General

  • Target

    pHGx3x5F.bat

  • Size

    189B

  • Sample

    200304-6dkn9nd3z6

  • MD5

    f8f2d35ab2ca83ab301ef94c9ca2c356

  • SHA1

    9f417af220cfe9c60bad058d139354deb8022607

  • SHA256

    c84e4db88d87029f006dc693c049288c87734e72eb1b2157011efcec833b5360

  • SHA512

    f35a847580b31883ee57c5762c5805517739d6a2b3b4ea43697518577dddecd2f066fbcb2858d0859ac10d67280ae72bc25d5541a72b7f34469aadd3044378cc

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/pHGx3x5F

Extracted

Path

C:\j0h0s1fi18-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension j0h0s1fi18. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/88D096C283EA00EF 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/88D096C283EA00EF Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: PSPy+x81aC+LT2OEWukgWyH1aDrvaaDlTs4zpbHvCQN5zDhEawhKAVGDc3fldkgE 6t6qjWpYmc2R+S96Iw3pmsw7BpnrD1L/2zUxA1tzzap1gDYI33Dr7J5sAkdMeIlE M5QNl9Q+uDHLk3zd/BOtvPxTNJwxWdvxICyu0X5SRR5MfveZRFzCp8KF65V2DNEW kGo+oNskc2yWuAJq9OWQVeTSJ09Grib8WZUbRsH/+ziXINQHfOYEODYir755jVQV 8idDVOvV3trkcWcieDwULAGT57UtfqLUU6NwAUfJFU/8ukgHPDa7VD0+1J3kmOXY bdGRM9h6iE1xl/iHo80sdIkQjSV5AgiPH1gSGxzByQLKpdlRIgDUg3iS8MbVQbU0 WUSJtv6n8oAkC72wt9XScTVtaQDdlFC1wTxVXc1DiQpkF5Ce8CoHoN2NpuhbIBpX NBlOl+1faEWeYDqCbVC2UAIuXX9WA2El8g4BaU59BOLj+RV/xHsOKbQshFPj+JJ7 nUPFBm+hSEkleT6Jlx7gv7N4BNATfn+ZPIA7M0nstn8p0wZbgZHB4lnbMtEs6Tll 9Q5DnkwXylZlnL2wP1h1S0YWmrtd3uo/PLryS9UHyzZl436SVe9eiDkWLKfeEQ5E YxtY0aWaQTCSnFD8Ge43ZmWLbi2QMhS5ucAp3mVjgkpkHSYIpaNGlzetgKiAf/Tq /230FctdCLfTRK1EM9ZmRuprQRZKCxIO0eGgBmwCLZXi2T+vMOdEEAu8X9XbiIct 1H+FTvoIwayeTYocUyQK+xh+nPmFXPY44lkQAPZpkJVrIdTjKIU5AQUXP4KLIZWK 7cMU+A36dE9rf73fn9x7an4HkuXQ1qOfA23hEprcM7kw7foulW8p3FyPIXCQCIDf khDQ3kaTs25zOyScNUrco4bNd5D7lnzO86Le7qjxqPCk0KicK6+JX7CZPZZnmQSO UBFaMsHiB/LwUbwXOd4hDwk4mW0c1sR9a8Y3L++UgdN6YMCR4MUvFvQrq+U/FTND 8BSSknuRh4GkNcmRmK4t05b19pVGkYWqPIiMQexnfuZ7xYzUV2JwHswfR3cr9BpY tBD+W5GB0xtg0e68cFX1xe5x8gX96U7qdT6UUNZXut1/6mdYpXp+YuXsOIvdMCub i6uRdRAWROtVPQ32JZfHITFdR2Dp9nB6Fb+NkM9lWhFb17QFQsXbDajZYGy32hqO tzzugZgJak+CMjBQGQAZYpRINFDI9eOpD4SZJ4KbDQnS5nhyZw9XiGkZjRL8aO41 7ydBpzCD3npgqiBz1sjPhpMr4VqwpjxICfISSc2Ya+G2lbxLoWakdA== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/88D096C283EA00EF

http://decryptor.cc/88D096C283EA00EF

Targets

    • Target

      pHGx3x5F.bat

    • Size

      189B

    • MD5

      f8f2d35ab2ca83ab301ef94c9ca2c356

    • SHA1

      9f417af220cfe9c60bad058d139354deb8022607

    • SHA256

      c84e4db88d87029f006dc693c049288c87734e72eb1b2157011efcec833b5360

    • SHA512

      f35a847580b31883ee57c5762c5805517739d6a2b3b4ea43697518577dddecd2f066fbcb2858d0859ac10d67280ae72bc25d5541a72b7f34469aadd3044378cc

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Program crash

    • Discovering connected drives

    • Modifies system certificate store

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks