General

  • Target

    fDVKq3XY.bat

  • Size

    196B

  • Sample

    200304-qqkm7ym462

  • MD5

    13c6ac3eb74ae1c015c9025f767dab56

  • SHA1

    f10a803dbbac9109f416597bd51423a98ade9c62

  • SHA256

    8e692d3a906ba2636e93c6eae4acfb40d13459492e03008475defe021ff4db21

  • SHA512

    d931c952a2ffe69502ccd2ec6aa597c7a7a1318aa9cd3bd48fb30fed5cb653fd333531302db3c1e77581e827e0104e63d313d2818a5bbc24d14047fa7c6882a7

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/fDVKq3XY

Extracted

Path

C:\ga69b470w-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension ga69b470w. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/87AB8BB5B8B13D6D 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/87AB8BB5B8B13D6D Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: k905YCnaSX9jG1TKsdK1yNi3W0jSZph4tLfjJ4vEWPrESwJpwTn9eggais+dKkcD WvBZbrquvoVCxdjxlvb3h7gETtn4GsAlUlhr6CUsyTUVmzQLTnGXS6zNl/tekoLx 92ixcWGliVmkrNtOR2D6IYvU1x9UdtkzQZ5ResXwXbHoFTTp4xp6tbNpgxyBGXWk 3gVbI5pLuEQWjA/NxGDGd1I/APdqPf7iNaFnSRZmn/x9+rmpi4XDxPBDB5eUR/eW vQDNQ7N6/cEIfE9gXecCYaKvgoxJAHzQ8PKudcVfcfjZ0x8JTwdU7AXx67DHJEGU mTsbVUtm8TpidQ4XioBPbFpszl83SUdlwUq/5jWdqE0m4WdnUtFYD+OwfPK1k/YA 05VuQtbD2/Dvh+Y1m/hQHr4K4Ltapr5KR0mJq9pvPv4ZbnfsqxlmXOezLl9lu/X7 xcBcc1oWDP1gZ+qYsb/zs1CLZukL1xVSJq0WQrWpZFNEWrVtjZNhLReFJ4ZgQPcw ZQNYKh6/jL/08oa5Ocad5PfRqPXeG0zcA3IR0e61424Y3DhKXfBoqxhWMTCbmszc IR4Yc6V3jtiTdrE9t2Z5DaTLVfidqgyf+Uaf54OTZjZGQQxecvh+c0S9eTWo/2I4 Cm3HBw9pT8k0sAQkWEIfih1EXtM5XQBhBO9Kz4OlxKLczeU53Kdwbahwdomt8+lm /AbsfkUlRvxrIbevNGtm4gXyZgVF+0UO6RMfz8MDnHE6BS226JY7C3Q1pxWqjJgD EWW7GdNMwgOhyCJsQ2/JoDvcF4Xl0dYf0vSgwjonKqt9CZidaOleSqI9jOYYIPlv wNtwasiOImxicDnw6tIZGOyT4oO37Zqy+q2R9i9nkeFI+Oo9F2++NWHGxKp35xHw 22dlNbY1S6AHVMzh7yJk6qcBTmSJjJGXJGZZ4KtRITTejxLYpOqT5a+IJkdq4Ni/ uq0E0rA/pG864n0Vg1apWwOR0r7WoDM7GSZfAHZsRBjt0y5JdTyE6slnzV3md/c0 5veR38Uqk4AsuAlhpvR6KyLimV0g0Gh6VxfwNC3ctcypdkRMG5CA78UMZ6rmKTPG XL5UZ/Ec6OcPULQfhiERokoxVwkoqwAY0FUzUaYbsYWo/xEV74kNux5uxHiM/5Aq AdnmQSiFBGpmdOs4vCClajTbmj1i/8+IQwsGNZTiINwteBoFR3kWyIOPrFFPSHSO UsoJDPxmp2S/+QJZ8NdEWoCAHYTjNmwqy+QA47quoT6ij/dPHQv78jQBpF7Ex0Oe GGThZ5xRlgWvhpVSnH+q4acBT2lYSM2pbH0hKr9Ci1JWSvi2WIw= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/87AB8BB5B8B13D6D

http://decryptor.cc/87AB8BB5B8B13D6D

Targets

    • Target

      fDVKq3XY.bat

    • Size

      196B

    • MD5

      13c6ac3eb74ae1c015c9025f767dab56

    • SHA1

      f10a803dbbac9109f416597bd51423a98ade9c62

    • SHA256

      8e692d3a906ba2636e93c6eae4acfb40d13459492e03008475defe021ff4db21

    • SHA512

      d931c952a2ffe69502ccd2ec6aa597c7a7a1318aa9cd3bd48fb30fed5cb653fd333531302db3c1e77581e827e0104e63d313d2818a5bbc24d14047fa7c6882a7

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Program crash

    • Discovering connected drives

    • Modifies system certificate store

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks