Resubmissions

19-02-2020 15:44

200219-dsykqxdnhn 10

18-02-2020 01:10

200218-fs36yr5yra 10

General

  • Target

    42HVHYvi.bat

  • Size

    192B

  • Sample

    200219-dsykqxdnhn

  • MD5

    a9075a0e43612a388eda0d4643037a34

  • SHA1

    6bfb53b342e2518e07955676e5a8f18717970504

  • SHA256

    811d39f86a8efff6544dcd852c24a3fe2e5446f5eb7fdd9e740b424a221ab366

  • SHA512

    9a9275289c65b19cc5e4d94572b1e6dfbe84c47a028193d0c142a363e0b279e0cb217d2d63c759839730ec8158460da427cb9ac354a124a9f6ae73ab7fa063ee

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/42HVHYvi

Extracted

Path

C:\7z93j-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 7z93j. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F6C38D1F961A5462 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/F6C38D1F961A5462 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: PEDVxC9sn79yxxS0kBuq/F1Z7Xqiib5k3uSGm/VU+IyJMpk11Z3DlE3b4xtwKKia hGCJy/SKrPjtVznR8mGZYUZqoYP5zCrHivyoMrXdjB6a7m8gYQe8kJyShidAbrdR NOrUPVtzJRfOdC6OAme+lmy8X4Ic54fiSpdlvpeHopDuLuPaMESj0LYduyCoW5AP nzPNDE2CzlxWyLKdBCn4hlZY6rqc7hNryZm7PyG+fa7ODKmIVrlQVsKkVaTtUqW7 w1Gxvz4dfFify3qxVmsR34fu7Q7R29EUfwE+QCe14igX2rjcdtAU7b2nR/e+GXXd jLOTMehdvAfcBu7hWaWqK7a32loz0kS4S9ppItnmgBFFDBWjniPREgGH6QjXHPd7 VGXSl/4eJuEcpR/BjoGhKJIjfSSJRkcmzkOjcLUMvfC1YecpthaZBD5NOpnhuRwb jZBLO52G4O72EVVSUFRmTt6raSaSiCmOEfqajsu57t4nnXYkdtVJncNqdrByeyLD IDplEodpx6c4MFDFjaKWB/qsLMtNmxbXjYXlK8i4RMpcaxwhg5T/muLzT/xP3AQO PMrtVMnxRQENJ3YvqG5viyrVFnSkWzRBKU+N3jCYjbw1PlnM8O/PA0TDuemDt3Gd LzpuNI3lFTPQ0wW8uOzLHmkyp8iAGfiDe8kWfVCJDDBBJQ/9hnD+YVsfzIij/toA sYtYF2HTpm6CXPaGF1jqQ9ZPhB26XbovoO91LgzczyVxUYK2UyaJiGeiX/QBG93j 6Irz1vJLOvhzQJHaCs6VTQlbGJDo8B1sJe2IEWK3+zbmz0T/WcQHdaAZFR6sX1LR 8UkMwEQMXRqORp9rkJYJbhtBAStPuGkZT9qvLnSpz5Im+JAEdef3qg6x67IXHf8d XLCAhD9T569fSeCTOGg3RWu1xKqBSgWfQRMVGyFOvxhQhiVMRZOqujUhl6pwZ46s QQLgc69t380w1vI+ysx6uHHQeTfe89LzHRSjBlFzTmHZ1C3sfaEozlQ4flevso4m kDWiTXx+l94/WhUF/6J1vK5eQr/1snNrRbQGXa5XouR9drCTyhD+v1PKfj1pz7w1 q8NtfKkUq3SZHTj+pTL+STPHtawipzjt0lmexcpCsQxy+FeYLUdHS6AnjF65zWVz ZOVyZic6gfIOO0EznJIde9mX/inMzjs2gMIxSkcUqB02O6vsnrdY0QGkKNV8sR6v W/szRC8Hisr/O2EVf59R+2bYr7jlPpd7DUIwv/DjhgJyVkOSO7LfRJtoe08iQ8vj juk6DNulwQF8aUdOJK0WthztshKT9G169pg8QXl4 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F6C38D1F961A5462

http://decryptor.cc/F6C38D1F961A5462

Targets

    • Target

      42HVHYvi.bat

    • Size

      192B

    • MD5

      a9075a0e43612a388eda0d4643037a34

    • SHA1

      6bfb53b342e2518e07955676e5a8f18717970504

    • SHA256

      811d39f86a8efff6544dcd852c24a3fe2e5446f5eb7fdd9e740b424a221ab366

    • SHA512

      9a9275289c65b19cc5e4d94572b1e6dfbe84c47a028193d0c142a363e0b279e0cb217d2d63c759839730ec8158460da427cb9ac354a124a9f6ae73ab7fa063ee

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Program crash

    • Discovering connected drives

    • Modifies system certificate store

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks