General

  • Target

    eEqGBFWD.bat

  • Size

    194B

  • Sample

    200211-hy6xmyr1wa

  • MD5

    5921814fde0e9a996f0dee5a45a865c9

  • SHA1

    946b9d4f1081b053f9b90544dcc83367e7cfbc21

  • SHA256

    bf894d6ef5402e0c90fd5cfc08bd271dc601d90abdf0f73bc8c17e5a2861918b

  • SHA512

    5f953ff30984392246fde646a900d5d91eb93f64345da39fc91007c67e913ce5b7ea8f59a5e572de72fa1052877a1eb7082fc67a31f9f4f118dd40db88e33763

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/eEqGBFWD

Extracted

Path

C:\mcibkq8-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension mcibkq8. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/FB3A92CAF2834034 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/FB3A92CAF2834034 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: ofbgB9wFd3musDcnJ4T9y2b1Mz6NiricH//tNJw7TYL/oMj58NKWKFnPMlnsSPUR WhQ4BRkljV7HU+kTlWDvRu5iKsuGZ3GzDNp1UTGmMb5/JMhLIIe9e6q56KMLPfbU i+erh3sZMmUtelYwtG3STc/dHDdx+zODz3JKBaE3ThgIsea4nQyAE75pkooZjQ/p q9El0IREg0h6U6xeBCcpBLciUdYBwvTKHE9uFrCVqlxFW+X/z7eWf//Mo6EHbV1u nhYcjVyZVoQet/NJov0dtKIUtf1JV+e0ncnw320RW+NpXp5+HCHGmfzcN8ZOq2kZ WG+UkRVfZmTCtsfPBc2EGWys/D6FEV9Ux4xLn60WqWz0u/+ppOtfUo+QnijEwKOz wC6497FrYCjz+dNs7BJyXbZKDpfMlf7AA0X8f6fiHnlClGSd+wqwvp9k9HYwVPiU 43pr+f6fVUTQLHf3xfMl4pH4Phr84wMHMEgRK3fch2KfI5l/8NwHFRJSGw3w/iwg iTjxb5/EUwfLr6DCByUNrRUXEP/LOoGYt5V6i8GB8j94DtXl7/Hz7Mqxxd5ceAfu q4TqMAZB+HcUDLkzylYr0p0IVC3SLZ0KvQiUIxCIL/2sE9xOO8ZQeb9IP4LOuR6o so7yy4KduMBjUL4HdFmRHTGz6Q6oSeUClTFkWX+XrFcmVFM+74Nhyk2RL7cz97ja Bve72HChgGuWeHZ0/qtuepWc88JXanzlsTpaAt0apXstY3LnHuEhqnsOkYJ5HfQc jJ5DDwaJV6DxuBAHeW57BjMujfRYKzKzfX2dQFkmP+yTImRXCFHsXVAvW0xe7jGy aKROLHy6HSAqwgsYHwpndxqt5+Ae8XV8ADnMQLa0Bdsc8VIAlUzdhchzPn88yK9v p2+z/W4BnEDYGEP8voWzp9u6nBVZlaorQZI4GVXeEVWleuL4QVQR6Lf+RbYNZdyB RuIXFqeZJrdi0hVds9Dg4LwMdJY5ezrcz+XOiIZjT5T8iysEVsxsAufQENg7lmr7 qkkUXEbaNKeR2ujdiwNFYkLQj/1xVyj/Y7U104Qo9a9q1wx4z+7P4pPwSxFygVgb E5OooVZ/72DOBRbNET3AI7UrIQbPxlfNDOS+C3lFEuQKKvDH/09qCK8V5OWWdtxa oK5WfrjvLGwD6xjo85g= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/FB3A92CAF2834034

http://decryptor.cc/FB3A92CAF2834034

Targets

    • Target

      eEqGBFWD.bat

    • Size

      194B

    • MD5

      5921814fde0e9a996f0dee5a45a865c9

    • SHA1

      946b9d4f1081b053f9b90544dcc83367e7cfbc21

    • SHA256

      bf894d6ef5402e0c90fd5cfc08bd271dc601d90abdf0f73bc8c17e5a2861918b

    • SHA512

      5f953ff30984392246fde646a900d5d91eb93f64345da39fc91007c67e913ce5b7ea8f59a5e572de72fa1052877a1eb7082fc67a31f9f4f118dd40db88e33763

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality

    • Blacklisted process makes network request

    • Program crash

    • Discovering connected drives

    • Modifies system certificate store

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks