General

  • Target

    xKjRCNKk.bat

  • Size

    191B

  • Sample

    200422-3533jlnkgn

  • MD5

    4fcc8ad649697f1f1dc32ca5b7869546

  • SHA1

    9b8655873f6850535ff1809a50c285b2a0a83a92

  • SHA256

    ffa870123e678c181157b41e18ef4d46d9e7bcc79f8bac7cf24252a119d3a9b0

  • SHA512

    7a33e722594d66080716fd63e156626a11b0d3828f7aa8ff029a5b4eb2015a1c47290a422570f6e877d441573b698411a8e5c9a0cc7386bde7395631e74959f9

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/xKjRCNKk

Extracted

Path

C:\6q0m0-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 6q0m0. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CDBCB760FC91223C 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/CDBCB760FC91223C Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: qkSHfJkENJlp+pxUgu5HGTRW+2J9HiR6dPsq3nVDGgRUbgNlAJBYnsO1QZBqdMJK IQH4AqUeXk1qhnHSfjg5wKU9KD5r2JaJkXquBlpb1K3MEy7HJXADEHFXUhypaDje h7PWyCrgL/baT1/N8LHDzDwj8jAA+UgDTe74DB0dCngXl+zYc65/QNttAzaE1Pg8 tnIa/SdgTjihUS1Z+QqKshisLRYLU/4u3LeLc4klSEe5UJBonro+LgxI7daKF3mC eyLCa8354L0SH7qaA8ReEOiKOmaPkuTeJzSeKDxrkJlw4jIOxA2kOK7Oa6O3VnRW BL3lVVUCXt6NK8rzk9TlMDoBXYpLCfNEqvjaC6IySL6Pza7gRlb3V1jrQWKcmbTf 2Kiwk6S9LES8W6z1HSwCAPwtkHbo0I8rGnU9cKzVgU3ZVJ5mg9J61nkXi6zN8Zgu gEBAF11r0qQ3FaiqdcqhJjOTlajqeVMqQFFxkNcQuN6oUVFrQQWOg9URwOZgRcVz lMMS1BCVoRH/Xtvcll6RnLN9YvBJClhSNLXk9pRL/0LicSFMYfrzZl8XjRJAKVHG M+FNNCh4p+AlK/LbsibDS915uLvL3vPG6crCpucxAPS2tK4bD7650YlMg7pMdx7p B+QEoKrsPj/O4lMKzClwtnIs2qyVpIxNjAuGrrWsSWdDo4ctB8LGhye6GRM32EDX WurR5st3o2WhlSp00aqb/j+7NLHbITR86AOqsTTPfKFP/Dgzhr/L0E83rK6z4N2d 1idwDhDXAy/YUUCKqIflv97aHI06nFuhRXlkoyZEDFkkAdXflF1uBuw1B9ivJRI0 Y/zFOAniK7O37WO7xeQxGOB4MwnDeQYn107H8hcre0zKy8gcp5pl4Abg65CzIvHN euE5xnZrBZ42sNaI5DxlZpCZJx55h1ebnOg/HhU6hnAwo0RVVPjtzmOT8TwHF7UE n56qaJgA3Bm+whJca02zMRgvo3LLBwOPzTHfDG9oe8FdF/+qy2Z9P8ns/DEDnttS cIAGyOsMMt8MeCqfSv22U76aOHhq3Exd5eR6ioHwK8TMcI738bid2LOSkjcKXclf NtxKZaZe90AEH79F1lvKmhathB87+tF387Yq1bGUm+Rv2ePEPdO9w+9qubB+ITGk +K/z+jIQ+wjVIePRRE/wfTNLotwTqbWNqQsaXUskCLwT2jxzCL+Q7j0M5q9oUGjl qhPVofbeHwAbZ/2Hs5Bw2Ec5XPQIGXtfFlII0rzSbrR++UnSGbZkQ2dkvUupaGVP yzXj7TP3pwhVDZIjy4cw1C9e0iw9saQ/hQTTTqO6 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CDBCB760FC91223C

http://decryptor.cc/CDBCB760FC91223C

Targets

    • Target

      xKjRCNKk.bat

    • Size

      191B

    • MD5

      4fcc8ad649697f1f1dc32ca5b7869546

    • SHA1

      9b8655873f6850535ff1809a50c285b2a0a83a92

    • SHA256

      ffa870123e678c181157b41e18ef4d46d9e7bcc79f8bac7cf24252a119d3a9b0

    • SHA512

      7a33e722594d66080716fd63e156626a11b0d3828f7aa8ff029a5b4eb2015a1c47290a422570f6e877d441573b698411a8e5c9a0cc7386bde7395631e74959f9

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks