General

  • Target

    qbrjGY3i.bat

  • Size

    198B

  • Sample

    200430-dm6y17pbpa

  • MD5

    cbbd8b182519724730053b25823337b8

  • SHA1

    627c36d0b7ab667bbcaced29b565bab53b874bbc

  • SHA256

    860285cbcff21687d85561abf924d2339f21a00b026da8a8798f6779f7ce70f9

  • SHA512

    2a3bf826ac1a0ce9365b4bf648e18f9cdf90c9e16b7b819c539be8b377df580960549037eb528c89ae9d102c829f4e574bd7d78ebc5f17ec112559242cab7049

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/qbrjGY3i

Extracted

Path

C:\f03ym-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension f03ym. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D456B4F343071455 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/D456B4F343071455 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 3Rrs54HMhS+0AOzHz8IzoxlS2EMRQvdNWV0ehBCniRlmOJ8vtNcD0jqHPwz+V4xm f4Gu26CrShkMVYawAdbK0mbGWg5IDNETh+6L/9/Q49fno6wxRMo4vP85Q9gRJPTr teNH+HVLZqC/45vsJo+jH6TfbvB9eaAkhgBBHTd5BE25baIC/8vyrrqV/HzStkPQ XIs3uOrOfEk1h2I0qAEGxQ/nm0RQtYprGHWUYb4QntGiea1Ha8LDAviqOmJWCoNn eEb0YIasiS+1aFsm/OprNH9W1adxwH28NyMlHOoG2s2x13fyF80NowEFGC7cXHfd jVMi5rTit24jQpE4/UnhOZdU3avXAgM22BmMn4yvUq0bZO5pZpvZrRCsFHx027pi pjTdEJ9yx8jtNdujoGbLUl5hrofoQIbyjPFbYz7mQpMqfAcz/lraRXaZHxLe/cfB w0N7YB1i/BRP2SJUIMoGgbRlJu5ugbh82jen9JUws/73omNf/FN3ASrVMu0NB9W1 o0L+SUdm1/TAq4YDZYO7h3j2T8YmT2XY8+dXzdlmQnu5P8I691ztryk22etrehgR VQzlHYGQZWoUvzgUp8Vq8AKBd1Y2CpQFH//FbjAtEsS2fWfFOx7Fo3sPt/97oA1f e57wSt5cuKQctRSYj+UWy1JOzK1sVuvypAqJrdfl/V2BL6qSFNY66sGB2H9zeXMM C2huwdg2dm5qwgYBdcdVxIqUFD9bnpKOLFM3H3RrYEtfMPE175qv3kynGsE/Uzgd 0I4B0Vsg2Wu5tlDy6OOt4v6xIVFt2f8xRcxTZar8xTEALervDcInnZiyCKn0e3LG P8EOUbmSuAtW9n+oHEYhb8XQD6lOhRuD6JR6V1oDUoqVtmCc7cSp41Y0WQJm10yd 2pY5gd5+/OFnidXYGPIQZrfArHs3kIvjevlLmRf8MxgF1TmbTIG/aZyGKEYdYBN8 XqCeIKW/GlQDflUxZzx2pM71Tcc2x+pP1Js3SfETBzxZPfdi5IAzGSoHy0vxxCiH jwX0g1lwG0V6z6sx+FSduqJcA5zkzdf86+UC0jVPoGtEl97kwkTGRB5XrOUEA4hO 0eWhgFTMryFIxo+Bn7MFtq7iSbuhhLhz4NNZ97etUXRI6I/tTJT0VbiLYO50Fel7 kSAB5ctqBZzrAuOs5hbKek9SQynEXiKppoGkfmvVnOQmdLFQFtRdiGKKpfHGCSSq 9L7CQ8dcduGoiPftDCHv2ReXEhcX3mXO2hhVieXgQwLCigc9sHRIJMCjEg38julk iaYEs3HsIFxAXPCC/w6r9rX2AlhylMxP7UX81yQu ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D456B4F343071455

http://decryptor.cc/D456B4F343071455

Targets

    • Target

      qbrjGY3i.bat

    • Size

      198B

    • MD5

      cbbd8b182519724730053b25823337b8

    • SHA1

      627c36d0b7ab667bbcaced29b565bab53b874bbc

    • SHA256

      860285cbcff21687d85561abf924d2339f21a00b026da8a8798f6779f7ce70f9

    • SHA512

      2a3bf826ac1a0ce9365b4bf648e18f9cdf90c9e16b7b819c539be8b377df580960549037eb528c89ae9d102c829f4e574bd7d78ebc5f17ec112559242cab7049

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks