General

  • Target

    RMZ0Lp3a.bat

  • Size

    189B

  • Sample

    200401-mtve3kqkne

  • MD5

    90218b146362ab63d589252e71438a02

  • SHA1

    dc39398af964a74d66f9c56b7fca4e744aa358e5

  • SHA256

    c143487b82fdc527a3a7f896b0afc37ee38a0f571f200f7d09fc1c01f39acaf6

  • SHA512

    67f13a2db6187c3a7b9647006fd3dd3730b38b09afd47f534905d0ece9aef341f0c1d9374e6a6ef435eac21450c0837dc24fd8a30b68a3b90018ad30e060c4bc

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/RMZ0Lp3a

Extracted

Path

C:\37s8fhpyv7-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your network has been penetrated. Your files are encrypted with strong military algorithm, and currently unavailable. You can check it: all files on your system has extension 37s8fhpyv7. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). Also, all your business info copyed to our servers. Personal data of your clients and business contacts extracted. if you do not take action to contact us, the data will be published and transmitted to reporters. It can also cause GDPR compilance. “Article 32, (1) – c states that “The controller and the processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident.” It can hurt organizations where it matters most – Penalties can be as high as € 20M or 4% of annual revenues, not to mention the negative public relations fallout. As soon as we receive the payment, all data will be deleted from our servers. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/463FC69F420DDAFE 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/463FC69F420DDAFE Contact with us in chat on website. You have 3 days. If you need more time to make a decision and collect money for payment - inform the support chat about this. [+] How will the decryption process proceed after payment? [+] After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: I9L2yGi8YqvoetrqGQ6jLvIxqTcPRcwzX/f2CmrM8YNfbco5Ciab5kFzmdtUcffi 8EMQ2j8CrteYr9masnxFhNg1xEa+qrb0+hBgmTe6ZivALNJ50nvYYyJk9V8jrja1 R8RDv5/oaIK0Z0+g6qUW1lH/Yn6a8AS0ji5HkDPWBImaZREtC7mgBp/1vlSq8S4K 1tjeFcYHlXjRucUWv0usoMj1t5FcOHI82lBCggHTVBtrwNfOW3HYdvb3OpFicWDX 9Cw7AH02huaXuZxp5NfHvuHeFeMzGZN8c5G1DpcWdZ4fh0VsPh1uaFtwczBIHuJD DCmW1W5ievbkGhlYxwBEAQk0Lw3lcXS+SxaMj2aSwwrsKginvSkz+340FjivtM+V 5uSu/pkIGjU00wsrSosysTPXWNpwjnDwzhrXD3BNDmKKjpta04fnvlJcb0fcmSUP oX0Vvz3xrCROmN507Y0ACwfjv5WQpCTu4bASudGSy1xS+MFupWv7gSV0CejCXoFl 9ydwwE0xxsX9HhsBkjt/gsgwLi765paqSOz6Ub/oBgjp41yx5znkzFSr0+IFWIW6 V+AklwuZxUgI25keA+Fu2q/wMRX36CmodFeDlv41paokzFAipu8ZH8Vg16hwyL5p KeRyC5LO0Hvr1Hxgbrlr2yHhhDWIfSZ34xPh5mAa4yEusgr1SEwmtQny/lDS8GjV pKko7E3pmI6I/KGUiUPnnPKvB4aVkANBuNKN9a2QOn8ZyreaDbt7bdyDarhIT8qz yxD2KpfNKWdu3it4i/fM6lG8FkS3XNakmH2ClLbrkObAC2qISfgVmhdS4FUwco33 nde1PjlHDk9uD6sw3WX0gED1BbZZTjgjdpRAAi9elnJfX1I44TuR+bhDa+3UFlgX vmdcO2/5kNztvUUYmO8E8wmWBL1w4L7hxpx0WXj/q6OeOCTUpwRbWBTHA2uwL2UR 1Wqjp+csdZ3e/ZnDoig6124+MF7lDCYaW9o556ymdL748Wr4SGQfHniNCYil2Qfa E6ju9j1veuX/CpaWOYdXXdrR6xt3qJzl5nJKg9opHdO3GU9ZaKEXBJjgFQYSzAG1 hLQ5UdDI/76JjM8GjXFMnaO92hyvHiUIr2w6XbSGqM0AWghQ1MAr8uJUB+NzrqiM 1yWdOORE8j5i9NyCz9ilBrEW2jE8z7Q/dZ01Z8z1DbkwrY9Lml0tf/KM5mHeaxe5 FNJyjlyGFoz/EbBHiCjzfhcQ4Z1qEQJtAA0LZ5HJckzaFb6Ap5u24PbM0034ReBK j3tqvJ7ZmKZcKkbU5ijr1TRxdwz6Ha50EVZhlq00ZDyDCMbhnCygGw== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/463FC69F420DDAFE

http://decryptor.cc/463FC69F420DDAFE

Targets

    • Target

      RMZ0Lp3a.bat

    • Size

      189B

    • MD5

      90218b146362ab63d589252e71438a02

    • SHA1

      dc39398af964a74d66f9c56b7fca4e744aa358e5

    • SHA256

      c143487b82fdc527a3a7f896b0afc37ee38a0f571f200f7d09fc1c01f39acaf6

    • SHA512

      67f13a2db6187c3a7b9647006fd3dd3730b38b09afd47f534905d0ece9aef341f0c1d9374e6a6ef435eac21450c0837dc24fd8a30b68a3b90018ad30e060c4bc

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Program crash

    • Discovering connected drives

    • Modifies system certificate store

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks