General

  • Target

    3yFsXBJM.bat

  • Size

    194B

  • Sample

    200103-5bbywmjlze

  • MD5

    352663e27cd6d2471f0bffbb78b15343

  • SHA1

    54580df6d37776d54645850dfc10898d51fa4719

  • SHA256

    504dec8fcbb3fb46037b86882c6760e22e3e0ebafdbc4dca3df3101102dcdf15

  • SHA512

    e4eda672ee4b02cd9001f118d30daca0a5d9eb65ae71e6648322237da0eedf88d6ff461b630a5b5ad951227c35f39ab8188a760212f8fc6b60001e2e3df2021a

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/3yFsXBJM

Extracted

Path

C:\nyu2d5f75-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension nyu2d5f75. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/03460156E7C74522 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/03460156E7C74522 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: W+xuOQU2B0AN6mWjpXEfKmzJjQjubbiVoHZI06/Tm5OTxKq75pli+n2JALuxlqbl fzh8n2RUnJO80jm4j/qFC2HnxbV8Wa4TWHL9DgDPEFXnlX0A+lodcgWb6MaLXvAw CXgAHF+jEz9K/tS68qtJ8xqznDrHUFFH+2WonlP9C6jO6JmyKvrA9uuJZ2We0bVY 7iqp63N2LGOu2/aAiV7dW9x768zobYRrh1YSHvCM2le+bK9Zk6AcFxzVX9fWQ31X 5Kdrp4dMayjjsIsR8cJ6+qjD9Jn4gkNCV1lZSBlxfitYde1wlVe/JgKozE0o+AqD 8gxZI2N4wsuhhkq+0wytZTVH4MA3ASMSLuyc96XFicDwgwDxSEPEnDgJdV84GWEr 2BwxE8FbR9QLiq82ohxl4YyZ1fwnID6FLEwWcMi+Rrll6chHT//j7VvHn2DHoAaK 8krzRRshHMX/U1A9uo2fcJR90sfJTEnD6ca3ay789XINflFApobaMCucke3s4YOE 7qG5EHuEBEidRzOVJBajkB2nAZX7XGihXILQntnBecplqftk3tun90Vxkb1Jx2mk 94fnJ/PVVmJgaMACLSlfCGYf7S0fqETszmXvBjp3Oh2H+ME7usT6tRGYMaysP+nE KQmSECPVH7qYts1jGA3OiB1Y7ewxMV74AJg2YNxztLNW3iV7ZiNF80L0MNpm6PtS UgvUN2kMAeR+H1sFJrdqoM6kmylqb8JqNMoztGSY6DP1iaxHwNJYPfK7t/SsY5Jo 0InkPyOQR3eOVny4jjz0QUt4wTSsugUqGgHT9P8e9Ba4IAtqh9hpErRRHL8/cjex P8ur8iTbOozP59F+2VTkZ1DtLXLspJoEO1+veTztcl90wGsDveWr2UUdHODdgSn8 PpzdvD99aJBre49pKtwCBbv/5GFkBjrN/co2GEmMNkE1PXc1B5oKidWqkmiZU6pG hComblfwAzQaH7zi9D/2omFcRXM37zNVQW7DxE4clfN67dtgBW2Hyfh/pJ2mHBO6 5xCuKKtXxdq++eSjVD6NNJ2UiZ1HLJFL6U8GTJkr4wZkEO1452kAxikK9scGZvya PP3PzbRm1V8WSz88Za+3ZtYWvH+kYCDau/19CaYJCzWlJDBLVqmRmsixRqsZclX+ cL8vr0Hgoxq9i22hvE0H++bo Extension name: nyu2d5f75 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/03460156E7C74522

http://decryptor.top/03460156E7C74522

Targets

    • Target

      3yFsXBJM.bat

    • Size

      194B

    • MD5

      352663e27cd6d2471f0bffbb78b15343

    • SHA1

      54580df6d37776d54645850dfc10898d51fa4719

    • SHA256

      504dec8fcbb3fb46037b86882c6760e22e3e0ebafdbc4dca3df3101102dcdf15

    • SHA512

      e4eda672ee4b02cd9001f118d30daca0a5d9eb65ae71e6648322237da0eedf88d6ff461b630a5b5ad951227c35f39ab8188a760212f8fc6b60001e2e3df2021a

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality

    • Program crash

    • Discovering connected drives

    • Modifies system certificate store

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks