General

  • Target

    sGfuLFJL.bat

  • Size

    193B

  • Sample

    200317-xg2tekyhfe

  • MD5

    17c9f036750c9f73392ad5d300c77ef7

  • SHA1

    e7f99574e7989564a222e10856daded5d49d5922

  • SHA256

    ca270555bc105598de38c9103f8dd41470b6ea4ae35d5da3cfb75c27a7897204

  • SHA512

    e5036da198a282c2ebdf7e0646d5aeeab5e28d20d7266b2cc7309569ab6770258a2f846a5f4470a03d07b63d16d3a0762f860aef106759ecf6be604e3df59d46

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/sGfuLFJL

Extracted

Path

C:\pmo05x3-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension pmo05x3. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F57C7E456F9BD1E1 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/F57C7E456F9BD1E1 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: ohh8VJ/rQXhqH6IueJWrokOn6B4ETHrBckHqGb04UAcgePmHP0BOGq79TDE4rf+Y f/UpR2EqXphmT8CWuepzK7jlxSsuUGfx9elSEOqX90n2SgTiJDsk7AGbdR2QfzQP xUfsSTKwugDjTLQSbFS6vUlTBk8hclMIp88Qgug6qPvh9znni8a875p6NZKa9m6B ZhogdaQrpzb8A0kbBH3zRqv6UlV3WgKcwydBu+TDG6mPV+Gh3YBx76jI7maTqKOM g9tcymVXrdkG116/OjNlmpiZOZOCyg0Ftpw+ubOqzNefss72EKsbH8vETfOjqpvY aa/aZuNG0r1m/gk+Y8QBcY2kTWL1/skXuyBb5QP3xPVIjGVYvZbnFZNZ7r16VWCX xC4zINgS0BLkniTX1luARUb/SWrqPDg6ndSq0KU7GtBWIXdAcVE9qjdefGtORp4y N3M16JzEcXi6q2Jc/SIqpPQUhCaD4MawM4R70CGqoXHnlo0Qtsbp3OX5M32s3gCk KFP5I1ivOc+StVCay8XazSRW1Wo4uuyWlvTfRGZwhkekXPy4AS9ZC8hofwF3lKz/ arK4V07s5go5lGVQeRliWeylah1Mr3Jsj1+p5C4NKbbcHV76Q8faaYW8Ys0HTN5j ufsmQQ5elNy5qJomqVeEhBO1tToDEJHjgtT3KjniLUn/ATIu3+PzTveSsBfTqTVo aeEereCiwU1JAo8b1KK6FJsCNqsrI+qhUQaEKqEVSofLOhKyV8t8ebvOZigyAd8L 20QCbK+8YgfQT2aCf6eub58FUbDHRQBBrwkJ/jqNuF80ufO6bt8XAkSnPEKzL4HW LikZm/9QBnmshIlob0wmpY9Gm6TH3+ui5cEfticF+ciEfYYLbRGZ/TOZ7ATob2dK OoqRgSEEseBZgGEuV0UkiuI/EWyEBRzDckdeR17oYYGmKr3RQN4Gu44cchOKEL1M o4IqK4tVvJT2qrV/7vdJtbl3FE4UCM9vKOvZ5LkKHLrMwSRUE9r/FPFrXtBLajHc uJbPiUtO3rY30XO0QkmuXUxdHGLEbF8z2VCop0SD1QtA6Snv1b5w5rgOI72YdhpT ick5Oc1B6xiQEh/JlX1UeutWCY+6EdCTSaA1wcHvtdAHFZjaO/NmvdV1ARRY1udz fN5bnI3TqdBjoKANai1ppgeYDFkEkVu2IvLSPI8egzgFFU2xQN+Ug+oWb+3bSVdJ aQTOjIu40gwXMK3EREETLIyzEHmq3OkghQfStvPVpsP31WPqMhlRXbrQoiK/bT4x 2/LxItRFkeB5mfjZ1Wf47NZbWBIhpiEVuNVJq1vph3AoWw== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F57C7E456F9BD1E1

http://decryptor.cc/F57C7E456F9BD1E1

Targets

    • Target

      sGfuLFJL.bat

    • Size

      193B

    • MD5

      17c9f036750c9f73392ad5d300c77ef7

    • SHA1

      e7f99574e7989564a222e10856daded5d49d5922

    • SHA256

      ca270555bc105598de38c9103f8dd41470b6ea4ae35d5da3cfb75c27a7897204

    • SHA512

      e5036da198a282c2ebdf7e0646d5aeeab5e28d20d7266b2cc7309569ab6770258a2f846a5f4470a03d07b63d16d3a0762f860aef106759ecf6be604e3df59d46

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Program crash

    • Discovering connected drives

    • Modifies system certificate store

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks