General

  • Target

    3Nu9v5ZW.bat

  • Size

    195B

  • Sample

    200325-entpbzplce

  • MD5

    eecd3a82bcdfa01935bc0d836b329a5b

  • SHA1

    f26fe622fd6b58796dfb119d4d506758bb63f495

  • SHA256

    ab52018e0d9d17dd67e02f4ce6525d4e846f14b36348aab1c7c837c0596ac433

  • SHA512

    0842c48d0be5286338d2eee0e7af3643851758cd6504b4f4689b19d4ecc82c714ac7aa3c22f457c3dbe42e391b734949bed000fdbf206b8124367ec6ab0ec474

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/3Nu9v5ZW

Extracted

Path

C:\678l89-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 678l89. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7E685D5578AF449D 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/7E685D5578AF449D Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: gFezRNdJgHvYdCca16D+ZahmpJKh9EZcC86+tVKvGXlJ6EIdCk18Wb8YaerDOiRj Xr6qGN14c8YAN8uee4lIbswm+XdO5sRhaiVTP4y5EAj/n22jbJm82MLldbzfHPFe KGWTaaRA1uUVtdzUKDB5NPkRjgTTIv3vw4Eyfg1Z1z649JaazcVFNWG5uOyykcid pyOBE2WXpjvdvOHGWNvvqnFneSMcmOxwUO6EyNp8CWeu72sRgkRiuLsL2C9iv1Ep 9qi1Z6b1We4CrK4Q3nW/0W6VdGG+1cNsowWim2KgERRSe6OSWscNpLPx1farYLWu 8SQcjamu4w1kMmKw7YEiIClsEIaXSZlM88wtUMkJm9I1XL0ItkzVX1L/16s+Zew9 K3nzE3sRYkO3U9wD1+SRwnagv01pxr4FK4il9bw2NOOxAJqws0hwX8UPhlDTR79E 87zsEmw0tZeplD62uJzW6EOW7K1I8EprkYSWnR9nNLpVlPX5JlAwePo/VWBL8pgh +bU99V1xK84UwEnjoBmQH5xa9u8HzoHqkQhW1MH10C32NJvTAtQBSYZ4f5qj0QGQ MK+SbDZV4DSBuQzlvosoed1V9NrVu3P00EIufMXqLbxarrmp3j5kteYjmF+sUPp8 DUkBuYvbiHfnuPI+Pj9jmlV7IbdWVNk7py0DZb5AQDMtLOdMZhG9gZmgINhK16eO 9RsmecmNd6+Uw5ddJ/lRDXkzPesWHTMl08SXka2tpEn5NRoKQNn7YrMMwOTQSCez H3Fd4U5y4ysPbXGQ+K7+UhJSk5SKXJ8/tuM5BYB77bx8GUBoHwwHwKapW57nDKmP Px6BgjPEu11tV8YaYXh6BJ7U1vq8T6lmeeOAeBu8pBXMR2Zyph62Mtf/Ox4LrRZi ZZ4Yt1IZ009HvN17ELQNYEhFUUhd7XVx+SjdAqiV75TFwNw5VjEjvODQiuxdVjwm noGzl6dFSvi8rqslA+XbZQyZV3lJZOSefB5LkJ5HpvUblB8uFHnmT59Ar1c8+Snv cWkRjTko6I21u3sx+JnTaPyjZlpGqQyBjy9ZZRkRzYYN4qL/IxsOqdetwBwTugJ6 SHks1l5QP+cebSeh/psAu1VCAFgiUVRoI0w4G2EajB8/rh53vDdFnqSZ/w8/E6iW Jgps4IXfm6CeDAciyes5WN5dXh7e3xwI9Xbndd2xBsnDAXK+6C93q+hbN2TQA0Tu NUKOxMTfM0iDjnuJh1EeMxG6xCqFTSoSX9g7KJAgh2QQdYJtqBJbas6HUGPYcZvY 1SdR0sLTpDpXA3dkoNpHc+Omir7CusyA8G43KCfo2EA= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7E685D5578AF449D

http://decryptor.cc/7E685D5578AF449D

Targets

    • Target

      3Nu9v5ZW.bat

    • Size

      195B

    • MD5

      eecd3a82bcdfa01935bc0d836b329a5b

    • SHA1

      f26fe622fd6b58796dfb119d4d506758bb63f495

    • SHA256

      ab52018e0d9d17dd67e02f4ce6525d4e846f14b36348aab1c7c837c0596ac433

    • SHA512

      0842c48d0be5286338d2eee0e7af3643851758cd6504b4f4689b19d4ecc82c714ac7aa3c22f457c3dbe42e391b734949bed000fdbf206b8124367ec6ab0ec474

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Program crash

    • Discovering connected drives

    • Modifies system certificate store

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks