General

  • Target

    v8d0sKF3.bat

  • Size

    196B

  • Sample

    200328-ka6nvr1n4n

  • MD5

    263828586e92f4ce98203c704ffbf1c9

  • SHA1

    75566486ea9fff4db3c56209a1c0f97cd13e91d2

  • SHA256

    19ecdb4b6af666cfb113f1da46dbcbc3d1e8f85f007dbd15e4cdaf1651d86f7d

  • SHA512

    eb2c49e503895e55a544e0057be3c36c73329d94ef3e77cad07e225e84e11d1c3f3da2465ff59cc766787f5c68ce9905a9182ab3c2aad32467c6b344d89149cf

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/v8d0sKF3

Extracted

Path

C:\41i6h904wd-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 41i6h904wd. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A9F4ADBB72C89ACE 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/A9F4ADBB72C89ACE Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: mAeAiOB44rJxZ174axFmWDCtdE10x/jPwC71aPi96VkrHjivEofqxHuVBD4hzh+r ewxzkTaoSdRNqxV+a+07YVTojh+Sfx3CTZ7Io3EDvTLrjz9V8xG+ukg8Pjtto/rP SkrZ5axOXz9b2F8qgdGRRNeuUqiHa2RWRBI8GsQm+pvrURGACqhyb+CmVdelXyiQ NvIOMcKPP0r7woeIXn/I7sjrpAf2NelBgMdjMn141LTEIlagQXAGVubmu7DQgvb1 XDDiwT8SY2tIfPpXk1VaKz9VeMaTf2Q6D1T0Nq6ccTUgCOg3lWqLK/3S2ddTPC4S q41ZHOETDv3cnv9ylWmcf9rO9xlVSPItS3YxrxobfXwXHWj79IpMhrYS6HgZgpKu zdV+SBJYsJ1u0cI9cVtTdasEyMN/RUMu08/p9AeZ5K5+0i19OGvpiR6f6uoKjrV4 gRceAr5NjSraLUM8yoGOdYM8VH0e5Zf/2zcg5mzqn2QE9d8vDCFx1dwRcdYexqNk eEJRAYRIQ4ay8xO0/ewRpy6iGnMdtbzVOP5Pn5pBuFhxCLU4VRkvvSPCGHBaZYH7 7fI3eoVD24lQ3/K3xATIhdvYm/lJOVvEC88NNNjTLVTugNIJybV+0OMCNeDBnSfk GjVA4TV9mjmYZjg1ldyXfoAiuEixT93twjZ52JOgBvfV1CEBLYiy5HrQvyoovju3 3YewaOvdiN/sCJF1YQKujjD+F3FEVkp816+8EXimBqg3BGEkenJjzSam8Lhi6Pis PVTneB8dtCy82L/zTDuno7jC9bLtl29AJUaxrMlFGBlh69mfQjl17mPGceFcve7l a+rJ13D24k6+qe3VHz62TQ0abGWFrSBy9jMB3tmhqB+QaPuV6KCJMJLrccrI0tER p3MdqMmT3BmN2mgiiRVc7URn2R/p94ExN8oIQLhj55AIoZI4Uk2xDLvwqWP8fgtn weRHqiOPY+wO/o7C+0lAnU8dJWgmYyWQnmd/ZeHRO2zsk3tbjfxeWwpUfkbJVBwH tBJOf3i16xH9rLh3N3g8sjJTOeU3c/2V7GAflFZTgcxrgVTDtfEqkgAFOFL0X5lE Zle8BqaUK1lq1xjGc8KnxpCprugx3qD25ZuGR2dDkqASMsYWBmA9AWn6a27476Z4 S/CZKDOnZpKZAHibFEGhKyK5vYPt6I6/hSgpIAnm63B1GwVubrAUyfx+9jHA0a4u r+oeeZjrg7uNGqPg96d1uoYmJZ5PiX0oTz30T8UqIjo6vhQOykR6p5rRUr6qpeUu B/rBzC66UVYB5zLcnUkQ0D+JiGx/K3RhQvOfXtuU2vyb/xFDjys8/A== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A9F4ADBB72C89ACE

http://decryptor.cc/A9F4ADBB72C89ACE

Targets

    • Target

      v8d0sKF3.bat

    • Size

      196B

    • MD5

      263828586e92f4ce98203c704ffbf1c9

    • SHA1

      75566486ea9fff4db3c56209a1c0f97cd13e91d2

    • SHA256

      19ecdb4b6af666cfb113f1da46dbcbc3d1e8f85f007dbd15e4cdaf1651d86f7d

    • SHA512

      eb2c49e503895e55a544e0057be3c36c73329d94ef3e77cad07e225e84e11d1c3f3da2465ff59cc766787f5c68ce9905a9182ab3c2aad32467c6b344d89149cf

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Program crash

    • Discovering connected drives

    • Modifies system certificate store

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks