General

  • Target

    6pYB8Xdr.bat

  • Size

    189B

  • Sample

    200306-4j3rx2by5e

  • MD5

    adc4c486529632e46e26c2a27d5ddc96

  • SHA1

    a5f4112bb2edb99a02cadb82a8de2100bf69a103

  • SHA256

    d2f4f3c848cdde79b41cec10b15c3234bc45e5f5fcc3982846ac4788872c9b85

  • SHA512

    8df8d6bbe3b2065c4de26aef438097d3a7b8ee7f47c96001cb86f41eeb2d7a154543af5fdcb9ab11c6b3a52de4b75f7163bc8f00d272b74b0632a37ed98c2d5f

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/6pYB8Xdr

Extracted

Path

C:\d5584r59c9-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension d5584r59c9. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F1A1BCF7F0747E1B 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/F1A1BCF7F0747E1B Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 2FMmS8nmo7Yy54Kfs1sJ1VyNPR+9IXpDa2YP+nyAecYh99C5JJrd+mpyfoDpHVjF DQzaTkSGb3uNFsXPnD7Flja0KcXBTM8FAvTd+/7fZ9ZAPl83XnjAxkcm/AmUh4XB abbyax2Be+EMayB/qGjn2hRybZnHREQvXFhdA8F9uYFcMy2Z8JMLcXx38TyuCBbR KtabP1CYBF/UXrpzN7PKrK2Rks8nO6Dhg4azSlG8KKReUvk2LKa0cknjXh9qkx4w qQ4qAIC0wOzKxb5g34rftyiO3GuNIk6a76nK3cWf0xuNsG/TW/f5TO9StrOzqyRJ 27+z2U2ZvEUsvNmus1GETX6IKa2Wv9vNqWDsSxu+Qq3OmQ6TKhG5ZuZ++DNLn+ck rUIiR07JafghCgmOqFa6URYUNtBr9yCc2dCdo5uK/ESgsmbzpWm53nQ3zHgmeKke tBHncXX0G4f9/bpw0R8CSWJOIo3Cbnfv8wtqaTjB7dIan1CjXCuDRQ2B5J+FRIfT zbu622MYhbDtherUTTwm8Je3DONAsNCZ0cdCxLq/3oFS5wcF8KZPntwrhGD+isnm WqOOkfK6VBNRL2ZCMGs2a48Hos5IVCdcdOHU/bx0O57f4s6CdlEEEPjsxoULJDOC gaSlQkt+MZjR/Ladq5qBeXog7wcVQL3TUeQjiNnOjAsCp/R9+xt3zsO6nNX0QY5I 3Ik8/fhfY2ThKAapc7MEiWdHP5dI8ntM+CzcFrRyUATVBmP4M6uqiqrnaLbhJSKM AXdCgK0dhUjsJiJicUq4LesAwmDvfnjeWnEkRQL2ktlrO6rzjmH4zMeqN7Q7YUsv Equcf3KkgRX0gsloIJvTCPEfIaHwhP9x0SDNte45KuzcTDh1VvW3bEPXk8aeZcFs uAfyLbZRDEQ3NWIg8k5N4aCeBJFVZxojt2gR4MZbMjt0ebGjq91u/QvF6u3BOfBI VrpMS7kPs5MauL6BNid/8mvgO5fQC9GKHOTq6bKO55XdgvDtdEGuzT8HqrtknoGo ATu1iAs0nf0zgprf0eKnFnTA7QN3Bi3PA2mNMlg4tGg6PVj0DkMr63PLlrCqAfY8 BWRqow4OB0kYg1HT3I91TswBKuUq6Lg4t+mBdWEzZYwNw8qchD4uYMARoZ1WgMoL cKM1ghZvqNYlHN7IoIed52Rq7TJVdFPIiFCeJsaxqH7Cy/C0pJlJDb7OOeZ58Qqu JkeEIXW2glhibEAYeZZnvJMZkt3KDdONfcuWYM1207wE6ArB+dofCHlbxHEw9iJU 8sHpOj5tij+zPAKL70cEB8qCzFim6hcpE32833nMSvQDbuEFxRsEJw== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F1A1BCF7F0747E1B

http://decryptor.cc/F1A1BCF7F0747E1B

Targets

    • Target

      6pYB8Xdr.bat

    • Size

      189B

    • MD5

      adc4c486529632e46e26c2a27d5ddc96

    • SHA1

      a5f4112bb2edb99a02cadb82a8de2100bf69a103

    • SHA256

      d2f4f3c848cdde79b41cec10b15c3234bc45e5f5fcc3982846ac4788872c9b85

    • SHA512

      8df8d6bbe3b2065c4de26aef438097d3a7b8ee7f47c96001cb86f41eeb2d7a154543af5fdcb9ab11c6b3a52de4b75f7163bc8f00d272b74b0632a37ed98c2d5f

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Program crash

    • Discovering connected drives

    • Modifies system certificate store

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks