General

  • Target

    p9h3W74a.bat

  • Size

    189B

  • Sample

    200106-qdgvvy7lle

  • MD5

    a07cd4b93a2d88d0b25de2f0001456c0

  • SHA1

    3899ce3244d184cf745f92eb25e02e21c062c3bf

  • SHA256

    9a95de86c43fbd364f77ec7ad773847ebf56d1388490861c7ae7d811e79b219c

  • SHA512

    e2fafab31f4756d7697e3d23c6fd7bfa4874505a8d6442d5edc55899fe848062a70b88b9295295adcd3a5cc4b97722c3e1d418f2495e6067d2307ce11a2a3d84

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/p9h3W74a

Extracted

Path

C:\7uzc61hm-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 7uzc61hm. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/03460156E7C74522 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/03460156E7C74522 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 9qykbqNhNCl+Zz0WzJ/lWomPDqoxMV0J+LqkuL4wm1QEi6vxOkoxegG44YQtYeWS 0koV40cimGM7K9FwscI4+3XqT/KC37xRJTh6cjdoK/iI7MuFarM50fMK3xlzB3Jv HH0Pr6n/uNUqP4lForWmSnEqL0I8yd0ab5pQsP8T0Yc1SZvMY1LVDH4k+xaMaHEL v90w1asB4X14mnjsQ1qkAm03AD3NDW2514osriIjJ7u3hSy4ojPYeC2RPnHri/9h 3euhIJE+1+juKpx09jed3/kh6bsxKAU08O76LhNlir1ZC7htRazMGt6icsv3Gnvn ldr8Pdg+8ixrK3cJ+Q2f/KB7zc0Kbktb3fGWiEKA11vjhNQckyAR7CqW6U/T9Atl jwhLN2ep4dtnnhFksVh4Z21LfBoc7cj3aDOG2Ni8nIbTIAAwXHW6iTy8aMWZNsEo FxV72te4Q6ILHktUj0gr5icSxmVZNIE+1yCS8nzkzaot0JFc+Z6N4p/CXTYXEfpX fbo+G8zCzefPQa5TCXfhUmlIglG8WV8x2Ygud26mNfGII+xFQS/HGwv64/Cl8G7r 1Uhc6jIUANbBL8H0NyzEyDFxC41GHhWcocbWPMIox9VlXDceI21N7zZcFUC9Zx/L XVtnZIvdXX8XhPjHODHujP3T0AoxfLCYpxqR9apfnYt2Pqynb6CZld4csaflpK0S ad1JUrXfQIs6OhGdBh6YH82/gJnBMlwo71Ss9Dg579u9r3ZC+BAzpRJptaVyfur0 WFf1c/JWlUVN9DqyexVEy8EWPI84iR6jwl4efeeuumQfwoXYAm6Atggyi4abIzdN pb7n0yTNYJqDiBVkvZc/DGbu7m3oMTkFbprmYWLrBM5nKPVZcbUn1SND+dXFKtIq bu74r6zGTm/2Q88jvm1iMXDb1JfYU1cbQsk9CUYh56EnX0l5bhWSUToQqsus7UmA uHr6b/S7zDuIlQhIWEUuebmSu1Esjbb1J4jm2ZrSTy/bTs01ub1cptc1+vtQZ/Z0 5xaqMOIaOZ7YyhDBI65ZBWO0aolrgre8GUnKIC728eFDJwigG4UhLx0yYxOrbgjw xPvlfUFhttCRgOT2Cj2TC9UzpSVX/14AJCPk3i7ilfLh22A1RPQTftxfUAZBEI1j GYJ1Etd5kX8HWbl8A3CTEA== Extension name: 7uzc61hm ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/03460156E7C74522

http://decryptor.top/03460156E7C74522

Targets

    • Target

      p9h3W74a.bat

    • Size

      189B

    • MD5

      a07cd4b93a2d88d0b25de2f0001456c0

    • SHA1

      3899ce3244d184cf745f92eb25e02e21c062c3bf

    • SHA256

      9a95de86c43fbd364f77ec7ad773847ebf56d1388490861c7ae7d811e79b219c

    • SHA512

      e2fafab31f4756d7697e3d23c6fd7bfa4874505a8d6442d5edc55899fe848062a70b88b9295295adcd3a5cc4b97722c3e1d418f2495e6067d2307ce11a2a3d84

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality

    • Program crash

    • Discovering connected drives

    • Modifies system certificate store

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks