General

  • Target

    ePwu3qhG.bat

  • Size

    195B

  • Sample

    200316-7e71xq1b5a

  • MD5

    aaa7b25a5b6939e0c9f77a1d8c141ff1

  • SHA1

    9a68e6ebd88ee65a64c80eabd25057e8b1f7a0c3

  • SHA256

    d03a1ed079e497d770b0661e81fe675fe379107ec06f75ce916466d2026b9310

  • SHA512

    bc6ac64ddfeeed68bb844d913716f47f951b488d2a509993e73202577b72b129d4c725baeb5fc5bf191c97a4cb8b90d319ed23b8c9056eeb9d9d5d34acd0976e

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/ePwu3qhG

Extracted

Path

C:\v65g0-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension v65g0. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D19FCC29AFE4E52C 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/D19FCC29AFE4E52C Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: r+V/nm2t9Wn/Qq6c9o4eo2YVCmUu3hViJQcCsUOkpJZjGJU5Vvc808DSg9QAUsY8 TAJxcf2qHxmHW8ndUMOHnOwJgQ/OUYnApkgJp86aLRpCCP/t0TJBte/BasySHVCb gMsCV9xFmMiY4hieV48Qmb2DQUckeh7IukSODiIcJzu8Zec+qvg3ArZ98yaCRCWy 1k8Lb0xgxnAoOKIE71ARdKQurUDgCDS2o14sVqr12M7r93nEen6Ax+iBFCk2g6aq RY+XZ6aSzTfTTPq/vP5qJQ5f3OlpNqr/t2S92b9iv39sjYFZCdPov0PtqFhclxMS j1kpq0P2AYi2o4jEf+aC7MLB6OpOo64RWyM26EnWaAnFoLbgOQxcb1CM5XHV0DTz AiwBdYP5LNGs0l01fDFLPQnVrL2yYVgexeO0ZOqyu2oYxMNDA58s1jmb2z1/9g1d lOxLDxS+33jJjIDhJNm0fgsmnWaOUZvFOQZVkCFi3LdcbSWDpGAdVdgbaN+rI1Q2 5w8vzFNcq2Sif5753jJq4axgy9o8Z/JoYHgpmTPSQCuryN4ifHY5NLEClafJ+j/g RwwC7aRa0P8HihWx47QN9ZjIwN8YEdI+qTarPKsNQFbSIvJX63Cv9FpIjurpJrxF /Kv2P5cos3Yn8v5xV1lk8DMVMEY1W4PH+r9rNRKnc2y4FRKVIYilr/7JlPOj6jah Ei8TF6Hm9n2ixE5RGgt0jtO1iv6LUPMUtcNeUpEYgoqHR3qr3/64PU6WM4BoUhC2 uEOl/a0kg91cmrOCaqRnOxnDdTxewc7yNlUi71xKIAA9X688lwZNNTVWEbxqEzPO V2lR8wHJF8K2muSsxbGYBAHpX5zZjoHL9+p/UjyzyYr8ims+9Ld2McTdI8m/TPP3 8yNGeaQOJ9H0v72yFGtQryivpZvvizZVemIeY4k9u6d4ZNtXTd1gKNsbr98oUrVV 7qgoyXITm9wwJIGTV9qQvJMLMsubmy1xhzEbUZmqmy46ZzfrtY+5aGEcDOZ6ttIU /j+aYTV20fWA3JmRthm3Mfjj1QwdZRbZkeYoomwC+o//FgWhsHLBazQe1kCjfziS tibwsXx7vxi3XE1f2p5GIt1/AzG5tDMLJln8Kco79AUKxP/L8rNwCj+HEnFSet4H x/PY7zsp9kJ7w+DrquitxHzZ+bCbsewBZi+Nb7+9BqAstki1eFFjS7BChI1EcduB P0gAmhHw/BGAEgT8tZX74s5ef+EdGSG638yqokOY6i0zhWdWCIyAjqZhVaqGMheL cZYKGnBt+vyZJhLV4b5sVrEkrlg8XKmx/2dfcKbK ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D19FCC29AFE4E52C

http://decryptor.cc/D19FCC29AFE4E52C

Targets

    • Target

      ePwu3qhG.bat

    • Size

      195B

    • MD5

      aaa7b25a5b6939e0c9f77a1d8c141ff1

    • SHA1

      9a68e6ebd88ee65a64c80eabd25057e8b1f7a0c3

    • SHA256

      d03a1ed079e497d770b0661e81fe675fe379107ec06f75ce916466d2026b9310

    • SHA512

      bc6ac64ddfeeed68bb844d913716f47f951b488d2a509993e73202577b72b129d4c725baeb5fc5bf191c97a4cb8b90d319ed23b8c9056eeb9d9d5d34acd0976e

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Program crash

    • Discovering connected drives

    • Modifies system certificate store

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks