xu9gmCq8anT7zFopw4 JUfqOgWZ16XUlysccu48g8GfIygkhJUfDocCnKQMe4Vdk73pH0HZ7YhzUIzji8hD HX4OL3XFLwqB1T9b0cRN9Vl/Tbk4DQcotzb5I8xfva7YG7jTcKsF6Wm0Ee4CMJfH a1e5NwvbgqAquGkhuZMadm4sSqewufKhb1flEUwq1pOu/2WtDAvdZ9J1yLFCjgQ6 vVfRBKvBMNhyG5g11rh/ddB32JMFdZ5tuOYjnPjdc3Tt2S8aknIPFiI9uopv+r8l fsillKQkylWTQqvWcHCSaGUgRuY= Extension name: 93zefhpw8s ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/03460156E7C74522

http://decryptor.top/03460156E7C74522

Targets

    • Target

      KMEknABL.bat

    • Size

      195B

    • MD5

      b31aeb87df5a931d437ea87673c47056

    • SHA1

      f00e5818beaa44176fa1799aba328098e65e45e2

    • SHA256

      85fa65ad29ef62077ff5fbb0289138bfa40467a804a5a73eecd2d25ad9db1ccf

    • SHA512

      817d539f853cbd09f94dbba112f0a973ea4a6a9078b40faaf9c75d39c3906d8ea3be1b9e6ed15a7fc841a84a44af98dc2ea15b8522e448dd52a02f26a96e71c9

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality

    • Program crash

    • Discovering connected drives

    • Modifies system certificate store

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks