General

  • Target

    9sqN4BDv.bat

  • Size

    192B

  • Sample

    200324-bdvg4c9eya

  • MD5

    cc0b34e285a2bb5b9ab6cd4d0592c578

  • SHA1

    6aecda27a86b4d3b07cb48a9df62aa6939372b6b

  • SHA256

    a13613d7952a7e6474f41c2fcf650bec3e50ee027145a402bba895ab8297b4f1

  • SHA512

    e30461021be4fe4bb764cb8763e8c2da51c14d0dad429ac8daae5a7a14591949d3ee2be520eb32cdf423ff7e4bbb85d4927b2ac597591c6d1ace11d28c534447

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/9sqN4BDv

Extracted

Path

C:\9vdg210-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 9vdg210. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/6EEA68D9D46B398A 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/6EEA68D9D46B398A Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 7jPYuwamE6aTSLn3GThqF51AmxcHKZZKx3BAG0vP/6+syVT/NQvnqDt1mqoxgKC3 XtgI+DMI24hyR4dEpTHT4tXrhfKlYsZJuzZVSPN7aT8Ts+BdbEOG9hypMsyuz0G9 YyL3Qqs/VSszpZ6nSQDmcrgrxSK/H4qW+IvvDEH4u1I/YyEO3lQ7dE2y11QiJ2ST oArnLLF2MxEKTIVvUxouyubh/QckOaFm2rCXoLZuwxrW6hNSQdPNKaLhj/XJM6xa YnrULJnXt93l+8UiE9cAtAWSX6agk18Ov12iOU2EInyFyHfzQsUq49OuZJmwCh6a KwPpNWQh9RNhxOYwPl4UmhTY8OXSxhL4GSJu5wh13pUE+XAWk+l9TiIb8BBMdqwM xYYvOUCuh6ozM++hM6wcpF5KqeSP9Os9gpC4pyycdjTZcX6imiH7pweu+seMKaR9 qdbFqWJdIeDf+BJtX8FzNc+NpvfeVf5vHbow4FGpxpAMiGaoYsCSoGzjADv+wdIC tfkqrXOvdJXAISbYd+ggopxGwYn6k7T3aqWW4tPdZmBUbaEGdUabsPebuxYgLyOw ZY/Cn9hUFSXDubXId0kxH5BmQ/iORiL7z2WGZym40+NI7hUnYptB2TMg52SmtBJm JVvZnm095hKDDTmn+DL+98YCuUHmL43KXJnJNPkqpM8QSIAoizKGJ31j0QHJIgs7 aknPfslSE8bK+xFuA/iPNYGpitD8e6og3jRniD9x8D8wIqZXJsUHT750kZnTpdW0 K4frn26gsMEILu3JX24ji+mWYw2VhBkoRRB756NQECazUAaxaqAgJyLVVWH6vdAu E/gi1ozZQ4Cdvo5Dqsr0zSdKFVZ7wAQJSCuK4j7gfZ1nO/SSaIe+/DbCEUel8wRD aMxNJuZRetsdXtmYFnegheOvhdbiLOy4ZjdW2lXiBkGfH1dCR9fNKctVgFg1/LBE TBytYRicsUMpYZ04gKDHIg/EWr9PdJv6VDpsdz0tMKD4OM4D8YQENgcIptFwO9cl TQfTM6+URXghNnTHHBOAZKyjiIcGvNh/tSYtIzc4nZqFGZQHdy8spxcAhdVaBA0N INcdk8JqyCpkegosIN0n/gLkfDG2GJEnMN6XQEj6omb2XpCwRSshLQJ6lKFACNwD Tm4/nqnkpsEEs2o6O+vFaZWXYati5O5G7bL9d0e78yuk761ApGzJJU4HbhTRq5Xe iFR45PmIWOsD+1btzoIPxuh+/s1z7/ZcgklCrq+noMwGsgp+vbBxckkKEtEKO748 wecXXIrDM9xV1rPcM1jKBAkmvUtCRz7iNVQ0pLDOiYwI6w== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/6EEA68D9D46B398A

http://decryptor.cc/6EEA68D9D46B398A

Targets

    • Target

      9sqN4BDv.bat

    • Size

      192B

    • MD5

      cc0b34e285a2bb5b9ab6cd4d0592c578

    • SHA1

      6aecda27a86b4d3b07cb48a9df62aa6939372b6b

    • SHA256

      a13613d7952a7e6474f41c2fcf650bec3e50ee027145a402bba895ab8297b4f1

    • SHA512

      e30461021be4fe4bb764cb8763e8c2da51c14d0dad429ac8daae5a7a14591949d3ee2be520eb32cdf423ff7e4bbb85d4927b2ac597591c6d1ace11d28c534447

    Score
    10/10
    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Program crash

    • Discovering connected drives

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks