General

  • Target

    2fUqd8gw.bat

  • Size

    197B

  • Sample

    200305-h99jc7bjx2

  • MD5

    bba13ab064fd650d7da536895d139ddf

  • SHA1

    9a69c367fd1c5d3447045ab97f18bd1a7090207d

  • SHA256

    3f7d93a5de4e099d800fe9f59e6a3b4bae526e405962e2f0208e18bc1b5cff91

  • SHA512

    c9b129829953df9ed8e0a9834fc8bafc0259abe65dc7b185535a8550088d459cd25327b17035405c8b424a263df337cc1bd7ea03b13b4bf95b8a948051efc031

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/2fUqd8gw

Extracted

Path

C:\h698434kz-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension h698434kz. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/AACE83050253A540 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/AACE83050253A540 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 9WSiwic+CtGsAnLPT3ePrETcGRj4ifVbNzCPgasQxXodbKYcjMqVkqtMM01UZVE9 locsAayo1ZSTD2sVFabQEs/Xilx1m47ylAGHfY8Vo6Gx+x1Byfl3jPSjz89o9ogg dEQTe+a4aIWlFNW6zsz2gvo1URrjeqNvuS0pVKeDAA3ibVU/joWPfHv0Ro+kTpFF niAi+u/8JmP+USEB5GG83kYUcE4hIWJMLwcUcpl4T5rfwaUUgEZnCP4U9QrVoYN4 /Ss2nDffrU+5p2G7qXrwnAfFDd/UA9piLz1o6cY9zmojGp9+4xGuP8H8XpKYXc1G k0hEQPLk6lOSHGVWpuWCIrcUCpo0QcqmDLwZrt6r0CGRzEwwSWZWrgSr4UJPBVT0 ZSrmovCyvgHYVY6eNuSjQ/iMwmiy90RvGrF+23+9VGVE6yFWqOLF5lmBkqtXoWvd w8XHhGy+ibMEuE+5tbMd+KYYEzYTR6DWZ8+BKYDT1ZwTqIXSPm34tDIun8OBeYtq adM6azUCZgBgdsSYJ6HKEB+ctZ/qlaqKmRGRhjNB5JtzuAtgQsX2a21NvpMh1nnH TyQQfgsWZ7aHPbllPgJyTtJAT3VfJcuPgRL4W2Ps4YFjhngH52flp1pSRKE1r6Ep F4jFx5NcTu6ad4bYXioX2f/BbCLVXzubX63+a+Vh34rb7swXUmFQt+zlj/2myVm9 Roeo2RCh58H5mLODPAjWvAJM9EqoGozg9LIc9rHidZ4pAkU/fcB47b2xgchTKgKe aQDegdQtyJES+RlOjVeFtCnGLEuCUNmO4sGghW65ANEiimlsAlycawd2yuHKtvEM WiSdbXGghN4wy2v5V3atuncXUsoCOXyaJSD+4qZ877NBxrhJvj07rMR+HaxYRpyR JZFzBQoTFX+U7NHI1WvA3oLvJ5hjZeLhIQN0HvjrKu/DyDos4FXW725u8UE3M0Kk uqVjYyJmgpBNt+upN9UCqjF8gmzGOdVZLdSPzW7w6lYW3L6Cx8Y8ctb9qjHtuLwQ Yz8N75TXo1YiDQNpf0xSof5w9znkxHHNG4Fh9ft4QKc+C0vzyoufGwxxDd6zmrcx EnbZ3hWccGEivD9jdbn7GJzh7zsPuODPSPlz6FyxMCpowd2BNRigq4uGJynuBi94 khzxVe1P9KqoSSWNAf7dG6U31kjhrKOVMD5/m9WeM0YDe8+zv/BPJObirPW5oMjP VVz723xTZho3jaibt9Yornz/eZ7Uh397aeiWC38Jf7s7KjqUGYCTuLQq/0yow8++ b2nCQiuBO+gWXVjbJ8U/nyEtxdNXMcmNEDdEmgvRK0S2T4+cqYA= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/AACE83050253A540

http://decryptor.cc/AACE83050253A540

Targets

    • Target

      2fUqd8gw.bat

    • Size

      197B

    • MD5

      bba13ab064fd650d7da536895d139ddf

    • SHA1

      9a69c367fd1c5d3447045ab97f18bd1a7090207d

    • SHA256

      3f7d93a5de4e099d800fe9f59e6a3b4bae526e405962e2f0208e18bc1b5cff91

    • SHA512

      c9b129829953df9ed8e0a9834fc8bafc0259abe65dc7b185535a8550088d459cd25327b17035405c8b424a263df337cc1bd7ea03b13b4bf95b8a948051efc031

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Program crash

    • Discovering connected drives

    • Modifies system certificate store

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks