General

  • Target

    sPECbGga.bat

  • Size

    194B

  • Sample

    200325-bg9n5gpk6x

  • MD5

    d94d07f2df93865d06f702c261adb86c

  • SHA1

    9ee4126797bb94f0395cca50216938d0e1c8d02b

  • SHA256

    9ad514765ac2d6d77c2e2a5d645c162006849ba95b1c3cbb40377c2ec9a229e2

  • SHA512

    1fa7ec3e2f2492fbdf85992aaee0db311410e627a2f63556facc24cd05efb08977ac14e7d06fee791f9dab9587f3b09b2333e03252fd6ecc1070c627365e4a14

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/sPECbGga

Extracted

Path

C:\1z17ud3-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 1z17ud3. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D19E534FFA58C331 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/D19E534FFA58C331 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: IL7+/SC6BHalS8EdT3GnRLR7g8yELs6+jumur83HbQhI+QPrush9BloBVTPwPp1q UXhaBWzBJTv4GD3N9yyOvgA8pqI2DkodyMIdcZd1skcDSUqW8bkFXIufFzfEifDd WT6pB5UXnKZkwm7Oj+rN/P7u/G5cDX3C8d7k/dctjTKKtUbkblZbsQg6g7IoqANB uoKzQ2Q+3AaA/yAnA3YKLSgcXZ84NAIPIanRHr80SGR1Y78N0Gp6+KHXubcPYEaI JhGsBiCVhKUkE3RLrjFeYkiiyWmyP78tqdNASPH+1YVu3jSvJJM2LHLZckZKUhMf 6h2pQoiGcGtEPWgEpkr1U0nyB4UxhUEtrx+SGQLEUv2JFqLzC1UhFrlgEvhdJd6i 3e4dQiakr7y+QQzTQl7xQ1SE2PJfH5VFUHRHLIRFo8UqTkPBHtY+TVjPniqLhM2S YekqiWI1/ZyiE9SfoiOl4JnG/Cp8zjvoUlYSMIm6sWs23yCeXMU8n33DSHNfbVlf PnL5H8rocS2SeF7SXHSMIR6+7uWzNTxJnHwiLdA8MDv9UATTef9c3DpU3bXJ9o4z GNpHSrn5dfWVWbAc/5PjWkIFtRBIb6NxBKpgQmlbpaaBsj04eQYiMqxJKSewNNIW aKIv1A0TdTok2q8loVt6ki16j7QawGr9ucSHEIrPf4fPGzi4Oa6/d0neMdbaoow0 ZjsyjERryjMVDAWwWM5UCGcJcDi4pApqdO0ZwLdjDRtLbtgYynu285cPtiH/S863 4YpCZ/c5CZRnaAfxuBSbJqmjOWmh2V2GqU7oGWhH8QLXfnF+542QZzxDYiSB1UB8 GtmlKLlHRnNj9ii5bPVmmc1Aqx7oubHwjZQQYV1DMkILDGBnAQhAByBXWq/flynk b7Ckn50iVUWK03gE5YvEdP54fqUsftzTdtdt/5l381b015Q+dZGYKHZCUet06fl+ glTKpXEYZ89r2GXw5z9XYQgueXZjhmBIadHAgQE1J8yBmMf0a3ujllF91YIiMg8Q 1gplI5RKdHLY1prscIIhkKbRvamQP0CSrvhJ1rze0MUHchQRtN9IqX1MYMhW/j5/ VdbxjjG2SVIJxtO4vQ7wEhMkoi4zyoFYiylAYk9VXncrIf3UAPyZMQuiQ/8lTGDk mTdNSbKoe4FPKed+ACentt+X6FsX5X/4AX9pDQ9dP7wPm2XL1SHOeAjSe6UoQJB7 UJ3XGRcob8giHiD3k6S715GFu5RDwhKCxiOG2Rh/WtUFLlRtPtLdW/F2KG5WC0B5 sgar/XRL+t413Dpuxj7lt+VE8DnwjWwNZANndOW9hxU= Extension name: 1z17ud3 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D19E534FFA58C331

http://decryptor.cc/D19E534FFA58C331

Targets

    • Target

      sPECbGga.bat

    • Size

      194B

    • MD5

      d94d07f2df93865d06f702c261adb86c

    • SHA1

      9ee4126797bb94f0395cca50216938d0e1c8d02b

    • SHA256

      9ad514765ac2d6d77c2e2a5d645c162006849ba95b1c3cbb40377c2ec9a229e2

    • SHA512

      1fa7ec3e2f2492fbdf85992aaee0db311410e627a2f63556facc24cd05efb08977ac14e7d06fee791f9dab9587f3b09b2333e03252fd6ecc1070c627365e4a14

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Program crash

    • Discovering connected drives

    • Modifies system certificate store

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks