General

  • Target

    UAgNLfZr.bat

  • Size

    193B

  • Sample

    200101-yym9p86agj

  • MD5

    966551082b89c957f76eaa6139141f07

  • SHA1

    ac01b92b035f445c673036511fb2bf7ee93269f8

  • SHA256

    4f95f0ebcf04be51de7452dd9607aa1e7fa640e9c93c13ef213d18518aa22d37

  • SHA512

    3c2964c148d47cbaefa362f5dd7536fcc475abc508545775fc65a1f5b0248143e4a7b904a6498e6865f9acfeda21ab9addcbc92618d25087b9a70fb9c6dbd9d8

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/UAgNLfZr

Extracted

Path

C:\u6nzwn9a5i-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension u6nzwn9a5i. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/6FC6AEAC658ED5AB 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/6FC6AEAC658ED5AB Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: d8OxJ8op+xXHa6t/mkA1aX+w8cT2PMb+BtIn6vj/3WRxQTh2lZmB6HSdT9utEB7f ff2zhbFK70ZV0POKAT0FRAA68do9xJ0AJYFLa0bgZFKM/En/GHC5I8BeWAC2ioBh pwOmEe+A0zjhtw063mQBSrmS8Y4zlQ0EXV3NdvciIqgmya6JdzJvrgrnYiqACk9R fnyUcoiMFm3mGsaVtY+5ytmHiOMgM4I3U3o4UP8vr/OpaJtSDjWKkMOj04DDCqaw tCfnbwBzR3Ci1Yu5S0iMVZbZqoXRRgcSbaCHdwLqrKHisSzm9lvgGjHVMFD6nhvp rOVg4TQ2Nagb4pqyzLMEPMMNfIvjYG9cwASiYbom1kw45lYG5IKxvafhYqbfJaCR 6PdrMyWVQFDN+kpj31YPboct3pUN1xwx22x1AQq5s7s1/lrXUndWF1cKrmSUnB12 hfsNziUAIJBIcv0AlLOnEiBrtF53O/GZgVO27oeVYluQ2gd+owmIPaeGhEJxJi46 1VfM4gGdIn1fj1vOMH5WfBZXWUjw2Q2Hhd53B6r4kSc82UV2ZLxDkmuUaaH+uS/r rVfcBgmMRF7shBGk5e7AQwVZgAdotX526SeNjIqmakm6bFIVTNkuENtttjjWMu9w Ts2CASyWfDlq0uMX+N1JUHoqvJLzcot/boIvgj6dPX5LOmtFoN9/5JDFtzOOxeWO VtnsD+GtCjH3xl2taVQ8MfgnmEgBQWW0AUuWaFiesff3ehAucoiXZ8xiOxhciG+S FK9LyMm9bwvKefn84FPEQaeyd1aYYxyaSIrq6/oYEQjWhn6/+2rsUSqY3WUA8Oig /THTiXXwvW6dpAgwSSQUXuGyQfzF8Kw9zAAsIKctHV10ZvEruptbJCGP365r4oVY vbIYaBf0CCEbKuegakBG73S3it0GbbumbQZ+7j+GbkXV7Cyh/6aIl4F9iWTrT/a6 d3hza9HBOh4ZNlWIBoY+5TgOl6BuTIXTNiG/fBZhjKk82AA0HPORpLWGA0HdmjEi YgxjpPgxSAjTb7hEaihr81/vQB/L4e/L7YBTjMlSbU2Wx/Ru+QeqAlCCWcgNB/U6 d5a/nCKeQh/3iKR/4k+Y5GEL5eLJ6nuPR4ZD7j7Qvc0EPf0KZQ0hrlO7dwB3pRM9 VafGDVyKzwZ+E5Gqywu65MAV/vY= Extension name: u6nzwn9a5i ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/6FC6AEAC658ED5AB

http://decryptor.top/6FC6AEAC658ED5AB

Targets

    • Target

      UAgNLfZr.bat

    • Size

      193B

    • MD5

      966551082b89c957f76eaa6139141f07

    • SHA1

      ac01b92b035f445c673036511fb2bf7ee93269f8

    • SHA256

      4f95f0ebcf04be51de7452dd9607aa1e7fa640e9c93c13ef213d18518aa22d37

    • SHA512

      3c2964c148d47cbaefa362f5dd7536fcc475abc508545775fc65a1f5b0248143e4a7b904a6498e6865f9acfeda21ab9addcbc92618d25087b9a70fb9c6dbd9d8

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality

    • Program crash

    • Discovering connected drives

    • Modifies system certificate store

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks