General

  • Target

    w7MPmXqT.bat

  • Size

    196B

  • Sample

    200324-d7qd4hh6f2

  • MD5

    f27899524a4ad3e77954797a979ba0d8

  • SHA1

    281223c4cf1338fa2f2ea469ea8e6f0246b5adb0

  • SHA256

    359a07b1df7b142cfd37af0d9cdbc28ace2ca7ffc9bd778fde48bfa501a69d79

  • SHA512

    2bf71ad0387cf7c0b48dca5dc95c403fa2bb7539e155505e8f740f5f991cbb4c266bf0bc790a16a4915f7c72bad871ac437f08c19ee918b2386086409a87e97d

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/w7MPmXqT

Extracted

Path

C:\j9771lc704-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension j9771lc704. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/1C7CA4BC41FD620E 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/1C7CA4BC41FD620E Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 4AUe52Ewkn+O73eTN7WLmNd6rx4y845kIvc5FO6OrH4TqsHShWV+KBTIv9PrfJkQ giwF/ZgbRsBYSEQURfOI6tVipEhV4HR4TdY23Vhc6qxoiPp8jyf80JmIaj0+LsYl nJxJA+n5vscDPrGsMNC0o2aWUfpwHaVZ1U36HSsrPmbBMiyGRV8wutnaVq1QfA3t KMb4iVVpWXR2Jf3Br5dTba9eD63s3woMq4HIc0UUKryTqqh8UvEk+idzoDFqcBLh zt/sfx/DAUEylZst2XnrN8do5fMIyHXQiEFWtr96LBdEtHdP4h+uqipRezaVI8gt TwLeAw89gD/1BWuU2BYf+Rxo7wnK3Jq/YFhTeEWEOMT4+v9DPKXOcTaWSzp+MACa HWZUDFzBlVyQ3CmVWFvo0Zwh6qezXalhI03YFF18GIpi0lJLbaXRaIgln0ksBIlR Hc3ThgWqJg5Em5vC1/MMgEddMzhEAIFwaXddGirBQk39JUiPNkMTtyDJPbhTrm8V +a9Bpo0TmSXxysjEBFhk93ygcay0bhEGh8+rtEZrkl4Sgid3KEEL6h8nS4iVdhKo hbw5ubORAA9xZ5MskUCBNIwUFVkoO3zoQYk3i0ADHt4Gv82teccjzqxMbAGJdgLU hByy5gngNXWH3BJAT0Y/CRpBD7riqgqRFnIc/xfqHulJSYO2tOc5L3e4InYfqun0 R1nrIfo4/ShSd2OGUKKgvQY/JwzPbKGW1VvBaGTTejkxx+0GoJ77IzQ49brQa8sx K+gNSjM4thV8UJ8pNwqhvG93PZYkw2+8r9UOfN92mq+VDiGNA/WfuDx6kdIF/5+F eQ00QxcQmgxnctQZzknS27+1WB5zVyDb7qR/DCfKiCgl20aTseucSpKPGafvAP2Z K3eboWQNoSwT4Mv2+S+NIDdlz0fsdqtS6mP9TNCKC+EeYYsf0luiENRc/QNR00nB I9E1LW/jsptSg3MqHVRTo5CXaLmWbYvQgfpbXvxYWsZtwISTXAh9Xbxri6I/7etq F5BZGnmdd/1glBibtnJphG7Fes7omP0WMVJOWfxDb/yZxeE5/Ld/T5rgToN8++fN DyejxKyi+MkEPpZJnzFQXdT3LCUBG9oNrZH60qeV2+DyhUYS9/myQ2L9Yqiax3RT mhAO8s6SpHq6/oWANPxcVJdX0bbLyu3ZS+19snzzRtgtJA1xN+1XNhRiyVhlyTeW AeDIh+rKE9tsDTuCIoYbYeJ4Melbo19U0/hFeJ/b4I9wly0t3B8Owzlbel7MY4/8 g32T5+IMPMmp8bPM1H62xVyHiz6ZvYcVgY5LGDD+sBNuxRZtyLUkcw== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/1C7CA4BC41FD620E

http://decryptor.cc/1C7CA4BC41FD620E

Targets

    • Target

      w7MPmXqT.bat

    • Size

      196B

    • MD5

      f27899524a4ad3e77954797a979ba0d8

    • SHA1

      281223c4cf1338fa2f2ea469ea8e6f0246b5adb0

    • SHA256

      359a07b1df7b142cfd37af0d9cdbc28ace2ca7ffc9bd778fde48bfa501a69d79

    • SHA512

      2bf71ad0387cf7c0b48dca5dc95c403fa2bb7539e155505e8f740f5f991cbb4c266bf0bc790a16a4915f7c72bad871ac437f08c19ee918b2386086409a87e97d

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Program crash

    • Discovering connected drives

    • Modifies system certificate store

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks