General

  • Target

    5vdSy6qw.bat

  • Size

    193B

  • Sample

    200505-rna214hzhx

  • MD5

    031ebf32ddffd201aadeb038ae3a4c5a

  • SHA1

    3007f3c3cb507ef5f37dffb7f60bed5e320ffbb3

  • SHA256

    2a6d148ce00d67fab5032507fb35d9b9aadf262f50241285499a9432995d56e3

  • SHA512

    87dfa36b43b402c579dec4890f2208dd45adc6cea8d5e781b1d26505e85701229e491a3cc1b34eb9d823246703ee547a975156e53a5847625a16ffec85ed8a83

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/5vdSy6qw

Extracted

Path

C:\68ydq-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 68ydq. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/EDC146CB8A1B7991 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/EDC146CB8A1B7991 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 1RZvnIQncLA9v7lfxd+qQPtO6FkPJlrfAxxGxgNScBeWBtEqTd3tnE3qbTnUtGqD Cne7nD+YvY2tRa5DRtoiP2pTwZ7qjb+Ixb9t+tZm2ke5ZcgLzeL+9MDP64El/wmj Q6ZawqGHnq81gGKaNbdq3TMsGxDSWNLyKSskEbh47Xm/qFkeBjRQUwfgCyC8//LS fUPZmqIZTmbmG9CSHnd6z4eribwFJoseqbckQjK2wHqBr7Uj1+s574Glfc3cwXgY 6eiYbzRblLfGQblRvPlAOP4RYGNbO87mAO3OQlX4WNns4eP+D5mzDlOTy1X19PGj gBHOkVAwcuPoaQT+92bmJRwpV+c9cOP+6IpqX9e5RUXIh4hTgmxaiWSZaW2ry3Te nNiGZyHZQS46m7dyaX8qEIWDLdFNkwhTWIxTILRO9DjnGmnpEuLl8FoffIA9Gg8P j1igIEmye/gmoAdvKU7LRw0BVmsSrtKaPUNvEgeuIGTBKF+hWfxHAWR3uUsrc62E 0ZDF9/3DihyGm2ctULBeS+pItv6OC2VrQVYws2q4EtB5x1/EaSI+CqGEiPShqWfe km/rOYSpGDeifo5t4hALbU3NmWQL3VGMAKrqrT3/QDnoHu9o/dK8BhOvB1OHRxmM s9BkY8hWSG+u13w7lEQ8f866jARCJuNUZNqgbOQZNEj16XRCHPJV5z+RX5C2/rM6 s5XEL5+H1Tqzj5V9Jhv9O0scejH41OPZsNiqAMqbXi0Bn29E04FBZ9dy7vxmPwvw 430DR9Y6UCnDeX7MtUCohriJXkJo8Wz/uDzgoqLFiwunVviI2Ca/f1HOSEdnNg21 MLoE9jKSNZIQe8u6R4+GZB/TsKlEf9DEg+GYPGOchA7bPX9XAjESm+JrY5SihOUy NCNuX5q/NrRMr593pVDD7lUDJlxvPpp24TUlEV0thMukAPu6fubLpKSyBeYNi3Vw 9GxY0ISjcLUXOup0/QzuCw/DJ14tj+5OnoqEzI+YJNzzOLkq4anezX1kAoYFSER4 hnz22wOhe7D9AY5lPmWXK+Hz2arURphFjPu1rbusxoR/y5hdtqpM5Iq0N5yDO8uz sc8wTnxmt0WDgqShe56exjJyubT3pww3CFVU6sv8OKdJANS+cuJzEjQu26nvCS2E FqfUWmM95QTIsJGHMkqCQ+8ViI9WIG/z13147Ws+GU++eIy/hK+uxEol0p7BU7ek lmQks6cAVKmzekezvE02+IAi8OAeydTxxcDcoS1TKVKPcffX+qv3arfVZsBSlDF+ 0rQwdHy+wq4nQAfMuZ/+D3vXu9QOuNwnXjP6kYMQ Extension name: 68ydq ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/EDC146CB8A1B7991

http://decryptor.cc/EDC146CB8A1B7991

Targets

    • Target

      5vdSy6qw.bat

    • Size

      193B

    • MD5

      031ebf32ddffd201aadeb038ae3a4c5a

    • SHA1

      3007f3c3cb507ef5f37dffb7f60bed5e320ffbb3

    • SHA256

      2a6d148ce00d67fab5032507fb35d9b9aadf262f50241285499a9432995d56e3

    • SHA512

      87dfa36b43b402c579dec4890f2208dd45adc6cea8d5e781b1d26505e85701229e491a3cc1b34eb9d823246703ee547a975156e53a5847625a16ffec85ed8a83

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Enumerates connected drives

    • Modifies system certificate store

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks