General

  • Target

    d9m2D1ds.bat

  • Size

    195B

  • Sample

    200502-frqqwqaqvj

  • MD5

    6e7b679050b6a217806403c4caeba81a

  • SHA1

    98883268db2d45bea8e55862916cc88253aef3ed

  • SHA256

    cb1606e450c581937346e52cb3296fef1a6579bac3b8f21c20cb504b1d73fa95

  • SHA512

    bc63deef825deaacfd533b60551b5b91ae5925463e3bd92aeccec6c043c4f841d1d660ea7f14071d7483fca0c2cb27b24c1608e2a3a147dfe02d93d1d340bc55

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/d9m2D1ds

Extracted

Path

C:\52cpxh1-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 52cpxh1. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3CC24F6FDDFCE86E 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/3CC24F6FDDFCE86E Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: v45oqito2pJ7+du6BoEqhqRAna8gJHr9d+TYv3OFyFt/xDR1sdVQI9iRxHfWk7xv lkjf9UKUFM9GMFPhESkLCaMdelniDyFl8yghEHX4fKuS2K2quFIHRADIDuFCu2Yx LYdA3bm5r98HuKSSCrSUeoYuwV81gaQ+/Tu0T03ujpeyak1C7VrroTC6LkTmnZPP tUa3zPqhcuBgZqi2Te9nrpdXKNSpoWZjIx2kSw5fyf4otqOkt2Eg9n1hM05uToeC 008vmFWSDpJ9amBhIf8kmrIDpKyIpAckVQFqCk1WgKysoVqddi/xuWugFJaHhmKg tL89tbdTzn5IjEIj8yATG6qiqtgRZq9Lzjcu8H6jFbBc29tPn2Ulvy69UJ31NfSU maNxx02lDj2VRJdFxvyl5mpSasb61ype131J8jOBUMwqy0KzoQBgqftmomWjPgFv u11f4e/5Qby9ump+UPjYxWANovEdAFMeloakG2OAgcvTvLbqPbZkbKrLh68fb/Iq z0ma2FyWVnYRyhFuSS1p6gcKyRHKumF8hlE1vLV6rENGhG8Y1iU4LcKX81sYxx4O FuB7lT1FojXAGJf+sYx+WzT2RIeC5SdW/JAj5+Yplci14lSXDbWXiinYTjZ8OGiu jsgjSuhzXZUrNT/4DT1E/HpUoJ2FSAnyEYqnvfP+m3dCY36W3byq5mhQKuxZRcqs QpPb+58TJ0sa7VtZeH0S5je5SZqcPxAI7CkQ5mJQ/Dp3esIkOe9bkNGo8IZocur3 fO8MvWpwV6Zf+uvA5qtjOMybCzMPrFFoHCbhYZrUq9iYYlVclz/y1ldhdM7eIfZt 6xuDYIDxZvQ77kXjy+oCLzD6WY8krroAU003dxmNdv6Fd6A3US4dYT6B5dmjOywG MapsGcTd/5z6wCVqE19MX7npDuPb+wwA4ghn6JszQeklwR4W7oBi8xVuQAqmeZ3c MpaJgkEt5DfyA/TuVWDmJMxbbpTWO9tZ0wQElyj6abHW3h2vumEPQIbDqSAItZDC AE0RkSeg47QLWTkbR+sICFyXXujqu+1n3TAjTTxJSRT6TkEnuRw5c20Ai/MRBeQJ L3dwCwt2eOAs7g9YjO7rYi5qWTtNqS0bw6ZsFRjiS4zgKUT9UR8qzQxt1O6WAf84 l5fn3AwgoB0UJuY0bu8EtIoeBrnUBB+ukaeHCpuqOPEG4Kb7I40Z5BP/0SJFmVS8 X7Irc43WqVMJwFvZFJxDaAhWXwncEJrG/2bNjGuEXcZSbPiRyVwGNRv9OQc4egTf XrSr4bvOlv892jWREwdp5Il3FDdtwcGJx43RZP7Z7k4KBg== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3CC24F6FDDFCE86E

http://decryptor.cc/3CC24F6FDDFCE86E

Targets

    • Target

      d9m2D1ds.bat

    • Size

      195B

    • MD5

      6e7b679050b6a217806403c4caeba81a

    • SHA1

      98883268db2d45bea8e55862916cc88253aef3ed

    • SHA256

      cb1606e450c581937346e52cb3296fef1a6579bac3b8f21c20cb504b1d73fa95

    • SHA512

      bc63deef825deaacfd533b60551b5b91ae5925463e3bd92aeccec6c043c4f841d1d660ea7f14071d7483fca0c2cb27b24c1608e2a3a147dfe02d93d1d340bc55

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks