General

  • Target

    UJvbivju.bat

  • Size

    189B

  • Sample

    200304-2xxdgala6n

  • MD5

    30e9f006bd27f61b87649fb861b70525

  • SHA1

    602c170aa87ed68a7c5f68f15a162bdbd51dfc1f

  • SHA256

    c27c8d9ea31e707420a5f77581ead62b943e9195989ff1d5df30d0ecafefe2e6

  • SHA512

    f9c62d8bff196da519b3c336d079781f33cdd0123f910448d9b8be41b732b149dbbed44e1bdb58ebf67d914ae4ec0d376ac16688851ea6714a21cf638a6cd7ae

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/UJvbivju

Extracted

Path

C:\7dx1t04r65-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 7dx1t04r65. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F6228642C93D0AF2 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/F6228642C93D0AF2 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: G/S5bNDEHvx3/Ipk3D8ZZOBApcmsfvGaKDME3BSenOR/3WN3GrFnBAxkCDjWdC6u RYLOSoGNapD4/RMrICh/58SlGVWPUvjSa8RDQfIXCDA13kxtQ3U+rnKT8Wxy15fg 910eVSbT0KUjUTCLvoEC0D9HCBChlLaWvZIHdz6gwZszRBxPZNSwO5IvOkjigJ/p n9Pxal8MdAAk3llHKXAXCbQnLE1TXvxD+3ln3S39+EPQ/cENLZGsTqWfnWx1OuZ6 KPO16MlcJIuoQKeVRTHHHVuSJ2L0Uz+Om7IXSosD3j+NcS5ffOHoTl5vpHjaDDeN dOhyVA6kH/E6eiA70S1cL/uUJzttSvLJ/gvVtfXrrB6TUmgQ4FjCSXo6YXNAcs5K zWkKrmy9xhPCakKB/s85ezOPwBpvhTb+QkGOZGeAXzoXd9zhEw8fmZtLqInktWrT 9SgdASNfrLUGq7x+pCs9QijYMAf6bPeS/lOW08FP5jLY84rhNJNVCfo9k1zImVuu /LJkB9cgTS1lUYJpzosVlXNz7caVXkID2aONT5AX9ZmHvb/JKXwqLMzknJ/ifE5u pU2U3Z7yEvR6wqRjplSw+fsu6sey2dOK482mLcIQg8UeChS6E7fliIe5qWmpuYqX kGoHJM03MU88C6drA4BJrZUOsb/9p3dXDUoL95dzhKKmJYeKEwn1Ja2/Gfpq33Vu b3aDj3kiJiMMpMlbg8naOVwdDT/CmgF/S7f4J0D3XCsi+pV8qCpui0XZeDxfjXUs aXqjrY2L2LtytvB02aGAEz1GtafguNnZstgaqFnQq69RKWhWTZRqFAndhJUk0IGd j9YcB+NfC525FKu5OZmcC+UIO97zZya9zIGaUzC6THp5ujcWl0iIg9fBp2Pe2xf2 pvNa655smFW3Mwy7jDMA2AS5v8DSuEcphfxo2uTgtTNoY1+8MBNHa2/yPZPLmNFa ZgU838xvm2P2Q+uv+PE6WhDlp6XQj/I39bwf8WA1GSFqSJaGwvMZqs05t/JxmffD r9PUe/2p+dGWR0PvbcNUZdaa46E7KvEczTueRpDrauDHsGcZt2Qoo2NcX64sMJhL cnu35vW5Vuy4++N+Hw5dXyEZYm4fVnt/sKIlFgcIF8qKFLHSFtWAF8g7QFhI1byi pvjzmW6TNb1PU4graXgR/lSWxVqs4f9SALwl64U6x3E6iLPWk26JAi1nEAN18jSW uJxXVIp4rg47rPx9klfHTaFkTZUzSipao+9kNgggyZ3aOMDr/56W++xpPahXZT5k qP7e8O8BIz0s/G/Kr+bOM/QdGxk6tS/sUhjLj7O63aLtcQ1vyJwrZg== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F6228642C93D0AF2

http://decryptor.cc/F6228642C93D0AF2

Targets

    • Target

      UJvbivju.bat

    • Size

      189B

    • MD5

      30e9f006bd27f61b87649fb861b70525

    • SHA1

      602c170aa87ed68a7c5f68f15a162bdbd51dfc1f

    • SHA256

      c27c8d9ea31e707420a5f77581ead62b943e9195989ff1d5df30d0ecafefe2e6

    • SHA512

      f9c62d8bff196da519b3c336d079781f33cdd0123f910448d9b8be41b732b149dbbed44e1bdb58ebf67d914ae4ec0d376ac16688851ea6714a21cf638a6cd7ae

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Program crash

    • Discovering connected drives

    • Modifies system certificate store

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks