General

  • Target

    mUNetnda.bat

  • Size

    190B

  • Sample

    200401-v44hyvqg1e

  • MD5

    8d47ed92c538cfd43a00b6489d8b4af4

  • SHA1

    f5b96923c6ba26d2cc1b8d7931c713ced4c9a8b3

  • SHA256

    fdb71ddc395ffaf887e8f74472c3d02d098a948b96eb4a022f8ab36d3232a507

  • SHA512

    18a320853db978eae913be9170806265455a882d72f2a853d4747623a6940240824c3ed952457fea512ec6d9ef3f7fd2b2f790dccf904c205594cf2e06eb4586

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/mUNetnda

Extracted

Path

C:\y36kj7e8g6-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension y36kj7e8g6. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/1362AA18C9D26876 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/1362AA18C9D26876 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: VK/7/30ajcsn0qq+jfO/M95Spbic+H94G0XCofCREXSb4CS6eUY4116iFy36p2ok YEWrD0RGqO5DyocUblmYLvKq4U6a8MA0U4r6JafbIojexaRZxbEikU6K4M+YYBPf qvKhV5Bk8lAv1YdhBx+cF59mS3ESthJsOTGR6IHM7p4lSEpu4kDx62z51kqM64ao Psh2dENVJ0pnkMmMVEm67RMPJmxWnSffgBhbbKGbS6fUi5isUuEo8oYzg3otOzGz lUXQKl2D338mz5cjaHIkNJyZt0MeL9spVLbT0QW93tPskjnwxnBIoKPlprGGQ4pm Le8kUonVjTlpKfC17s/wZ0TvP6roqAAiZRp5Wkh0gi/QvXn/J+j4CXrLnwMYPmAH H9eubKxheh0uOx3cwjhC8NWlyzARO1iyC2wHC6Boc1N97lVW96BvsgvQ+8v2DOn7 x81tLba4fQ91uMdW7HO32fCPLcjPA2JXjmyDaASFL6QPOXoaIhS4AXb8bYClwHDA mOfkBDdTTJ4biEp1d+HrrYdl1n5JznP68oxTfL3kRkM70qi662+zIbDYBwrE9Mff zxFizdfw1N8M5fZo6qAe6VeUKsgcw1osnxj5x2d2LQgNEKm0BIePqRlGT1gZgAwz 7cEtTCOUsjpV/N8nG+wts3cwZtBDr3NhnBo3wuIMna13wgWGsnyhvigw6oByqfNJ pEK7JOoKgeNOQDhp7wCNASeavBxD8NZcsd+q+0tl4gK3aK4ZGMZ5BtETqQIg2Ekg 83GzEBoKvYuXTWXFKM9UysLBE6OE21tHgCMPtiljlHm9+18TO2mCp9VFjmFswcd1 pYUt2WbWn7NBA9O6EVgR+P60qZnkVVZNK+Nr4GV0Kr+BLTwpKMxSnzocB3sTiQ8v oSnbS68BJtZsV1+yNljupMkX6Ufc0a+gClfRxPMVew4EnoNA+6siIqlpyDfzD88W A3dtBytf8fPGWyzbl9VJ5odQTnl4v2xJxKs+wDkGh+uOhJXvyCiG5Os5Us61z4If XzGgTp+Mcai7tH4O23Ov5uS0KQg0NtAMQswtcAZfUpy2tsRCyNmylOmXRRRujjHy zpJq2BGaqttvM+wHhF3sUVxcvZSVWalWAnApB+6mbG8fN9HhVf7QDzHmDXi39w4n JrQv3xJFl56CWYD+E5qkHg12tWBxaloTAtYv4fmEsRQ+LTffjTWeddvWWxPAWRW0 uK6b4EIZ1RLRpTGtmMtGXdYgPaWFZ0q2Ee5FnEF6NfPvboUchsj+n+M39X+PWlJf ue0lRbHL3yk4Eeh/3GpllTG1YxVxM3BCP6tpv5U4Mwv9bt91i7/wNQ== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/1362AA18C9D26876

http://decryptor.cc/1362AA18C9D26876

Targets

    • Target

      mUNetnda.bat

    • Size

      190B

    • MD5

      8d47ed92c538cfd43a00b6489d8b4af4

    • SHA1

      f5b96923c6ba26d2cc1b8d7931c713ced4c9a8b3

    • SHA256

      fdb71ddc395ffaf887e8f74472c3d02d098a948b96eb4a022f8ab36d3232a507

    • SHA512

      18a320853db978eae913be9170806265455a882d72f2a853d4747623a6940240824c3ed952457fea512ec6d9ef3f7fd2b2f790dccf904c205594cf2e06eb4586

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Program crash

    • Discovering connected drives

    • Modifies system certificate store

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks