General

  • Target

    JFh52PBG.bat

  • Size

    195B

  • Sample

    200505-9faf279hms

  • MD5

    27cfb7797118873eddaffa1b3dfa352a

  • SHA1

    04332f9742db8be098ffc355c45e223e2aac778c

  • SHA256

    f18541c904b443f13026355bd0f39b9e380f708cbc6799da5de746e3fc980962

  • SHA512

    70584344af74c6ea7d80df5956c9fd95877a69e041053194949d30f84f327373d2a2b6328cbb03ef06e6b102736c49c09a77f8356c92530d7d13699f3f846ae5

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/JFh52PBG

Extracted

Path

C:\krz0aw-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension krz0aw. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DF44CE8B3125A7CA 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/DF44CE8B3125A7CA Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 699P89a4QHxywj5L91rfkX++NM/3fWppZgBRxIgk3UvAvZgIpBTbNWCmFpms7TR9 JHnnW1gwto4kxA4tzpwzoDcQOx/lweUHg2zAUFI0cgd1Ie7Sznph0gR8dqTyvnRc 1C3roI6XOEd9IZEJ0Atg0ZkAFpaDRefSVqjnyP7rCeysKrOgar8VPkVYmMmfLr9H b/k9b6Tt3W+oKL5v7pcB9utsqwS0BR3PFGiAvcvNn++Wn6tUIqHpj5MfksNTZ++j zh06k0VheIyklMX2UJDbsdISqRnJuGoEDo4aojvD/2PZsA6/9kUJzxoTcKel01Zb Fc+k9kkiDamdU8JSDh4mBbCOaF5AQxLxRDJz5G8vgvX6JWBkSzyBDMZXrElr6u4t iq/G6seAGSqVkd7SFZatVR2dHAVqutSFq6Zgx1vN29RCKJEw7qgiJfYOPnZCp2k4 YtHrHl7qPUIJ5lqSNSvrswiFSlQROGfhFEwS2bWvvOtf+NjupzC06F9PREPvjYuw RXW6ms7Oo6RkCv79RucoietmiE08gK08LiPq8tefMXte5rzNe+9fCJ4YxQQgVshI gH7SnEDbCJ7mbGxWMsxgst3fDmM+IKRV6+ay1R7bySgr91zfEnAd0/ytZrmfuIgC rCNVN2EBn8wR2Z4xqilUx/mOTC4Ca7yN4gxs33mZfug1EoYzHE1ernUiusRlBaMd FJ+UzN4Da7awet+sJI0zWDbVPkn9thkAQ8/saBZ766TvUBCzGp8asZqmDGto8nnU KqbrxY2dtC5r+NpD45/N3dxn7XJ7bkfUWePVX9NOoC88LwaMx+VssQkCgF5+0s5P iGevxq0yBsWDNk05onK1UGBRWNexkd6A/ixfYDxekp3nqaku7kHgHEou5LJ0Rkuz D3SR2fl43VUR1ZiwCuEHJtO5gRpMRCQTjRWzw+IdZFu56CM6TZc9O9sS9PmPsrH4 pTqDJed1PkBHNIiU9cIc4HHhHIGTvv3MfFHw6O3bghux1yWJLCu3RWeCytSV9YrX LD+dozQh0Lbr9IgAmc37dihhZxOIyLn441BJBZ8pcEhSyMs2OB4tQ6+qc/BpJINH z7ctGDvGvFiE6vANwwbNL3YutK+3OirBQ3IB27mfNP+zzmsGe5IRGw5SfQGHGYPw EpL3o+uJDYN1YFjhKsQwoJ9CmMr1qVCygp788c6DlnotiPbqdheODdSi+2o+N7UZ eRWxu8QBIcDK5Ceh+472yepDe3iSjpP4guCBPiRYR/r6WNvd1uryOQO9pQN/AqVb 3h/J4edvXURh4W09np1WuSnu0YajXnBPC0DvVbweB9U= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DF44CE8B3125A7CA

http://decryptor.cc/DF44CE8B3125A7CA

Targets

    • Target

      JFh52PBG.bat

    • Size

      195B

    • MD5

      27cfb7797118873eddaffa1b3dfa352a

    • SHA1

      04332f9742db8be098ffc355c45e223e2aac778c

    • SHA256

      f18541c904b443f13026355bd0f39b9e380f708cbc6799da5de746e3fc980962

    • SHA512

      70584344af74c6ea7d80df5956c9fd95877a69e041053194949d30f84f327373d2a2b6328cbb03ef06e6b102736c49c09a77f8356c92530d7d13699f3f846ae5

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Enumerates connected drives

    • Modifies system certificate store

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks