General

  • Target

    ZaJ4FCCF.bat

  • Size

    196B

  • Sample

    200212-scdfhkjn1e

  • MD5

    68d8269556c7004948245c547d5dffab

  • SHA1

    a6b3020500dcebb6beba98fcdfd3333f4eee3bef

  • SHA256

    4c50fce495b3543c8329f330fbfd8908b5b0f6da8d056d48a2553aeefba5763d

  • SHA512

    6f8084ea3c15bc8eb4ac268b83d996eee682bd08214facbf752e7dfdc69c30f54a641cc5f2a791b1eb57a30e08aebb28ba642b18fdf964351e80f524a0eb555b

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/ZaJ4FCCF

Extracted

Path

C:\f0vu6-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension f0vu6. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/EC6570002F081545 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/EC6570002F081545 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: DO4cwGj+0xicqqPo0/xKlqdBH2HD3olj+UKgRWvyK9HZcoNEIMsj9Ft8jeaNC8Ni KKVUET1TVl6m14dRWSCDyB9tnxcwq7w8VsNCcBcTpV5ZNOOt2KHPsi2eHBoxImHC gB3dozSGkeJBuk2jVygjphM04mnqhqTQKjfwd9G0CGSqyPkvcIyNI4AOgR1rScl6 S5L0nxo7iYd1VuZaPAdJaeOT2EdbwBFh2pIxAnNKiv9osRS3PUC2q8GqQnkpIPWA aUmNMP2XJUg7e/G+8Q8ctqUEM0gzp0LlG6mWY1JFZc+lrwWqkG9QjaFfok+gc1tU 2TPj77UoosUb0pWwAZGN2e8A5I26IdpeESLJlS2MFzA2UKvfs0NPdgyWdovHA3zf 17cK2d4bYlVyoLSPVKq8AhaylTtQ/Zpw85U1WKSSjHKhVwhwIzUKRC4qGXXBsHVh yNMeMgW3j8pW0xEl1zwQpQhP8GSArA5HT+f7zhZzTVS+YBQVzIeKCV5G+rhzanP5 lBPW6vQOxsa7fWB/NgImmCiMsrLypcKs0216NNxHma8aGg+D1MZgmQPrT1QSz9X6 hnNj3yhr0qFyUOlHFpWLuHvh0aYLZ+gISsmWS+DIhe26AQ2AiezM0H6568h5yQnd rg7KXxDE5fcsSVGL7zigBHo5y8xJmEXADszKC/KZvyAZuPt73BrkCzCOONhM6MCZ 2nvdEPIOmt4mFQi0TcoaJbXd1xmIYSnK08jDwq4pqHYvFMillbHNO7Al28sGqYQ5 yn1i5aeICOYIw6Zpgn9S6oglyR1HqsNT6jFsF7fzahnWhNZxqMnN90k1wJXeJ/kQ VtqX0bNMpc7ozAkl+RCuHxC170XimznbJw6KT++Ff87Llb5LIXKj4gbVXrXbzy1P pz1cBGnxioJ4TDhUhlRTWzNl3F4fXHu0oqmHDjE2kXt6fJglHBFuPB0FMnjs6T3f jw4wD42wYutReJiq2gk07Aout8wkRQQCIsYFeMdL4wC+sS2DxTw6MTFdnH3n3md6 gx2fN0r7Qm5IMGyIXcBR0Me0qkvGupQyrZeEiOW5eJNznIghiWg/Z3A1xw4BNdMe UFZehQOPy40oO4C9sDJw9B2QgSSsk7yCEckKqByfBQIiHCZpE2eyBsPEpEG+8gvX uuoM/q3y48+HTg== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/EC6570002F081545

http://decryptor.cc/EC6570002F081545

Targets

    • Target

      ZaJ4FCCF.bat

    • Size

      196B

    • MD5

      68d8269556c7004948245c547d5dffab

    • SHA1

      a6b3020500dcebb6beba98fcdfd3333f4eee3bef

    • SHA256

      4c50fce495b3543c8329f330fbfd8908b5b0f6da8d056d48a2553aeefba5763d

    • SHA512

      6f8084ea3c15bc8eb4ac268b83d996eee682bd08214facbf752e7dfdc69c30f54a641cc5f2a791b1eb57a30e08aebb28ba642b18fdf964351e80f524a0eb555b

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality

    • Blacklisted process makes network request

    • Program crash

    • Discovering connected drives

    • Modifies system certificate store

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

3
T1112

Discovery

Query Registry

3
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

3
T1082

Impact

Defacement

1
T1491

Tasks