General

  • Target

    Cjbh0M3S.bat

  • Size

    193B

  • Sample

    200430-mey4hts1zj

  • MD5

    5d7075d9a1018ed0ee80c0e92c3626cb

  • SHA1

    b3ca818f726d96177859eb15d4871525383594bb

  • SHA256

    44fb52f56f3b557e8fd8346ecc5536ca63a3c88eac2ce4549565d9501795c91a

  • SHA512

    bdd921b5de3eb45836fc4fc1cbb0efdec848a049c3d47d7646ed55927f7ac838480b266d5f361b1d0f99c530dffc4ba45e4962901a30432f1f8c1777bb9ac96c

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/Cjbh0M3S

Extracted

Path

C:\a21g6-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension a21g6. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/43AE3FBA7B121249 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/43AE3FBA7B121249 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: pAjUxta9FOc9MkuITsCyxpWpKMSSOSvFBgJ72vXri8KvV9hz7MjQ/jylAId2tV23 bynMtWmVtpGLsTyru2wNClYP3nitqqagCu3Cl7vsdSU4h5J+EFBaZWht1pHXFpdz AWTw8qT7/5RhvjOam2r7uj0efVhoR+j4TfFF0Jp+B7bk5o9Yj6Fy0Ogl+/QFb+pc N7uVXJTr1/Y3njN7TwaRb5d9eNRVX1lMj+T7v0ddQT0BjkaFYzkI08GJC3+3aRfY ml0L1R7e1nSzUYBEEfXepAteyTfzpYNvwZHpZgC1ZC9bAMgukAoD7VsAc7Qa0UpW a2KqZvcBGecw0c2OHcojJiGBEU2PuCn6cA4fmzLEzkEGSgISpGnWd4VlqDRYJdM7 gcpAb+pOY6hE1yDx3tmoB+UMmeU0Z2+FAAa6elgMYIa9eeU8DRXn8sBdTiLgTgQT RZ8TCIgeXMoxAxk/neoPqGWdi7B/bM2GB1rB5dY/cPfLPwRyqDRa6tlWph1afBDc p9mgNrNFOncmUYkKqlNgrMLDh/W9wSyuQuONZP2oBaEpskR4K8icB8h9AMPbsH5o 4k9OV1tvlxLXqKEkCG8X73/p7vqQOmSXPyeAj0jrK9gusqbnMn9uky8S0NKJlw+t qXNjHMN03huWWPeQ5EjYEBz/CAteIWaON5mXl3vBUoLK32X7nMp0tGBqxkkidZ5h 1YywwfwIK6Sd7Ijw4h4EedShgTLQmNP6nE2UjlEYfXtU3zm+qxz4Zavws5tl2Vnr 8qUGmBZcKDZIWvc0BYJItHJSXI3a7pNQf52w3gs5r45YA+5dMcBW6nCPmIiIN0U7 E4EVO/g8ISuU8PT4yHZXuFTKxitBg85Yv/xZZKPuyWibdi6J/NJxfxgNUz5Ivw+g pUKkX5uGhIAUz3hte1K3x7eKygvw2i6BHncSF8MpAXQgaDT6SDN7Drayf/u+waT7 D7BJCJ38X6NvZms5ILLqU4ERTZFttW5Jwtx8r7gKEtYr3uRVCCfMrMkDEw1zsVfi 4CnFrkmijTl9PjlRtPqrhWAU3IZaFGWU7YjDy8N3bFPFUZrCK8Bd3zLNEzVVQoQm HToi8ii6rkSe8yv2ZPpHDG5/0RZ9iPOtwmCkEjV0pXNqAjz3Q/1y8bbPNjHSwN3z rNkLWHJx6PzZJrx1gABVfAr3/bW9RsAuL6/N95F+YVEWJJubX99p/rHfP2/M/U/g JPDHL5ZSRIC6smbaZESvfQQn2vwmE1pvPIi71VqXiwbh22LU00WhuTQKaPSVyFBr J87chC0UkXibWoi93hlKP31+NeMyyIsk46p78uzh ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/43AE3FBA7B121249

http://decryptor.cc/43AE3FBA7B121249

Targets

    • Target

      Cjbh0M3S.bat

    • Size

      193B

    • MD5

      5d7075d9a1018ed0ee80c0e92c3626cb

    • SHA1

      b3ca818f726d96177859eb15d4871525383594bb

    • SHA256

      44fb52f56f3b557e8fd8346ecc5536ca63a3c88eac2ce4549565d9501795c91a

    • SHA512

      bdd921b5de3eb45836fc4fc1cbb0efdec848a049c3d47d7646ed55927f7ac838480b266d5f361b1d0f99c530dffc4ba45e4962901a30432f1f8c1777bb9ac96c

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks