General

  • Target

    gUFmsNr9.bat

  • Size

    192B

  • Sample

    200101-rpqtg1ratx

  • MD5

    ec0ca871ccc3ec9813ab3ae758f8eac0

  • SHA1

    367be798c0689623705fb87dbe00c45d3877d16c

  • SHA256

    e43848480ada3d64317a1b5588e887d38eeef746d3ed3f7cfde1d2e5a5b5b099

  • SHA512

    1f62a6ef1198bdc2b3d2afabda7e8c741dbdf901d2719aa4c74be5e3645510853841ce8f233ec269cf7efa56f29a7017283783c73eb216fcb927ae4e889e279c

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/gUFmsNr9

Extracted

Path

C:\929lr-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 929lr. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F944365DCEA7D292 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/F944365DCEA7D292 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: WBUrBQxmt4SLUPRE2mWmM+m2NbVpphWdDfhXGpzyLs40gxHGnTJRZ1K49h6HHfsl 556LxGoR472JbS9OCqaLyq+RfXFRqNaGVhLmDOlALxDo8C3/DdYyG3bI/7SyPwQM hSfncen9TxmLYMTGXwmtMAjiaI8fyVuMyKPKJL7O33dE8iK/W+Ma/s6VKY+QAEyR X/qGTjIEbOBnD1OB/f6FwUudTUgx4wYXWIXgc/tLX0Gf0qXOjy1zE5v58jCNWbdO kxwoWi8vWzO7tEBr+xwTPZi4vyUIILSbpD8LmYNhTC9uNCXrb86VHW4nHWh81K9E gAnGVBNk/T2ODkXeiJmQ3c+RGtfO1RrkeSOgwk09PNCToFLGxJmtzZhZXoolGZUl XcO7xAZGA+5JL9k0c38hhJyI03iQ4Dun8EnTFfN2w3cGw4DNtVnH2OuflNgr5Gfm zoMIkh3InwaBCjA8yO2ffecHE5SkyXj+wOLTvZ3rjc3EL9tCpokWHYRloCxiXPrZ kNB8reHz1ftbltTUOpFxDmzdGLjYL+LzWjaI9p4Hll9S9N+NFV1Ih+mdFN4fMYgz 1hd2do/44MvnjsGVZEXrEkY5+OT8b7rmpuGABwc8ykAvK0dMAK/Tlww3bqYA/XnF 9Ep80my8rmFbYoj+0v8tuQenDCTbMEZ0WXC7HBwe603YnuUAmUGibWn+MPZ1tH+M nMguvrBC8Mr5R4SUroSGtu1VHHXmECo0FiG5XZqCAInurzIRkWzSjCN5PQNsh+n6 F0u1iddHFVt/2R+jpMnxb7XHbXrF3/lJDZ69kvxItwwpGP3taM+3cWHgOtuByeya XIdg7kQKA/mLUoiFe4cIQLrCX7qOM3OnLyoRjY+nU22llKbIXVWcVZerPj/VGOJ5 ZZfVfVU6SuBMiFGBX7LZzxM/tFbbqK4VLgXBZ0ssfzoxQVEnqktHjZPuSXDJknm8 CaVCYj52sTHAPQM2daZ/0ZWhfB6bORPxq+Gp70xIeDPZKKrmlizk83dWLw+OejhP /ugOS5+eoQOK9HJuNsVfxD5Hj1SMLjDVuryY7cITPpZBPfaLCvjmIF0wFkGFlWRZ JDvpTyWAHvxzgs+VPUqZftazTSYdCQlSrdLTEOzgMVeg8XSM0yj4rz2Q5Kaygke1 UJx41/F28+HQrA== Extension name: 929lr ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F944365DCEA7D292

http://decryptor.top/F944365DCEA7D292

Targets

    • Target

      gUFmsNr9.bat

    • Size

      192B

    • MD5

      ec0ca871ccc3ec9813ab3ae758f8eac0

    • SHA1

      367be798c0689623705fb87dbe00c45d3877d16c

    • SHA256

      e43848480ada3d64317a1b5588e887d38eeef746d3ed3f7cfde1d2e5a5b5b099

    • SHA512

      1f62a6ef1198bdc2b3d2afabda7e8c741dbdf901d2719aa4c74be5e3645510853841ce8f233ec269cf7efa56f29a7017283783c73eb216fcb927ae4e889e279c

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality

    • Program crash

    • Discovering connected drives

    • Modifies system certificate store

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks