General

  • Target

    KTWmE3JA.bat

  • Size

    193B

  • Sample

    200505-4zplx3a3mn

  • MD5

    86e9084080fb1d5b8df7ce17b4205606

  • SHA1

    ae45e41a8738289d0b7f5cd8d7bc5d2c5181cf63

  • SHA256

    b26ba894edc0ffedb94ed655a6d2613a774ea645b6bde9f0536d6f75c6320a86

  • SHA512

    85ec46f47049528e367c95212fbc882e7d3f0968a612864b78a4f98fe0df774be9d2e8512f4eeb78a7cd8d3ac974967d7f8ba599b7baa7279155064a57a9996d

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/KTWmE3JA

Extracted

Path

C:\134n6zob2o-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 134n6zob2o. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0F00BD47B1130DD8 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/0F00BD47B1130DD8 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: Da64DR2q7r7gSxWZLZrbso3ZJPJVAbvtHAtxyogVTx4Z7AWtmlH0oOk9vvoNP86a 7IHX8ZB+8cAaaJxx2vlXIa1iuJqbTUtxdnUPBJhynkfURY2JGB07jtVRusk8ysK7 k6dwsT2nRENKK3kwowAztr43iXFSP8/EUnhSYvgeegtgb9f76y7b8q0jnTPQ9xIK l3/p0s+MvnzU83QD+inqhzPtl0v0T9ODcOXnQzMoj6/TL9FwGqmGBz/dDXe98y2V 3kzbTHtABWEyrDMbwH/8p4r/TgKRnpZvK8JwQrbt6sY4b1dhGqYZ/Yi00+KrN8sH +xQ/1AkaL3FBEGZoFl/MnEXL4HoSL06SZctQg3nfdcHOWFJDVQ6hPyrEUDcnKniu tjaTGQaOj8fpVwUg64O5sdiNAeXlOFuQawW/bY5AineVlkgvKrwar6o2Xj2r93Yi 7WBVXa0STmBmMO/x5lIsUYa3kSoWkZj6RK7sbPDLfbTIi7dq5YsvRbFKtDv66l4b sZHJ+pdyVQ1pU4haYpf5aVuyCIz97qFpmT2blPfeDgm1f7+MGhO/cTfDIcrG8Tn3 zZurx6irUCXvWcYui+Z4jFVE0mVYCI3uiVcIdjsVWP6MIc1HSvcwBHq5iV1gpTb3 HtK0iorW/tSpTrgi9yhh56KdBLkPJRGX9seVm3CeaUzPQtXLPNFVP/bwpA5v0SRj Nw7EAT9PL2wPGIJZ3Njhje2o/PD/tz3wqzPOynVACdMCxi5wfXOgliwpvXfYo7T2 vBeSL1KYAXs1R20KjU1bSCxH2+VR/boOmsV5mj1iPxFtijvpC3MDwktx4qu24d75 p+j4qjFRH4DyUpHhBJs2S7mXwBCQ5uDPl3qLl8RVJ6td726tV/omycVjzlyMbV3u IAborIZ3bA1fhFTDWCMEC9l3OLSsFjCVkkV7lrFEWNBrCoWNMeLCmka8lNTPi80+ n24vbqyul61zYCE7+VWOXlyAGh4S7gFNIxUi/8Rl/Ll+UlwoRApMP/9oQAvV/CXL Kp2JStaP4sNGT7kcPSg7Gx+LsISkBB9nGCUJn68LuOpfEcgmaMvGh/wvGZHeMpPx pLo+WpGe5RKRIyN3awNbW1S2pHrv/jcEarjdYWSWCIGbSmlm9ISPbZnYw5cp0VpG yxLmE0ijyX9qvkAcvq9EN2MvZZXrFdGmRxxt+sU26SKvcWKApxgoLuIqq/FgPK9e oLhmdofGXzSNaIm4alE/xU70L6voTKCw0h5+ZqNBVu5hLNerdM5Rb48Ig7rjHD4i AXQq/xamWxFxTf5CBnAGyHHtYT1eNJlNlMvBdaRjHQO9gDmjro1SdA== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0F00BD47B1130DD8

http://decryptor.cc/0F00BD47B1130DD8

Targets

    • Target

      KTWmE3JA.bat

    • Size

      193B

    • MD5

      86e9084080fb1d5b8df7ce17b4205606

    • SHA1

      ae45e41a8738289d0b7f5cd8d7bc5d2c5181cf63

    • SHA256

      b26ba894edc0ffedb94ed655a6d2613a774ea645b6bde9f0536d6f75c6320a86

    • SHA512

      85ec46f47049528e367c95212fbc882e7d3f0968a612864b78a4f98fe0df774be9d2e8512f4eeb78a7cd8d3ac974967d7f8ba599b7baa7279155064a57a9996d

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks