General

  • Target

    ugeUxUR2.bat

  • Size

    192B

  • Sample

    200419-qysg9t61bn

  • MD5

    b32a8a9b873bddb42382092e73e27ef6

  • SHA1

    b539fa06c5d88d392f9740b248b692cd129f46d6

  • SHA256

    05633aab23dbf5e891b0ab97f4a85b00be890dd17a96ed1a7caed9ebbbd27f04

  • SHA512

    62730a9ccfdf743b9b49e413d57e1fdd4edfe875070d11a5e5688be94e6dad964ef7f83e25fcaa1c39ffdee783ad49dcf7e53aa5eca300175ef2e32316413dbc

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/ugeUxUR2

Extracted

Path

C:\35k679233-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 35k679233. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0880BDF2560BC8CF 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/0880BDF2560BC8CF Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: xGQYQftfYb99JXTE4HvH6yXJyKD+NP4dvYTaqvugJUrVB4MxC3MRBfTJXN6TY4GH OwhMLjnsesbduY76qcTEjvdSkbjj/ryxNEoj0W+i9cH+vZnVt1Msbac4N9kcANMu sX8LkKy1LYradILDnA8trDjb/InyIGJWlodR5Z6d+Xqc9mFDNn5M85KJxHSYgo4g OGkhlUf9NhiMsF3BFNgD1VomP1PPAiFSVFxH8TwEz5Kw0Zj9rdz/Ojbr6RT2qcVd D9ktPg2QBb+MOX9dC52eva9RXQIyhPxKHD3/5Xe2FejVQ6r8bo8hsrn2lN+HN/SY DyraMJWTj/6GwctmZfUDGqd52RtuT6qzmw4iMFiuF3+PbK9OceHFvxqJ7folLyko +xXkmCaX4x6BuA2qmV+8Wfh5JrkonRP6MIY/ioLml3ixftp62dRVSAy9YWjl4EzH qH9gd7clKYPFc/rf2Q3H7crhv6a66dBS1/+E1ECzRz+G2jxHZI/otRGdzUYZEKM0 5pG1sB2B/yvjH4TNFWMDZ4ZQtFi0NSR6OYa36KpxQJ+zuBQNeuxx2J+AABIw71rA 89p2s8T2tCE7s+pt422T3enHcg8h4D5Wd9SjnW3CuN4XRJ8mOKBUpPFl1z9GiO8e KktiPfk6v3HfB4cx09N2jLXsHWG6pATHtctdECRgFPr6qqGio9HHPOUa+l3fENMf cPHam9SfmW4bkwJdoCEsBMy2/3DpNjI8o63GHXUQaDvXfaRDxBMiggFg49IcmsUU nN+CgzFw54Lm5V6uVW/56KkODi/SFNzAkpeeAcEg5UsU7oH5ws2kDngLDO3QW/x/ swC/uf1sdL9ChfjeH2Msl7lwPAi4oqEUoldBiSotSU3NmC7QT0PHFD75hhuSV9tj u3ZjyKMwmBVQ93Cgy99Bwvh/cSFw8vsjyx3TD5WY2i/jK2gUfOJhIWtnLp+oXrc1 YRm3OiZBKVEOXWkaMGsfUfd/R19/qacNhYZStft0/IsfPX/QZoIt7hd07s8ZSsGM GOlDqAFkEgYnjgMLHaEfGexB2wgmUQjIDCORWPFgY8i0kVL4vcswvkeOK36cEgLJ mOdgbFfh4oEigaY4UuK8qufWK7dgTk54jX+MxK3H6LaCfS6rl80x0lmivNQ5hCkd mwpTjCP1u6aoh6X0WA3FKWogJM3d7iSFcVojGP7jPMtcoTMp0ZH7PidtHp/qXFIg fZe1ZQp9VK+NDnzeqqqvPdv5SXLpVsHCGpOVvL2zYK4aTp14UfkU+IiqRXFOgr4w x+cqNQ167JkPdX2LjPOwRY4R+H3LXOQVHnovyFnxC9g7ov6KyUE= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0880BDF2560BC8CF

http://decryptor.cc/0880BDF2560BC8CF

Targets

    • Target

      ugeUxUR2.bat

    • Size

      192B

    • MD5

      b32a8a9b873bddb42382092e73e27ef6

    • SHA1

      b539fa06c5d88d392f9740b248b692cd129f46d6

    • SHA256

      05633aab23dbf5e891b0ab97f4a85b00be890dd17a96ed1a7caed9ebbbd27f04

    • SHA512

      62730a9ccfdf743b9b49e413d57e1fdd4edfe875070d11a5e5688be94e6dad964ef7f83e25fcaa1c39ffdee783ad49dcf7e53aa5eca300175ef2e32316413dbc

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks