General

  • Target

    ECR3zkRF.bat

  • Size

    195B

  • Sample

    200222-3dc6csydda

  • MD5

    47af73dc3ff82d0a97e7b23198acc224

  • SHA1

    b4bda7187d28ffc99c52781604a8a1b04c165e2b

  • SHA256

    1598c21c0f1291f077f108dad0286e29e58f07962959d6645f256ecd85e43162

  • SHA512

    82a6afa9ad6ace78e6a68c5dfa124e5d62927ceda54e341a04db9591b0b407f5886d3365af8a86d449870c3414ebc151bfcc256d1ac397813bf71a342358e002

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/ECR3zkRF

Extracted

Path

C:\fz3260-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension fz3260. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A1945F93509159BA 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/A1945F93509159BA Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: km5sNk7hgfuZ2w0OeIMkTWYXFT+HdPq9dOuUdSg1PFq5/zsMaM48+cxKV9U6ZHH3 e+kgGeh2Fwy8FaUiecIdR0D2KTkf+B8oZ1XVnROOxtrROpk0pdnCVeM8GRkSnUHY og6vhCJRh+VJtR74QDoc6nqMpR8q+r8r4b9uXvSqxP31eLWvg5pMGDjDLaMN3TNu RLv7EHwXg8Tw7JHuG0M1lAfR1vL37MoiCkb6fvYuJL1rM9AUT7flbjzee2lxN2Dl 7Rxb/0KCYb/d9w3f0cwQi3PGUMvy8hyQRh/UBrISd2EB6OF4YUZ/XobE9rsuGhYp 4V4DFdzzVlbTa2LxqLtyuZyJ5JIXI37tFH07Qpww/s/9aW2OIXUKHRemeTuGwULu ZZ8y478Y7ybKhZVks2hUTrxTifLzQ0JSGmXjAhd2vWjIR/oJbEMM+ZUPKArentIR YI9iDpw0GLeW2rI3jQKwQ0j368dc7iTxfhBzJPCc6Nk1OGGaToLL5cXCScEB2iXS CR9pzikCLE2maLbtd78y8GQEp8LSDN3QJAxDaYN3ATnkCcArQRLgo3SaRIIFrJZz 3ZkBJ4VxA1FtS2V+Ima1klE0jzkcSk0/DUKj/KchGvJZTOThqvDPHgOfz8gF763t JAaDv2sS0snLS+cKOHNBOwRoytlCs9Cy4tBJjNjG+brjZXMUwdESY2Rw5q5TIIKS L3idJcMogkTGEy5FOQTYG0gEIAbM1Wrly02OyvvbZvnm2QfpYSjUjQNm5IJ8PmmJ eTusVkNnCKkvS6wcagLbXNMztQ+17n1pEGF7vB2mM+YQjwYNX5HsAHGn/k0hvJkB gsvy4yxBS09+Z8hcZHROnDKj+0Wr72j2ls6V6clPy22/zEyFP3EZnL6DK4eLTtnn 6d61Q5bXgavR2Bx/YT3MzPp8Gf1PzLLEUzmHWSoODB6PwCHYmo6/x/KTwZavey7/ sbLh5FAyhRVj4UZ2iHKz+pbzi4y6DslmoYtZWEGm6cNA5QAIUBLBFBy+pB6lcJqA I0IwhcWRvjYaukCjjdPtm5APssApmJJnplNRdG5x6SMuT1P8qBYZ9wAAZeN44RMa x7CzSznrhKFviAGXAHeo/VKwzT+9wee4k+1Uq6ibZZWWmzh/VZ8Bm/uLvoxnbYNX 6UmiyFfxTw0S23f6z4OPr53znDOaoI81jTK78WnzfDbImQYOvmAjOAPDmY0Wlqao CQpMOuzjPEvF7cilE7cZhRM0It2yMwBmaS56RFBKGZkVmp6J+KhZsMSaWte1dTIx 6lCw4fHr5QaD6gtxMOAYjzppMbnrM9X7kAF3PykESSA= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A1945F93509159BA

http://decryptor.cc/A1945F93509159BA

Targets

    • Target

      ECR3zkRF.bat

    • Size

      195B

    • MD5

      47af73dc3ff82d0a97e7b23198acc224

    • SHA1

      b4bda7187d28ffc99c52781604a8a1b04c165e2b

    • SHA256

      1598c21c0f1291f077f108dad0286e29e58f07962959d6645f256ecd85e43162

    • SHA512

      82a6afa9ad6ace78e6a68c5dfa124e5d62927ceda54e341a04db9591b0b407f5886d3365af8a86d449870c3414ebc151bfcc256d1ac397813bf71a342358e002

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Program crash

    • Discovering connected drives

    • Modifies system certificate store

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks