General

  • Target

    dSNyAGjr.bat

  • Size

    194B

  • Sample

    200330-v1plzt7fdj

  • MD5

    3263a69061a96c5fcc6be2968f67726a

  • SHA1

    b4ec7fe9de7a5954dfc95d69feb5525fef517657

  • SHA256

    2d0029cb80898c2b7f7e5c03e6d8fd8f171ffa2ed431a0f02c94b0209d93c2a6

  • SHA512

    5c67bbd136b0c48fcfd51e402751e3564dc3b1ba4c713697af9c896c2d6c61a825c66196e5b3bbbec3b76617d31ff8652a82239e90c5df35c7b794297c4441e4

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/dSNyAGjr

Extracted

Path

C:\ltp82mg-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension ltp82mg. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/586CF4580BFA49CD 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/586CF4580BFA49CD Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: REYX0/OnpmIqzIiGRUhJfmXt5tFeqqWrlbY2ojwg78ZTtKGZjbXH9LEDTgI+3nam h/9+Jdb0tEeqmY6Fxzi4YYQiI11JgLa60rU/2+6w67aXgvQ/EU6PnwTQ2H1G43Ai aKhH3hGzKmZyIy/TBzK5ohH/A0ogDZcWD3haGfX4RmmtUXWYC17/N+9GpXPXuUUF sCd9r1uUHVv5MYaRoCNTJ2mYejY6RZ8rwY028x3zOB1WCN8DEGXUWjwNBs6ZYSEt UGkryLQJx6EjQxvBpUZY8yFzeilvwNnYUDXgVcXDDJqMGvc5+Nl97vHRoRDgLrv9 tu7uhA9rdv6PBioPLGc9V+G7F+AlFdZhS//Ai1BiN7PK/lHF/Cne6RvYO99CftMo NoclZ/Ey7QgopdINilN3AF9xj26BzW8OCwzZ9Hhs3aWb1F6NiDKmd/aoWDE8//Ew VkZJ2Pwc2byA39LzfGbb6PS/f1cstG3a56C9z4DTxVwP7YWc8WSoLxFB5lcWoceo aj9MGf3q4cFt055F4IVfF8+M0zBsuPtU8y9mbAIPD3vCjNiNp8GncWjvfWd6DYIt 5lDwTfWuywTcU0+G6eEESYc86rqL8isCvmlpGefK3te4vwmqeKFPnRt0KXKzfzjZ nFfQnDmo0WKV/snm8QVe5t5BG/CqUoTtqGvlR5+tb/XD4r1fHP9ntzKIbQ/gx0aZ vzt/tiyWj/B+FQLTiqC1/Kp4vmUieWwR9QncfJQ1InHKNzpOj5v2ZyvCWk6XZjAT OOajEaP8MTiVuGWbvnCKsphhtbUMP4fpKeLPu+z2aNU6QJMJVb9k7FiCXm88zY8x 6dpjIqkMLyYUoe2XJGxtVexoJsEhz63TqyMN+y2dw45ywLKM1ckqN+aABC6cS8Na H5S86fN2QIJMTZ/RO/xixl82276gG0d1ZfpbEb8/oDilUiaDzjsH9+ADQCk/l8x3 wcPVvE241S+dUFmKJF9mP7pjtXsuvi286pA6mjuPCgExjDyDFodT9C2JxYFqC0Iz zQikW+w1sI8xLGQFmavYcIZOx4Gqal9GQaZjRRr66sg1yt9Sw8Gf14W8yQowRmve qhSqeeGN6sO4Qe9KUlPt32b3NU4ZkPD5jXFFfDFBtmrvKO+aH81nIbFzPOhmMyxN j99FbnYRZPj9L73nzk8H7MgVLFtJGsXDh3rvXjI3H4qWEiYidquI0XGoshKJusx+ yCfSvRlQTbPEFUbANXcg7iM3lvZOghOdFzCH6OR2+tjQQVOoGC1MGPOAwKLJdLcw Y6/v3ZYxziAhZCmZjRtB/nxnjPXEtL58cTC5NAtlyKcdUQ== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/586CF4580BFA49CD

http://decryptor.cc/586CF4580BFA49CD

Targets

    • Target

      dSNyAGjr.bat

    • Size

      194B

    • MD5

      3263a69061a96c5fcc6be2968f67726a

    • SHA1

      b4ec7fe9de7a5954dfc95d69feb5525fef517657

    • SHA256

      2d0029cb80898c2b7f7e5c03e6d8fd8f171ffa2ed431a0f02c94b0209d93c2a6

    • SHA512

      5c67bbd136b0c48fcfd51e402751e3564dc3b1ba4c713697af9c896c2d6c61a825c66196e5b3bbbec3b76617d31ff8652a82239e90c5df35c7b794297c4441e4

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Program crash

    • Discovering connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks