General

  • Target

    hgDyST1E.bat

  • Size

    190B

  • Sample

    200319-lh9cgsl3es

  • MD5

    4668239566a80d708fba74f1e0bddbbc

  • SHA1

    3bc18157625d1de63134344bcd94006c92e970c4

  • SHA256

    31580cbbd123c8272731678cb7c2297b6329b3f4512125568aeb7a6ae09ab294

  • SHA512

    d95adf76f94b712e99a0be8286fad55472a12aa04c5288bc930961d003cf09bd83fbc26b19ab90ce60fd459b5efa3e0eadd36d5a710a62788efbe3ad6ce72947

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/hgDyST1E

Extracted

Path

C:\ng4sm6-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion ng4sm6. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/92B2766D8AA053E8 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/92B2766D8AA053E8 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: dL3TJ4ATpNyF466wm60kQpe1GxkVDzRQ563wwMUDzYZ1eBIKIUDiQw7BfTm10ZHy 5ovfJJQYqjyXiT4p+KqjcIcNyGxR1anZwQMbaplgFcSrnUscvKV9koF9vVOQOFS1 TjGNBdIkY5IL7N1u0D13mTTvB/Dq5EBtWmKZv8xvEZs09nzE0VHRrFDKE+1g1Kho VRY4s1bc60axHrqW86wSwI06wqiYuD4Hk3Zx/p9NCz/38D6ByFvx9f2m9BWGmLXp NHfdQmF2Lp/rLw5IHYFkl9WXkYKnTYgRfPAihL33gbD6HJayQvz6gxFzHDPXKkYo zx0IjV9Ue2hrDMwd6JrOfXJv3GSd6BdZU6YwHDHCDD+7k7kk93/15s98NgknuWQS 2sWGX97a4SgYuphZWa5tFwDQt7DW0JJrtTbUBb1JmIcpvlf4feVWdOyXxx2uXZiG WrIVCd7qw4woES6NOMEXi9fM2fKgLWqISuA3Dh5HfYj3B3Dt2vhcmmI+dqoVZWyq fDiIbiw9SERRzG+y+X/ZxVI7F1dXuKSEtZBAnUnQimmyZJVJIiBn6cfWG5KX8c/m z31amzbVApx7jyyxJVAv3mLR+KG1yfRJvejm0aKOmx0rsMAGmZrHxBYSjve267bB v0T2hO5vZ+SjrUHZJDjmJdFqUnnZNUINgDy0qCLj79FSP1pXwntE4o9krniUF/JC ce1io3RDNs5pVqi3s+HJ1/AtzVaVkQTrOKB3H1hSDxth2cUD/RQll81Fpmy/36r8 2A4UZR9ydxX3C+coojJgP5sQj5WmOhsZV9jufaSDGAOIW3zJCMhc6u4/nZQV1qWQ Hk0uuWijyV5cDOHwZyf03nNc0VQP8XeRG5jD8VDuGp7ss/vHkqY0BcrhnpU2IC+7 Tg435KF6FhgjjO0UaQwGeaSo/o+Jjcug/gXNUffdaj/gWplcyCL4gpWaZ25uPfsm X7KQ2j4SNJtwlGujew829ezxK9L8CNxnNclX3sXzLZg22ZmoHquyyyj8DnsT2WNj lOCNxQV+Og8/OdT4wtmGbR0omxFVmKz+DWli5eKC9xVQS3vHqYgLdvhuBsPGTsY/ CPNks0buuSAD7O/uo6z9GSN5HYfqK/JYtPtpYFWr7ue7W5vH8OQg6Ld8cXlA0DIQ w7iys7TV+qa7ebE6qrguY2Xpg/FI4/S8F4/3lF9wdc05wYECZ/nC4M0f+KStnGNa uVvKE2JarVKYLhHf7lL+2Yf8ahjQtFLUlwFBYPk08po1aU98cQUpBk65UzODUqnN y8cP3OIWQ6VJEid3sHoUwGx3lAuAi4ykRsq+2MWB9VQ= Extension name: ng4sm6 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/92B2766D8AA053E8

http://decryptor.cc/92B2766D8AA053E8

Targets

    • Target

      hgDyST1E.bat

    • Size

      190B

    • MD5

      4668239566a80d708fba74f1e0bddbbc

    • SHA1

      3bc18157625d1de63134344bcd94006c92e970c4

    • SHA256

      31580cbbd123c8272731678cb7c2297b6329b3f4512125568aeb7a6ae09ab294

    • SHA512

      d95adf76f94b712e99a0be8286fad55472a12aa04c5288bc930961d003cf09bd83fbc26b19ab90ce60fd459b5efa3e0eadd36d5a710a62788efbe3ad6ce72947

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Program crash

    • Discovering connected drives

    • Modifies system certificate store

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks