General

  • Target

    U00vnQbF.bat

  • Size

    191B

  • Sample

    200501-e1cgnnp89a

  • MD5

    2300705e455665cbeb1087bfc25c672c

  • SHA1

    737493862ea5a0c4de10f4e2fda82000c45e8779

  • SHA256

    adba07f4a5d9a769b00d436a0e7c89777664b8cc17bd2515e951572fff8a634f

  • SHA512

    26864b6c938379a876018ffcb1c927ff9806cb5fdc93d2088cf59ef3b7487bf81952c9e843d9ae1b3f827f3ba43dc7acf4b2a974e9bbfc709d58215982399911

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/U00vnQbF

Extracted

Path

C:\28b86t67-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 28b86t67. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5C323C8674D79305 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/5C323C8674D79305 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: SfJ7kCusOBkDj0kVxJH+L8OrYinqSu+vbJ192but0zH4X/mmEwqxCNXOG8y/lerQ ghzSxw/CY7EVvIvWhZd3zCONxKIf3YQmFI6x4tlLIEBPigHmQ8BpqPGqVadJmbnA l5/BH7H63T95nsCEmJpB6/3OHzmGciaIhAI8G1rJecTsI0QNBYrwEZ/2SqZ7cXef LRReJJx3u8KIUGjfhjGf4rjV4Il1zmggTXSBAnJ7jcfHBRFHVO4d51hVLQfg0Gq/ LbPdPaAngjr5c7GdICB07qrqy7xwu25EazPXsfHvcowIxja1vdrqsBrHdRvc6S6f yTjsaeVkNwK+GGyAoBMXqjbSEV4sWfb2WeBwtnU/oGlfrs5p7GzqLGvlwhpsV10e IWZGPziIA5O46p25uSX3Y28AMIFeMQ/E04MRQHhhv7R950CG9FVb3JMxPMARHbf6 233hHe0gbSg4ltn8n9/qwyIiIbVaWBkyqpEux73dUyo+yPwIBexkg1d4jaZpKdgh cr39fkPNIbBjamUQsQc/tOzhMfVGzERgZCWvu5x2LiaboUEE1/P1gbPHkjkQzby/ uNNu6PwsQMuPvxm+os7l8gWfvni2zoLWMlrfqepjdYnM5h3Te8jgCSkeA3Qkaf5b CV6baOK16TJwTPaBbXcX7ybKw1EEcFPBnvgK4JdFd1jQPQL7P+MxMvlEBgAeshUv 9KZhASfTKoexdrk22cry0uGBZsYRI3WsStj2v56uOETNbQ/AWEXerjXWqaYyBodW gKpKmhqXpqmy8vNgyxxAHO/Z5qaGSg2eiNbjPbhW78VoZdxWrekwKBdP/H/1NfUG DHMYfeEDTMMQxF9xT0WDLPOukkvcOfZP3S0MoMdWmIOzP2iZ8awnmuDbvP/ewW55 snuFpO2VCgWUw40zgKd+5N0mVlhR9xY++Q0+6+K2QhifGkiCBnRfXFky6BcY2tJG Q5gQv2EjxTgImOdQBlJyRDZzjGDIdvbTKN3jWHsyogmgWzEEP8+T7zl5vWmLPYV/ kGCKKKwejZYahHTl/7VW4bXK7GUhx+Q/juiLEomdCQiXUtmJlCe/McZXmijjKE5T xLPl6Dv3jXdI6V84hkB+K0WJDMvMILUmU3Dtk5ImCez0RTWj/2kakIxLCQQTZm63 Nk8YoHHBBnpub99U3TYMV5IJLI8qZOFtXwLgi+Kmp3YAqwhicc7fP6RleTS4zGvj 6jYhfMqLuh6yLbKQobN3PBrbFEG0O2SalbdjkGIFpu23hVis8GnymARxns9rZZwL j3u/lpokoUYiqQFRXNOMUeQF9OAqPfBqrqimRSeV02OniqQg ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5C323C8674D79305

http://decryptor.cc/5C323C8674D79305

Targets

    • Target

      U00vnQbF.bat

    • Size

      191B

    • MD5

      2300705e455665cbeb1087bfc25c672c

    • SHA1

      737493862ea5a0c4de10f4e2fda82000c45e8779

    • SHA256

      adba07f4a5d9a769b00d436a0e7c89777664b8cc17bd2515e951572fff8a634f

    • SHA512

      26864b6c938379a876018ffcb1c927ff9806cb5fdc93d2088cf59ef3b7487bf81952c9e843d9ae1b3f827f3ba43dc7acf4b2a974e9bbfc709d58215982399911

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Enumerates connected drives

    • Modifies system certificate store

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks