General

  • Target

    4tM71hqZ.bat

  • Size

    198B

  • Sample

    200501-2gph733pdx

  • MD5

    b883baec628ab0b3bae209a8d1d0a339

  • SHA1

    79bbacc2b6ed81d4146b58f8a100fb83acba1e0c

  • SHA256

    4c2d46061923d9aec3c2a9788f4c17d1815adf849edfe6acc0a0343a5484b752

  • SHA512

    17cdc7879abe666c1893a5cf17d63ae9d22804a76c2d11a623a68118ac2ef0043c40ae6c2a8c558161bd180ab1d4bcd38342a88ae319fd57ecb7daf7b50d2735

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/4tM71hqZ

Extracted

Path

C:\39p89ngw-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 39p89ngw. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D8BD55EFC979DC01 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/D8BD55EFC979DC01 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: vReagcBfaAuMTWxZcnOF3xDGqU4yuwVq/iOpiy7GjfSRoiWvi+/POEhS1hsEjxz8 k7bQgTwvnqs3/d/C1LJb+iAWQOagoKZhF257nPYvMXoOU/5Ieuy6qvqoW/i2ofDf 8vDp9bUqH9WeNJwAsoMPiotg5JSjiPI+xXzJEtMQKHN9LvWBr4OKjmmwW/mLSBoA x2Y5zNOKYdXiubc0T02IrdL4ZcsuJ5kmxQ36d7pRBLmmMQEvLfo7NGn8YoyPPsyS +xt8GFX6eF+MXlVQh9+x7KBKwhYxkeauTAhh0DTenwOfQgoXYlp8H2gbskgj3/v2 Pzvv4PUofguoMVQHqGByH1JrSWYEaFpGgfQYu3gJ5Regb7mF+9aScbgBphqV0/CF NJuUktzOr5pbqsK9SvqPskSrTSUvQWtsdU0gPhWvUurPxISHLDnI3+Awh0+h0nba vXFeJzxvdvnVc4FH7nykuPyO/4qtTWPAO3AQYOGG2EfkGt5B20khOd9BiWubg8tL FhBHhuW2TKbhjrB+AKLV+tpcSPvJFvEpX0UNhgriyCCWT7tuQN5JUPGdc5h6N9Jj FKOV66kPdhvSCJzyRgA7WwwgLbx33HDiBJifzMhDpIyfyFC6QapPczNeOD13pI9N fhZISiGQ51bCyL1PEbeSk7cX0fZg6q0YLr85DqqR75K7ZohKWVq4ybrYJPJhM++e Twlvl5OMQFlOUpzisPbqaN0wMwfHy3Hn1hAkjJwyZB+ZtW7VcVHxih+1KmH4SKxE SSvlMJkJ4BSeyxW77pSkhYsplv4jRTi9xvtqH52zrQ6ijGLWPMZ5RMhXsGzaNOMV Ag4+umWKUad1B5vYJEcF97F5HD72TMEvm8drSjQYUG8aTbTwvKaGimALkfMqNAoL vHaTxZONvpWE+yh9/leCp0aprh4UElUcI1m1Qs6AbAGSw+Z7w9DZzkrlzUxmItKX ZfBUZDCt24zSMXxltczVE1o9r8wBooqwOeYbVqLOHnMhlHP4RVdGtOXKfBt8e8nT 7uKaq96JdbacpSiM1NoxgDxa3dk7iT2iDd82s7KUgA2i42FJLadkwkIcjifo9jlA qqS4DixK01anAYnWhErrOdqBSF6yRZhQm3vM30F53fHSGcXLV9xgMDyYIpPsiI/6 mRwW8xh/PwsZE4KqYGlUBVF6fXs+0pFiff30urKeqJoR0Ljbcil/0BlTp/EW7gv3 xiI1/QuI/uMtUSpcFMz2CL3EfhTDiWk4Q9CxXkOH9JCAKVoGDbQTO5SCKGduMLXc cBje0MshhL6QXd/zpnGqLAHRZVRd8yAwi5VqtjBgr/LG1Acr ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D8BD55EFC979DC01

http://decryptor.cc/D8BD55EFC979DC01

Targets

    • Target

      4tM71hqZ.bat

    • Size

      198B

    • MD5

      b883baec628ab0b3bae209a8d1d0a339

    • SHA1

      79bbacc2b6ed81d4146b58f8a100fb83acba1e0c

    • SHA256

      4c2d46061923d9aec3c2a9788f4c17d1815adf849edfe6acc0a0343a5484b752

    • SHA512

      17cdc7879abe666c1893a5cf17d63ae9d22804a76c2d11a623a68118ac2ef0043c40ae6c2a8c558161bd180ab1d4bcd38342a88ae319fd57ecb7daf7b50d2735

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Enumerates connected drives

    • Modifies system certificate store

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks