General

  • Target

    9LqmY8y8.bat

  • Size

    189B

  • Sample

    200502-swkrpnyxke

  • MD5

    409cb77ca0557e5e095df01063ea8ff3

  • SHA1

    e664180fcedc6210419e8382edcb017f9dcd2363

  • SHA256

    f4cc72498bffce63ae55294e28cdf826ee706385369edbba23a3953c60097a19

  • SHA512

    88cda05b09f04c3ea95eceec40d441f616b9cce3e5b39e569ced01bb030ba8cc40a77f49521d3ca7db7db838f93895cfec52248b4d0a5f58ba36344cd39c85e8

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/9LqmY8y8

Extracted

Path

C:\cri431j2le-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension cri431j2le. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] https://mega.nz/folder/SRsjiJ5Y#_FUrUPa5DcWLnHqafWIvpg We have downloaded your documents, databases, documents of your customers, correspondence. We are ready to put everything in public access if you don't contact us [+] [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/658B6E0D1FEB0F68 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/658B6E0D1FEB0F68 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: ivQueA1VRZiKvSfB9n7TMIDUQUWXWKRzaiI4TRXM0A0Rs5oFE/yBxXy+WF+kDJkO rGAIiJbMLv1oOZAFuZnJyK4jbzMFJrlOGP1/jKoXp7pn7UPKjDarXcn16lx8s+Au 8alLoH3VCJEL+3UgjXhdsDnWU6jrTxqGmOvSXQvInwfd4Jmxrt79c5Ehc9AAdgO9 JzSUUiRvujNXWocnlvSIgH4OTf359v2FMEnvW23+Bip1cwniGsjuvw5fmVpCXn1D 1D45fQqjWhIAMpDugRmiib88KCcYrIWRY2KRAiylOujOr+ZjZwbVekTQy8N2Lm2E y5jriIRssNVwcM+wX4OHDtPZ/4JUTeyAC9ce8ZkXRthRseaKRykjqPB4/orss1r8 tXRew1XaRO/uLy3DkWuOPrS47xKVqcWH11jMnRJQ2XdvxGXxfvYKyrrAtEsTafn7 IGeG1GWDpHYg45oIF2DTMcERHyA8/ovPrcREJMwHU9j8kbfPnwDLUlD23/mPL6Js fqVfT9Qn0TEHv1w9+XFOrNDPYiY9vTgvbShb8b6xBxpaa4BhP1MalVwpbWFdEPdS PsJgtaNTRnFQ+irmkFu/1NIPkRkt5NSEM4Z0s9r5P6+SN1Mv8pxdX+sv24t2bujI rzKe7fKU/Nh8AZ4aWKwpa0Whb73Qq17JYlKvA5B+xCmwdeKB3dkCLNnsOCjFEAZ0 4n8MI0O8VH2IfHFWC/f+xkvll8QF65XtGSc6CSA7i/1+McUglUWpqM5w/XD0d+2M xAtSrfPevVN975Ga+Wbh5X6GlO22OKtJ1FSySI0l1YEcxqYpjxjoJ3QUep9t5mPN v/ipODeo74i+/0rMhqria0FbPpLzNNq19CprJuqOdlrxlFhwL8PpHSnH8oJEMhdC 487K2dS7GyO+2ECxaH5p2wrYOnURW9DA0xEczzM2dGyb62yPs9/NML45Wievt0S3 dJ+7r5j3A01WBKed4x2IBfEcMdN9MQfPnFgsVh0Gs4uP1+ryPCwoJ+iNFIsoLRlW bax+O32vBGj6G++C7DCjX6vu1eN5pK7g1s9tbNCD0j0ao6tUPTgN0PbubzxDccc3 4blIQ+AG/H7v1z+BhdzVBRUD+7RRkj9ie7JaXOD0drmkKor3Itdrslk1qStgjnQI yMXzhMmb67i5kpNKT+B3fCLld8HFzLRwtMzeQSNPs9Zp2/u0YDUEhtVBkTqz68i+ GLyCuyf2IgFYhb/3GUiYJ++6v2JkmgjIzuzB39jRgcHgYC1R/D7dak1lQs4A5067 g8/m+Q2oMntloeIbAIGlPiNO3j8ohaHjAXDtyWn9fE/qdIaZuk3iTA== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/658B6E0D1FEB0F68

http://decryptor.cc/658B6E0D1FEB0F68

Targets

    • Target

      9LqmY8y8.bat

    • Size

      189B

    • MD5

      409cb77ca0557e5e095df01063ea8ff3

    • SHA1

      e664180fcedc6210419e8382edcb017f9dcd2363

    • SHA256

      f4cc72498bffce63ae55294e28cdf826ee706385369edbba23a3953c60097a19

    • SHA512

      88cda05b09f04c3ea95eceec40d441f616b9cce3e5b39e569ced01bb030ba8cc40a77f49521d3ca7db7db838f93895cfec52248b4d0a5f58ba36344cd39c85e8

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks