General

  • Target

    hBjM939D.bat

  • Size

    198B

  • Sample

    200211-8t4pnj5wks

  • MD5

    31f14e4e5545659b2edf91aedb0830cb

  • SHA1

    e5489bc5f3b8f118e6fb0ba7f5f4a0223a33863a

  • SHA256

    2f3a2162c69c2185edadd4cc4d60b0ef9f2d212d2d710f30e012b9878aefc0f1

  • SHA512

    80298267b14e688189cfefabed44496c5c22a51c50c788ac72ed1b9ad4ab1848068308f1a7990665ebba4220a428cdb7a1a5695a3643ea395af7566726914562

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/hBjM939D

Extracted

Path

C:\s0ks9v-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension s0ks9v. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/2F57540029B6714A 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/2F57540029B6714A Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 2sQa2gib1zFYFj9+QT4ETSXCJjQyO2GmRkYzHmkTU6psNkkNmAUoctCkylMmfMQV CMP8rjq2D/yEEB4ESnueqA7Sy6TGy0ahveZgNAUp3jyFAEWRNFCFX87DMIp//8dk CtX1Qm1CIAqF0WJa0X2WB0h1q8TyuPhllBhLwqCN2SLzAZt9iKR/eQdyUlsnkVlL r8HHkD93fLqMrLGSqo2pPuGpxepjlTeddaF6NJv8ZiMPe0uCJRSPM5nDUHSGK9C0 /5Pt3nRmvq3LUaPngVp6GDBkC6cFT082DLB5yaGiVVbHdhwQ0ZX/N9M00o7fvB9R 49Kx1RhQR+TgYcoI5aTEgL28VeeHfCDIMhr8ZjhwOzi29qj3gL+KYL1oOhx8e+qm 1ljSzKAC5cibju7OUYsTkaOaO+qQGPd1cQ3KYtyM+Ff4XNAVTfGKF35SO6qpQe7Z GiWNnRCphj5UYLtnFvXSf6uUGpX3D01rsTUxjOEGNS8K/0PuBjkpO4gpJsqHHTdq wBcleCCEFwovgLOWDB65KQIthP34r4mRSfxubBQfoXtej/wgDY2UDmfzUKdznbvo les4OWG3svtdah5f/VOZ6TigQh00vMa+gi+GniqI6sA6khaygUL+jwIoh9dk2s/P 3pRG7cTzye2ClmK8OUhXiXTiO7/n/4zo+HseBoyeA+R8kroT9xbHWeUbnn20a3rF q21/1furKJRMXhTyEHJiH2qsOd+F3OKS6FRAYZbUKZuvWPV6BoO2Z5lSN0C4E1JU lBX24aVGsupZ3T5oiiLKvO8zf3OEWY5+swgmKZhKADnawsxiCuWFHKPodIRgSyvK 0W8xUxDXWCL6bQFdy3Da0oLgLh1fEFx4aA/gZhsEQHoWDk5tC26bJMyopqMe5wQM nViGryrUFjCkhebmRixRIkCF/w6xXqtlPKUrvTp6geDVjDsIfdOXt0D7atYAqKGG UP7uG11IEyTSAUyiy1IBsoahBMdlJigLzq6/V5GX81rT4KZbiRZm0JZl/5eY+Cey gB4EVLKtYpjAM+sVAyETHyFqYk/czqPbnA/PcnbqW0HmQnjzL92rMuUTWGr5qqCE Kg/ph7buW8weh0b4BoLnSKHIDYA7r6wl1WdRkrEDclp3woVfGVScO60FiQYFPtzQ iz37ooPNaNxqPTz0 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/2F57540029B6714A

http://decryptor.cc/2F57540029B6714A

Targets

    • Target

      hBjM939D.bat

    • Size

      198B

    • MD5

      31f14e4e5545659b2edf91aedb0830cb

    • SHA1

      e5489bc5f3b8f118e6fb0ba7f5f4a0223a33863a

    • SHA256

      2f3a2162c69c2185edadd4cc4d60b0ef9f2d212d2d710f30e012b9878aefc0f1

    • SHA512

      80298267b14e688189cfefabed44496c5c22a51c50c788ac72ed1b9ad4ab1848068308f1a7990665ebba4220a428cdb7a1a5695a3643ea395af7566726914562

MITRE ATT&CK Enterprise v6

Tasks