General

  • Target

    E6ZiuRBj.bat

  • Size

    192B

  • Sample

    200225-97z14365sa

  • MD5

    2249a41a0632a89a141033f45d9c71d8

  • SHA1

    d11ba758c8a87a62e773a95e5cd01787fdae226c

  • SHA256

    03d85057c6e2669996196110f2b048f3de2e021f8806b61b6e4696ccc802e742

  • SHA512

    c59548a6636bf85403b1ea379760d5310e1d8aebc859227340d68de07eb3ec63672a31db38ef6cd519f58139c192a0e4a03adfbce34c42708b7c630c172a499a

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/E6ZiuRBj

Extracted

Path

C:\hp0ws8n-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension hp0ws8n. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9180D364F1EFBA80 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/9180D364F1EFBA80 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: q9l/VFlPdZ3Mvn86Ek91xkgJkdRb/DKgkxo7aOamG+5bOM0Yo+EM5XRGbfASr+HB VW6fKXxuGjBLHNZ8qPKKGyXSTvpLzmNm8r+39G1R5P/GbyBy1W1UeB28lNhyeJaE wuUqZ3tCxLH3DQ2VImwtRaCC9MWv3Mny9xVRHOYeMWnzbYFP2/H0o3LJsv9qai1d /Wos/GWkT0kKedfmoBToGk+E6FTp0vU8Mh3piX3O2hSa3RibAq7QbAXqlBqVn0C7 2FJrU8j1vXciEpTwK7vtXd27K6+g7L/OeUDtaweOc8vbpAq+lI+ImoExAV9JaaoA l4pLd0FFb4whaLAH4E1/Lkg16udtLbA4Qz5SPi1FrmLwo0lGr65h3isrjc/s5O8Z l7NUDxYIaD91H4O2Ouz0BQWm3TDlwijNOao3OfHsVsLVGdgz8gAytmysikyz66SD mLC2rnPZt8HUXTLvk5WZAfJLGrezpvUxb3mCjrC89fn/u8iEnBzkG0CO4/jg+NsK R/LwD8Bi5Ky8X6CQkErycGmJeeA0mDsxYXZPxr0PmeppJ9LkwveSeUWD8gqx9nQN 2JZxrQh//5gaeYbpbIDXtEjQWS+xH6uLtnc50AGNiF+M4tLSzKUVKqwotlUFr2/y xmHGnMkhCo5zidLggTUEju234949O5ITFz4TVgWy4R6WYX6p4oZNn0UqmZHnNBse AbjjaHtSh/KFIuHkCSpPOR+2MBoUaR+SO2xArS7MEdBeJv7qOsy55Gh2vS51Ij9r SIvFrRCS4FKc1ICs6jN3HPbmKXZC0MpyouEjNaTtPQ6htVTasMIU0guhfs/yF1hP 1oLsrp46erLErhhyAnz4FKmyaMtML2SynEsVhFPs4r0PvbnhUCjmqTWOhJsnVPMA 0Gn1md43GIYYHWL9JUp+jju6zcBV5gzXzSIMWHDkP0dg7Af1EGddvIf+s/FPba43 w0qptOTG3M5WlyyfhXNG4ysr+Lk/ourmrg3oUILdMlFbg1235XuyRfsQLjC6ng1M ICG7JHmbtcq91YtEO1DpQXCx+61+ppvv6H7pCdKfeiZF7bR+WjJx5BXEPjfgpQl6 IhUqmJXtdO4LVq/gUhb9dJkM6GkR4lZijCoHijxdZgUN6hEPCJ2FwMwoGX/ZDnCO llb1L33BG8woYF0STX8UOU+yY9ZCzQaUsyx2CRMafUaIcyCCVpDnDMSJEO83Z99i MuI+gcj5IiRp4eY3W+FuAT4xmmdRBX4F3dnU0iQ8x7wqMu8tng8iuIWInXjIPh3+ OGIxF6ze/tGSui9iXBU9F85WmHafDqnu7zM4wywM4PiAkA== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9180D364F1EFBA80

http://decryptor.cc/9180D364F1EFBA80

Targets

    • Target

      E6ZiuRBj.bat

    • Size

      192B

    • MD5

      2249a41a0632a89a141033f45d9c71d8

    • SHA1

      d11ba758c8a87a62e773a95e5cd01787fdae226c

    • SHA256

      03d85057c6e2669996196110f2b048f3de2e021f8806b61b6e4696ccc802e742

    • SHA512

      c59548a6636bf85403b1ea379760d5310e1d8aebc859227340d68de07eb3ec63672a31db38ef6cd519f58139c192a0e4a03adfbce34c42708b7c630c172a499a

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Program crash

    • Discovering connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks