Resubmissions

09-03-2020 15:11

200309-1vytt543kx 10

08-03-2020 05:10

200308-ss8z26wgdx 10

General

  • Target

    x1Bvt0gq.bat

  • Size

    192B

  • Sample

    200308-ss8z26wgdx

  • MD5

    dd1239e32d4fd55aae544bb15b09ea1f

  • SHA1

    d4f32b49384a2337cbed07cfeebfa8e67e0802d4

  • SHA256

    715a6a90ff483fa2887f7e1f517e959d18854b52d8f7ed9b2c274e5b54a1c436

  • SHA512

    7a37249a47bfd25e8bd8c7c802cacdb5eb822b221e3a884599b49ab8798b0a9faf7ba98f34c14b7e7da39869f1bfcf452e482935ca502d77e829556921502646

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/x1Bvt0gq

Extracted

Path

C:\950q149b6i-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 950q149b6i. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/6D192BD6B5635A1F 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/6D192BD6B5635A1F Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: r6g0KRvudEIIJbtURDz/99M6+nJN+EODxcrZpmP8qwLIvqJZJfZ7Xejb8sOhVphg 1zayaMRVl2IOBVG3AXgm7m7T9WX6ccM21nbSXELJAq5hKy2W/5hwBOSSESmc8qJL WZwkF9d0ofzkZXFhR8sqH6+jOGjdQJ/Yedqbyd8JhtWEWs2/NTMyF03tlqlvzISE cgltbgwq4BTm6GwYSiUx1owEy1wxip41X7wLYr2O87mmDxj8OL6IDTA6A7kPMj2A 0SuJou/LpzNLBi2j2AwkFqheNsYWGaPfizbuDU+nhLKmV0pOaJ1ZxX7K6j+lt70O sg5flp+J+YkVPYQcPEpE58l7Lwa/7dvnlSjt+829hv47LiV8g4BzJ7kDOYEic/Gz FYe6HtzPMa3NGIh4h5UYWVMLuxjjn2UZVEBFwl1/PjL1VSXB8n9pxSilZm4cRG+V jrsmzKOiiY/pVkJxX4IhDgcbVVwWWTFJKNOvdGZq/2JDC1Xizkek2pBaWzjCbTrK xR8E5itRpge3O+g/EWmrdBM53NKMOszE9HJ59yLq0XAMt0bSn1j4q9DLLpKJ2joK DOL6DYJf7y1en4TwOHCtXyGP9tCHHZ0LDTZcE4g5wNRVznr1KEDVZ7k2KuetW2wj CuIVlI+jz/8HChGNOPyyiX6P8ZfnrH//oC+KkkfyMZvI6KsgDd9Zy2d/UIQh4I4U k0iNXc8hFTWQHbkPxnATCJfOSoehBd6Pp9fTKW3cwnyV2MUcW+Ueu64BR2bZcUNB EH8E23d7iq+pIBLQS0czQX9lSwSeny/hPOV6rJSWJ0zI3DHvvyL2I8IsxNmtf77J 10vmX7VSOlbQbytfL+NnAVlciYgIPyCazPI4p0suT74HUh2JRZRS6eGnSvZMEoT6 679l1ut+D53ywuZYLDyXfoBatyU2ZJOfW/2y1yv6UUy9qvyPuafUQDYXJSnP3bZp V5ElBqges13yEAUMxYimdZC6XFJESd9ObtmQ0fKJRXIRWccUuRC+eiRdroagOyED 6q84Aeg0ezeqJfEEuF2xw6nxQ6mgCYk20fB5tY9ngLBecJb0r6xw2HPmnyDvXrVb axjiDD45fmH28kCmyMH1li8yeRba3mX5g6FZfaJR/x7SvrVgGaruPxev/48xNQ34 p3v6Nr/nDKmjeCCPd8lajbrlvbuFAYutPTGwcSoCNcw6tB3lHod3hlX0mbe5uOGh wvyA9tigYKN2PwPaxpuLxOMT+4Mr+LjNAVLRPHzJGArvhjB74uJrUvIbeRS5kveH 7lc+FNkhAcfdpWxRCYk7H9PRSQj0KdFt/oan+QKpkoktok/f1om7Kg== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/6D192BD6B5635A1F

http://decryptor.cc/6D192BD6B5635A1F

Targets

    • Target

      x1Bvt0gq.bat

    • Size

      192B

    • MD5

      dd1239e32d4fd55aae544bb15b09ea1f

    • SHA1

      d4f32b49384a2337cbed07cfeebfa8e67e0802d4

    • SHA256

      715a6a90ff483fa2887f7e1f517e959d18854b52d8f7ed9b2c274e5b54a1c436

    • SHA512

      7a37249a47bfd25e8bd8c7c802cacdb5eb822b221e3a884599b49ab8798b0a9faf7ba98f34c14b7e7da39869f1bfcf452e482935ca502d77e829556921502646

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Program crash

    • Discovering connected drives

    • Modifies service

MITRE ATT&CK Enterprise v6

Tasks