General

  • Target

    HtYRZhCc.bat

  • Size

    189B

  • Sample

    200301-5pr38vj7xs

  • MD5

    d0eafb36abcfd1c15e9bef86bcf280b0

  • SHA1

    c4c71e785acaa2543c8ff32db8dbbf49761b78dd

  • SHA256

    2f8423a9b51942cea3d3e71e185c4e5780a8dc51cfc5fc0d84d08ad9efe067a5

  • SHA512

    f75e1a19ca43ab9fbb7e99cdebce8ceca51922258cff04724e811eecfee88a050b1c496580a498ecc845c67abf7ce14b37bf80c0f4fd9d5c300d4bff1b8c9cd5

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/HtYRZhCc

Extracted

Path

C:\i928ld15m9-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension i928ld15m9. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9180D364F1EFBA80 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/9180D364F1EFBA80 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: j+iIzP1RXp4N97ddNg+p/UZHlfffsaYmXJMbdoA2zVDRd5ctOoPxstdKUVPsIOu3 /KPceF/HTlo1vkuL8fpYGcqmRoqjqC3kXwbn6+9L0fPgMeneSWEQyhpaDQrEK4cN pQVjeNuHbWU6Bmy6YLmZNhxyjDFMqXT3scRn0GTrm0lzLwBTFG0Bziu2exjvsjZf mQ35OLJJDXB6XuLwMm6bJaMWlLCth5h56GYA0bRXwsmurYr8pnALfJgXYQ3s6wNO gpDmkFQGMzR0LFFIWWVOw5zrkaSc/9kQ9tPNQE0sk8hTRDJy9YSq1hCC0BaHYplt jtzWjYw+EZo0q0QoIkhYVTCA/KicJtONATV2wXVI6VmYjL35yaM3Ekuav4HrcTEo V02Rox0eh81ir0NcQ60/ifPfYnmilaRnOfkwKwdHmlsCQAd6Fq1U5L094wirm//9 CaRocZhcaQRCgCAGKMQBunyGAoN9LK61aNRxltJrSahcmZDPaGxxvoXrMmadhsK7 XxLft9C8Eh633J/dNxhfJt6c+tCd/Nm02JbFJmMXt72od/b7YnDxxwxklQJwL0EO HxG6vEjvX/WON0zJyAIZqU7LzHuEw5gW7pSUtLfDHg9emGe24UTrdtF0oDdnIhYv Kvec/RlOy/gw6awq5KDILzoKM4VIOG1zFcAekAxZntbw6y29w/+tXaclxOUIgWmh 5R8w1SO1GQcOLxoR7dxZtPUh6QqgPBI2AECSNvKUeXx2PZV3Ta80Vyu6RKkYGQwm PbkIslScl+i0Tk37HmakFbzur+BNuaOM/hwEUeL1ncAYNMgp1NBn6Tbl+JUokTzy 9OOFVGEoUk1nkmDXbIUI8SvxxZMk5ddycbfsS2geHp2vS3RTVgGvkbokHgimMr6M 0Z3LXm9Fr+vedgF2WdH0rPRl3LaevZtykQW+5+AYmC3nHqHNH1Hvg9d6fZ8eypYs A7OQclBqJFA7zcAMC1+S/ZJaQHLKbxlrVScfRnfCF51O/fqkl/7OEaaDK+DYBcSg LOtq4sexczCMZMA3ZaI0IElg1rlKVTTXfBsW+OFHoXdyNQrMCmpGg5m4+klYHIGe tHQNc0yDeOQSEFj3xIj7Ngd8sw/budxBWl386RP9fCid7p0HLNe5AVHU+y1ug5pG ntlr/y+1lnQHTZIbkqNM5/Wwkg8OdroKsS+M15V60GAZ64atrKdlZUa8co6dvevF dvbJyM4PUfug7d39OSIkdCHTWny+l2Zv7NNzaUew2MSgMLKpHZDKv0ZfCnq2P9N4 OkGamZd/lzEwgBNq6BItyhZTFHSaKElNs3Bn2IbcZuV8eQ+S3mpKDQ== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9180D364F1EFBA80

http://decryptor.cc/9180D364F1EFBA80

Targets

    • Target

      HtYRZhCc.bat

    • Size

      189B

    • MD5

      d0eafb36abcfd1c15e9bef86bcf280b0

    • SHA1

      c4c71e785acaa2543c8ff32db8dbbf49761b78dd

    • SHA256

      2f8423a9b51942cea3d3e71e185c4e5780a8dc51cfc5fc0d84d08ad9efe067a5

    • SHA512

      f75e1a19ca43ab9fbb7e99cdebce8ceca51922258cff04724e811eecfee88a050b1c496580a498ecc845c67abf7ce14b37bf80c0f4fd9d5c300d4bff1b8c9cd5

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Program crash

    • Discovering connected drives

    • Modifies system certificate store

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks