General

  • Target

    Gwbr3aud.bat

  • Size

    189B

  • Sample

    200325-v2sv4vjxlj

  • MD5

    bedcf382904ffd9d90787b2dd3ad81a2

  • SHA1

    56128ffdde214dd351e2f1c0be362a632d065aa7

  • SHA256

    051c9112f4294354c647723d8645889eaf36dc198a7e28fbe2f6e229da623a00

  • SHA512

    e52d5ce4f80d49034e5429e2c0ebec13e8a9c10b467c3368b1042136f810098cb1ea4d238230c82082025c20c8f54ed69dcbe99df5048d03d95af103100a0a3b

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/Gwbr3aud

Extracted

Path

C:\q2p91h1cnh-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension q2p91h1cnh. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5127E8D3A8777106 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/5127E8D3A8777106 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: M0bmlTfJo//n8ZN36d4bD2d8S38OAKyCnRJBtQSQQfeVkr9wCmbxxKnfDA7cR3z2 w9hu+khivGfNUEuzB+yLg5nzVKJKZgVbdri4CPRCF+qWa1AcIw1m2oZWOv4gRmX5 uDzM10Wm/iMn0mWL1pS3qQ2gLBivv5inMLyYTnrFvWCXs9mGKoTRSACIOzxswmms 0L2ZgHprCwIpIXjEpsHW96GI/jh/avTygLsSf2gmy9MmZIkfvqgF1eVVMMBpMrUz Gog4HMGEZ6SVjCz7pyVVT3xAVrpFtT5jso7HtaCDc1YZY5cjXnomkjdRARHVssQ3 CQhLZY+SV1k+VoUeBwZxzTnCdvM4x7NjHA5K/r/Xx0e3t0VdLuISXUr02B81fyV5 oCMyW/M4s9FM80eiBhGb9LWL+kdjkVr+jo6754u4UeM6SAnpZZwmHF3cgImR21GY kC09vjVbjzvG6DFWtAleJzEXmsclIU9u64kBofehCCnjsiJOctWpfDkSoZrQrogg P+Vn5kt+MGoOQH57X0szQXJtLQI7H+m7AxGoiH9eZ5Vp2TU5k5BhShv2bSJZuWwS 4JBMwUMBNc4rNGju3XxC/7myMyXW/xL9kIDkFRwCsw42FDNA0Cw+9FMDy1+/9OwV tzW7bdV3+eeMB+/Jj4QYzp1XGm3T3I6oyUljWbNkAoxRFfI7t1c1ecra2OywwhCr vlB1Cp6d/9AilbuQaK/t8mTiktEQaa3c8woUxwMr15rtAMbOThJWKRsmZhyXPouR /CC/K+4EwLSCzRnilTySsjOpBkDU/e0eJh3/pCYahEmQ3zF57AxEHZF6Jo8jxQEo 2jlgIfDW7h939/Dsfd2h6J8ryHMUo2GNHXK4XGfm2at9R2YERlGOvS5lOXm9fDTX l5pVdVTxzxk7UC44N3ZT5VvnfSQqPoLO/S/F0IuIdEAnY/5ayjxYwXy6UyUpFzcT Ryk0UR0XHL7dz0/bNnEXpVVuhhgImwyQ7c7dhIriibZ2N2q8DMs9nnyhgd0i89dC +TWXAMzmGSPjL5kmO4IN/IZClYsdJMvkAZugKDC9BlZyQxKFy1MG+OLk/QWWUBfk o5LS39FITfoaTA9qI+7u/oQAHDZrKryu40660cdCIgkcyH/YrVEwtowYGWVU5ZS0 pEESaFKCpodfoySK+EV62xjsln2ugZANIirbfUJ9sKkVJts7yNjENYs9zjOaiav7 6ES0HoT1nAj7ZXK7W4JStcBuBljNsapQdIs7e5thNToXZfv79L38ZulaQowg5B5Z Iv2eRUnwr83OVFI1zq7SYOYe+XR9pxgo9vNJWF5KiZw1W+d01tg= Extension name: q2p91h1cnh ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5127E8D3A8777106

http://decryptor.cc/5127E8D3A8777106

Targets

    • Target

      Gwbr3aud.bat

    • Size

      189B

    • MD5

      bedcf382904ffd9d90787b2dd3ad81a2

    • SHA1

      56128ffdde214dd351e2f1c0be362a632d065aa7

    • SHA256

      051c9112f4294354c647723d8645889eaf36dc198a7e28fbe2f6e229da623a00

    • SHA512

      e52d5ce4f80d49034e5429e2c0ebec13e8a9c10b467c3368b1042136f810098cb1ea4d238230c82082025c20c8f54ed69dcbe99df5048d03d95af103100a0a3b

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Program crash

    • Discovering connected drives

    • Modifies system certificate store

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks