General

  • Target

    Dt2NFbUW.bat

  • Size

    198B

  • Sample

    200101-xdjkryzdk2

  • MD5

    973cddb2b71bb9827a2df560d75af93e

  • SHA1

    8559341e73f0a51418fae343f5a597fae5bfd98d

  • SHA256

    0d14e2a78d12efbb31930c5dd64b18c68e4918210d071ea300fdbfb20f0d0bbc

  • SHA512

    d0808c5a8648a9dee3f98f83c0dfbcd433f84912a043fd0fc8f39bf29d3f3594e9b2a288933339d76f6dcbc178867fc52ce196e236debe570a1e2451783f7ecc

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/Dt2NFbUW

Extracted

Path

C:\7qoiz422f-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 7qoiz422f. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0334E33A2BB9B1E6 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/0334E33A2BB9B1E6 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: L0KKO+KT1Fl3AS2VHeOIXDB252bXc0MjEfh3S6FB78laFHP3QdQg6TrhRt/CBow0 ppnt0cpclACgozuTKBceCDfQPBakvQ2R90b7Y6vZzgoDm0BC3e5lnBVOesHrJBBT 7aV8qV9jNSaZT9ethxFN2teDjarOjlIR2rlsR6LiwP6VDu8R5nnys4B6d9fchnjN H9Bbs0EnRlxXBcfFga94YueLMEfIlAR07Q+jgSxyNmZPaVQdOgsdHea1tKsfGFmo cWt5e3s5wtl4DR6o+WqKFvaRYcM0o43Yuc5sC+cQBi5nVkE68gc6K2ePJj17oBx1 wgwR2eldHTlerqhbWYxQVszc/lYcCqxCp9DHL1oAeOJc5QSaNdYQszBOI7eKAFJz xDsJ7pxOznx9Ket8o7G3NPjGKoaYjdhi9/xeVL5NXIzupbhjD8QNvv3X6exOQglt /aPPHHR4fa70g/n/Putic25L2klw4zgJf1Sc7rhv8JHR6lRYxWcURJJLwbgdlLo4 lP3ICBrtzFlwSnGmiaf3/0moyVV4R/pYhGkZReVh36+fWWLPy7hVmlqNfO2r8TRl 5rDIadjNQdbentXhupGHpFNae3WT3lcD12QZCu3RQ1Wuhr5UAsF3ey/jREw2VX8n Inx+LwNMJ0G0OTBJJ47UrNmI21wip/rPOEnLUoiy4CM2iDsH1VISAVoX4o5qGYQp OEj7X/6GFwJefdG92R7W5JkOv8XH2gUQrI/SMLYtDqJEhTlH0N4m0B3VTihP8xPS gdBaTF48Kc7wyrElycxd+wfGTZF5eySWUWgb5IxJeg7KdTcAkC6xNDboWIpWCKAC macjy6Y+OofQSJVhr57C0WJ4BoPVy3IObwHJ7GKZFvhPpaFBiX1tRLxPySo6f3Jf vAK/VFc+81G2rgZs4G5Oyt8TDQbn3vaZK6TgdwQaiIr/qIlGD3nsb3LR2T3iKvm0 IQuErlQSNfwZ+t71yBEhS/yO3+ZkV6jZ2Iw/j1CXhfWqrDIvQbxX19cvTmzi9BPJ kNvsFa8UVoOSoNFf1IhI4MowTisdb7I0cegid3KogLL2HzR0cn5SMw+JM+T5sXUs K7S0ukhXH8M7YNu5rp7JAqcot2APEVIEvKogHmMPLGqt4k6Ckt+kk0TTW8FYM55d 2x5n/seqkZEXkfzbDgiKfdSf Extension name: 7qoiz422f ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0334E33A2BB9B1E6

http://decryptor.top/0334E33A2BB9B1E6

Targets

    • Target

      Dt2NFbUW.bat

    • Size

      198B

    • MD5

      973cddb2b71bb9827a2df560d75af93e

    • SHA1

      8559341e73f0a51418fae343f5a597fae5bfd98d

    • SHA256

      0d14e2a78d12efbb31930c5dd64b18c68e4918210d071ea300fdbfb20f0d0bbc

    • SHA512

      d0808c5a8648a9dee3f98f83c0dfbcd433f84912a043fd0fc8f39bf29d3f3594e9b2a288933339d76f6dcbc178867fc52ce196e236debe570a1e2451783f7ecc

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality

    • Program crash

    • Discovering connected drives

    • Modifies system certificate store

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks