General

  • Target

    SRidfEeW.bat

  • Size

    197B

  • Sample

    200304-ja7ehzzpl6

  • MD5

    a006bd666bc4f82f5ea1d674887611e6

  • SHA1

    95ce7a9aebfdf6c87270f5889fa808a3ee8b714b

  • SHA256

    81f5009b863a88f19955b83ad86d888a14e41894224116433e2dfc30b7e5a57b

  • SHA512

    1f3071ebc844493d9cd484f5e519d9dd53c2078ece43366c370286b53dd38b3ad2ffe2af05293dcd22a668052a07a24791e0f108c7213b0223305fe4ad57739a

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/SRidfEeW

Extracted

Path

C:\97jlx50n-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 97jlx50n. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CF5DB5924344656E 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/CF5DB5924344656E Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: u0WwdD/VKpuNs/ZOmhBc5snPjvbwnV5ghB8pUzFrFdJdsjgVE8G9s9SBieA5y77K KaG2NpS+SMSyfzgCmHt8GMhYCUoEe0sdPFB6D46Y1Pq0sTTvVkYLqSdF2ijEqlV/ r6Q5XewRV7qSj0d5zewFadQLzjC89RKZ+ZbyFy1Zyx/VCB/z5KOwecSS7BPrMJW/ 7EZLybZK+eKO+q6OV0Ee19kCL2BOQqHau/Q/KwUgWK2I94aMI9C9FQHCnmzbID1O snbz057UghQIE5Vs75vYwach+XPp3zr2PKOC/CbRb17b+QMiuYLY8e54dnbPKSTm hxc/z5Wp3mIvHJdY6VTylGbUY8kPLncJ0RCNPvfaEsxPAj6I0fLS6yH4yiEgGE6V OpRUEQrIofbiyWo8VX4mnBEFGtvK2QfOkCkJ9YrL+hkrGEHzrGQNBBlIUSbKVdLX kGTGfLFVtWiW+LzJD2Gduxm0+LiH3XcmDViyOFyyFeh6JrninFd5hMfiMKzZ7Elq pVp9IQ9LUAU2EXisZaUC9r++kZh3jm7tG0E211MDSVXW/5bArVmIOEh/MB7C9Ta1 +FnTacGzRZj240TjbArTDRU5NXo8pZVwYtVy5/AohPycqW9NwET5a1e+ie5ezU/t UcYE8oAMKwRXofItfzPPXkE2FpI9ckNQMF/Zy0dg4MTl8RNOar3bT47EpvYotR1l moEbS71QCTqhV1Ude02uJDJvSUaEopimapbUIeawPD8YvFOm2kwztP74RzHzZGzp WjrPjdJCIAqLXiOyXTa2W04azS1vGbjiNrqjb9mO+/AkXtlC8dy+AcgCDgS6kao9 1hCGpX5z1OOPFKLk6oDSxTiV54I3FBPtLMenJkLhOPo5FISx4t0HIt1V5GjpoHaa PhmK0SVGPYL7iqih8KdumIHkoMqG1SFqFjUB84w6pS5zCt+9efXXTtjB493WgDd/ PD97vDz0/7lAsNg+2bW46oZ0kgNTDmzQElHm73HpdoVDmr3oy7bvdF9N5PCMK2JD BOdUZ9NBtsSrqC0k6hodzL+UrUzPnR6BwBAzh6PJmjH3zCwNbkRRAn/YE0LO6t6N 5cFZ8D8hjiQpT0VLI6zRepCNjIWeNxx46jC3ziYkfE5Bx3Qd0zI0++kAURIcBjB2 XR01QX7Ed39onf3ZcQiLHTkpI/eTgYKealeov+A0dIbg71vEnI0xK4S1Ep3wXrEj +gSjaOL8OWDvwkzcE63UwoYHDFR+KNTCpZhgyJlrgPWxZ9L67jlQUJWqZIVTeZhL Erv+lPkU8VbqS6W/9BT3bdTenDq7qPzQofpV2YTxno8KRa7H ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CF5DB5924344656E

http://decryptor.cc/CF5DB5924344656E

Targets

    • Target

      SRidfEeW.bat

    • Size

      197B

    • MD5

      a006bd666bc4f82f5ea1d674887611e6

    • SHA1

      95ce7a9aebfdf6c87270f5889fa808a3ee8b714b

    • SHA256

      81f5009b863a88f19955b83ad86d888a14e41894224116433e2dfc30b7e5a57b

    • SHA512

      1f3071ebc844493d9cd484f5e519d9dd53c2078ece43366c370286b53dd38b3ad2ffe2af05293dcd22a668052a07a24791e0f108c7213b0223305fe4ad57739a

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Program crash

    • Discovering connected drives

    • Modifies system certificate store

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks