General

  • Target

    TG4Rrn07.bat

  • Size

    196B

  • Sample

    200504-yx4z4ph4ys

  • MD5

    36415cbe52b3dbeb2af9a30c6815a0c5

  • SHA1

    25d0489eedaaaef75455ece1a89485cca32a0a9c

  • SHA256

    ce54af523565e53dcd1273a581513a9fec0bdaef947c269bb4cc8b6b2d70c201

  • SHA512

    de5b0ee7eae56f9d6992c512f6a090941da641f6a7eb17ce46d4d743856d08de53886a72cda6ca87cd678aca2fe15b018093b297a0f35016370b90754bb26500

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/TG4Rrn07

Extracted

Path

C:\dc5v2ye0p9-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension dc5v2ye0p9. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/038CBD1E4C6AA933 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/038CBD1E4C6AA933 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: rkNjEhIuzFKJ+LB/LMoAYTKbCgwQk8+ymZUHUtiMJZ08ZztDRlQfHrwMP2QD1W7D EgTH4Ay344V+1t4jRDeWPsgEdltjwobF4/XyecJbNcJNF3eBsIDNpxJcSJwrBRgd rmU4qCaWVJf4AbQ6yXDRuAohfpjRYexhaRE/hbAmkJI2CQKVpGfvsn2uqXzA9036 LL26LtKz52gwlF0Pq+UDHOzirn6i0Z1w55jPjmatsg9NusBw77NBvH380bmHp9Da XFkuPE1ffv4TUuLrlL8PWVFJ3tEcpk2jDKmWZhWvU3Ml/wazAiYc2bIJ/cfd0vlQ mZ8o7QIAHaCMLOJJiGKr9RTvqMj1L9M392XBboQhU8GF4lU1RenyFPoNqy1Ti0dP xGb7SuGG+hZ6BbrCxBtPGrXZVMopxDfCMsnyLGb01+a3Vm/ZhrFHUg7CIMHsHNSa cvPL95Y5C7sZ2u95Y7Bh7vlEMs98Yiq+dTsWpM9Vioooz96AixUmU6Dm3ote6bWj eV7qpp0VO1U3z+05wWdFjHnNBG18Fygr3UEDOxUIN1/h1ZkLQnv2v3Qrk+2FL9b2 2ClYJCoi72z50oFr+8B4C8APh6RvJUoo/bKmsG4V5plt+ONDOmX3K3F/vsPTYcxb TRu1KNJP/NiuPO5iWJzQdwNBWscgfvTdZW9cV+QeDd3WVhTLycAkQ0iUCKgIbWZV ihbFNce45r5hbnBIgqpwUF2o+EYK/vmvnGNnPMLPgaYH6ypWtbf6QqQofPTb8ItN iB72pGcnMUi5H5bc2Hor/KlXyTv8DcF95nbbZscsVbeu23RQmlvFgwlOX+UWf+VE O5AtOmUANtaYSGVB1nN6jY61JTifB9J10bDTAvtZBGwLc5pxQWsbpouv30jKFWqc rzB9mbrMS1aY0InKVUgykEOBqj2FhDoX3W1MqOgKI87rqi1USi7UHpj+FZBo9dhN mkxLrst91BTkcG2zwQhlhfFSjNA7HNgvBqGFwvvLayWpeM9CiANFz4zXsPiBLbhq mSxkWVAuR7slg7UI2llg+Y4GwSVvFtcQnZhAc3zYXry2YmC94P+8GVzY0ooF/QTs Tytu13MP4fSJEQn5fttkzgFhWYDyzu5UsVIcfxj1zEckrtCstO39WDU2eL7EnFi9 tWW8nZN4izGZRHRU17BUxG5aUh8nhSJZOy16o2xfrqLiWTj4sHQU0X4+A1P9ilvg vb2oaij9dw4xzVuCOfXyT9sKgFSSwhptQWqLbfBb5Ws0vsSqomnIADP42s/j8diD fBQ3KpWIVzW8fIClmNunhCmfHkFFgv4tY6aU3PiwgPa2GLx03Bb62Q== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/038CBD1E4C6AA933

http://decryptor.cc/038CBD1E4C6AA933

Targets

    • Target

      TG4Rrn07.bat

    • Size

      196B

    • MD5

      36415cbe52b3dbeb2af9a30c6815a0c5

    • SHA1

      25d0489eedaaaef75455ece1a89485cca32a0a9c

    • SHA256

      ce54af523565e53dcd1273a581513a9fec0bdaef947c269bb4cc8b6b2d70c201

    • SHA512

      de5b0ee7eae56f9d6992c512f6a090941da641f6a7eb17ce46d4d743856d08de53886a72cda6ca87cd678aca2fe15b018093b297a0f35016370b90754bb26500

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops desktop.ini file(s)

    • Enumerates connected drives

    • Modifies system certificate store

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks