General

  • Target

    wirUgNPj.bat

  • Size

    191B

  • Sample

    200422-e86sp37l9j

  • MD5

    f7a60a2d1640b6b0f51659b777c8ebef

  • SHA1

    e403d248ae0737522b78958e25288031339e47a8

  • SHA256

    9201c9eb223cfc445263367ec2c92319496cee67f257701ba6658934c70fc0d9

  • SHA512

    c03dae3ee619d5f571445e25a06caa2e418357cf54bee48a801a227c9df24121cedead8ff9e32836f5f38195dfb4e2da64310ef61b3fe992edeb6e9139f7438d

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/wirUgNPj

Extracted

Path

C:\c252lj7xk-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension c252lj7xk. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/36763A1B6DFEB689 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/36763A1B6DFEB689 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 3Fm7R0fQ5c18wwJwJ82zGrAnTsyYX9pehNMM3Ks7M+zlrZJXjAlsH6FCQVQ6vYm8 9a1unPzK4DCl+pc1NqaUxECtCA0mx22rIXYj3FF1LHHf+LMGPRSbwTEzP86uf52U wFrM+LjC+i/JN8I2BOAlNRrifgV+zZZXjnIA43Byv4kmK1cVE6QA7VEuRcj8D3ty dHgfayYkvo/FoBw/m0ecxkgd0ACEz3bG+dqk8KiEZlJydJpQ66c/XohMl44+ec1p xxmsQr9MdRdBgqT1CPFZhBBUNDjCFSnHKJmnhCPJe8n1eARIXZkhl+hthR42zv3y bJ/k1vc9lqDeeMiimW9PeIEllLPwEQlJUr7mtfZ83/E3ZMKez2pC7waNL4yjNeK7 D3/EcZEuGwdQs0e/mjYgGX1FpXDD3j71trQAwbAShh+cEKGOh3niMDIvMj7lbRMx OQbNJFvKfz1GnuI5mRqb1i7dc1av0ULDPza/pTWQ1o3rydthS4z9uR2srlKAw085 sPd+S8cWju366v/W8MCRg6g11i1a88C6DA54NLNskvqDZIarlgVH20VRuIdTFCK0 HwbyjmMUTfPrhg90oyilMciQgy/p90OUGHYq4fWlT8/L+O4FjruqN5Z3b4DBd9LO 5RdnkUPrUUUJvYoDkgm9qvwBNoITEFvYscZmQBg7aVKT0GhtXk635hNDt31pEWXQ BcJEaZR1fZWqhe2ljcMfZpn2hQ3+wEcMuxJoskV6nJ3JlrvqSFCn468YSR6r4uFi uBhRMdsochSFEWWiPiCTKTDyTZbzWg4Z0nFluuvvJCsU2R9b33vC/y2xvH3nWU84 4SD8eQxvwcMMJFXLERC3sF//qCBLu+W0AA23BuvsIhRZ7muJeW64/PJTA0npZuZm ohW0JndYBqFjCGOP4ChHV36Fke/8rhJvyne8GgjbHMVkrzsLuDTUtiEy+9xL0dvY ORbiObdvR7Y4BiO+SeJhkSYi/cLvRllG2fwVJJt01aNjl2nBEYTLrg9be2gymc4R LcqeWypU2NMLxRUBskHEOmRZ6elyL8qVNiM18l3DHwwh/mbKpjLfUvm7dx+Yo0Q8 77aRDultW1fMSHH03WLhDuPRVT8o6HE37jqFVdwCaMX0tevMElfMznUzZ9P1mY/f WTwXQp3BmzW8UiigxFF9zJ/cubIcPUBbX6DOGbZyeHg6OHBA5c5EDWerxvwSH4MP 0TW1CHoFpD+MDWJvk6g4Wz0onoa1a/6PAsWd0cQBCkAXyCq6I6oOk4AVOJmmmawD S8LSf+c0lvFNl+EgeUFEr413vZppHzN47+wWhU2IT0o7Un0aBos= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/36763A1B6DFEB689

http://decryptor.cc/36763A1B6DFEB689

Targets

    • Target

      wirUgNPj.bat

    • Size

      191B

    • MD5

      f7a60a2d1640b6b0f51659b777c8ebef

    • SHA1

      e403d248ae0737522b78958e25288031339e47a8

    • SHA256

      9201c9eb223cfc445263367ec2c92319496cee67f257701ba6658934c70fc0d9

    • SHA512

      c03dae3ee619d5f571445e25a06caa2e418357cf54bee48a801a227c9df24121cedead8ff9e32836f5f38195dfb4e2da64310ef61b3fe992edeb6e9139f7438d

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks