General

  • Target

    8PKf424V.bat

  • Size

    198B

  • Sample

    200422-ycbnv73xte

  • MD5

    24d6ca043665689608a14745e2f15c20

  • SHA1

    32b3a89c643355b33e87cd7317562ee28452825b

  • SHA256

    ce2c6c231bac94908f739317192888044654566c577b76b2287b361e959fe896

  • SHA512

    301d586cb10a5b2bfc352dc66320ca9d57e6e5d15905ffbc46da6599b8462b4b789050ff43ef9f6367e9104527b6624acbf22e3aae4bfbc3689b685a2e4e12f6

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/8PKf424V

Extracted

Path

C:\0l6s8-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 0l6s8. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/FEAA27A87679DBF4 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/FEAA27A87679DBF4 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: A3u1alSPc4LxlHfV10DnP6O/jNwK7FpLnYKJWMRNJOA5mvXaA9kYM+J2F4T9+G++ nB2GS7bUQRhWM6I9tlFeUWhqIBe6LYES/eHw4FOJSWNju/ghID/Tqe4SIHwxRzyt oREyx32XHokr8VbaDH2FecRFnaMzGH1f7uWtowQney1PvWECs8mtvzuunTyH7T0K g+SObrkBlMkYWiwkPFaGWeDLU5hAa8/5xdN8sWBIzlH6WceToy0nd21gNwZjB/Yx 37m6hMr1asnCV++mo7hdU3M6dU2okLoOXeAGHysMIhd+aY4ciw3uT74fomrqjvdA 67pRnineCD4QNvsS70lkB3SdlIbQXsNM4UY9m13YCMoesaQufd377Bqm1JayV2+q AO9h+eKmpCTRlPwNV+ImHrkyRL/GCGDrxXdnTdK8KL5n6QL2SJu79nG0NqqLCUgR sggnd5RXR8lPTSrr1OuuZHazfWyiziz95MvGc1QUO8U0/jgq8du6Xzi4z9jEqUks w8p0cms8tH2Dg8JmjsoK8Ety6kfC2Ik0G1I1SCfLrGGgA1p5M85RSn2D7NTW51yd 3SRkdykLPGCJEQoe7bvLH/py9C71sz1ZvtvPJOwF94hAG9NFiC2se2rymkmb/yhu eP18Z1JuJ5HmLaqPC9GmvF/1LrTn+ULj1IceIEATcwK8Gd51TVVvd62EglNRpF34 5xbAtqi6YNI1YULaF7/TENAv/+ky9ilhdgR79Oa6ncsVtHEg4cuzLsQPYQouXv6B HFjPiDE5F/9z/cCw+fniEzsP35g+JuFKzq05DfYA7EEJ8Q5HhRdomOFZQIz8z3pu fNDoFsrQcKWPNGiORLeyfmAzsOolaxZwAMiY8z9Ye4aO+GYz7Tu4LcI2juYvuXoq 2EBIaap8OhX2hOuu9bmZ2Z6nKFNhOenHPnm5+lKkiTZqNJxMUWYGSGUSJT22JHNh YU8uioXgPt8ntxoCKi8z6n+ZlBe6A+6oqOr4IxfISOKGgdjOXA0x4sQPkdboDybS 4zY8f7wN5dQGejD+l9N5RqXxy0SMBuDpa5vkC5ERIWz9v6gTyREPshvylGOvW4eW loQPEc2yxIUTQSRhe2Dye6FNbGsQQu/Ru885Rp6k13JZPm+bF+rse1CYNOdh7W/O R4rEpnxMXdsPw0cqEAUpQLiB0vlAba92G1VlGIyYpgoVP25/oJlRaV5zfUx6m052 cASgADBabLLuoNVVXTPQyiC6afrmvYiu0tzJW6Hc9ak8Wrman74TApZKzOkQ4WP9 i9p06551xx54dzSrjG/ZTi235tO1K4BdzXpJqHUv ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/FEAA27A87679DBF4

http://decryptor.cc/FEAA27A87679DBF4

Targets

    • Target

      8PKf424V.bat

    • Size

      198B

    • MD5

      24d6ca043665689608a14745e2f15c20

    • SHA1

      32b3a89c643355b33e87cd7317562ee28452825b

    • SHA256

      ce2c6c231bac94908f739317192888044654566c577b76b2287b361e959fe896

    • SHA512

      301d586cb10a5b2bfc352dc66320ca9d57e6e5d15905ffbc46da6599b8462b4b789050ff43ef9f6367e9104527b6624acbf22e3aae4bfbc3689b685a2e4e12f6

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks