General

  • Target

    Sm5WHtYm.bat

  • Size

    193B

  • Sample

    200505-s7ybt5gp8e

  • MD5

    89479f503f8853ef6d980710e78294c3

  • SHA1

    816b60d4a2d1038ad57182c3356639a7f595e519

  • SHA256

    94da60b220dfc957c34baa5386d0758c38afb21752e7bc55bf7a0ee19bd752b1

  • SHA512

    ae9a1fb7b5f6e95e07cf2515e55dd6d4d98ae2b40af5995c645bf9c808b8326894ed1f98ebd678594f3ea259af28dffabf29419573e7923a9984a55ea419d61d

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/Sm5WHtYm

Extracted

Path

C:\8372l6bpv-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 8372l6bpv. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/15CF157DDDA55355 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/15CF157DDDA55355 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 5vtgSzqtHwgaxIvF85DjeO++gKidhD6ssolDBMaljPU9kXkshc7WiEHx1CpeJLLe j5QuWJtptJHzJ2HTDN+hWmpPOctNsBN5s0pE8TYVmCHq7yTiegPuUws135sL07fx JYRYLgefZRF8HD83309sy4Y4uIY9XBOZCUrT4x5y7hXk5n8PO3egUahtu5FDy8BN dEkkh3vlv58V7ODM/eqaw0TAiYkjVh3tgKoWZBIus3JmkwYxMitFPfmQl5Ximrcv ARaWemT8c4iPtSdnhwNSLaAZq1fphBf8m4FXr4ZjL2ZXhwFIcbWzyu5oPUhgG9N2 buWGDVS2u84tGhjQPu+fGexWeBaxBWC6y9+YOR1XxF91s9LXmSJzkkzl/DH16YZR pSpwF2YjvETSjKZ4ciCi20XCi07mzKKLW9w7d9WoTBj4Rn7sAFB3d8WpzEwMQqV8 WPZMWY9jk1SGv5G0jTZIjHJNzi72vhvMvDQchW0Di+3B02WJervHeSxKUSq+eodF znLkLwv6333zbnKC4axuNt0ft/XxE+/A6y4ef4TiLbkD38SlWMOogtsocmhlmMXW qiEdDddUxxTgXLhZMvjezm/v+YAyAK3Lw99sVSuW0aJ0wpl6r8MVQW3+o42kQf// 5fgWRckxzNLA8mP/AWvuey2lYnHf0J7b+4CgiYZqMjdQpELaEYkxvTVd8TMpHVYU eXa5QVQwyEmGaEF1plOyJ28RDsa8XRT+Ciwn369YleS9dPrULlPAmb8wQyiEVx+C TfKHpWfX4l1whZWII+4EbK+o2WhPwsNGjsxg8tKoyYnBRYcSroMlGz0AqQkJvPJF 2BkFos8OLSMHqMpS+oBdW13kQZWb4LQ70ozNBXkQM8EI+rdr5kifxQCV5hlXX8cC zRLaBtnVNUmcieL6DvreBOAiHlF3uwuJ3PtP2zh70cyNkG6rWcoxDEfalFeOzv6k T3FKDqXaxrrlpR9955rMuApGWbIRcZlNZ37lEblOpMpgtf7GKG7ebOQ5CA9Wk3LU q4tlPTPE2ZB9K2Z6GKvhrkP3wGwpjmst8TyqnidxgmZ7AqVw8u/6axLI/SMKPDOE rxAyjNbC8Mv0xAA8WQGTuu+4lj004K8Hr7q1tqwcqj5q4HTCdeMisCQ373jtnn+7 FIU5Akd2Ti5J5FIrNCShpJrCqFsyVTNDDIHJadfYnd/xxSd8X4YPjpGZF4/kRtuy lzlLJp/eTQxanv4s2UDadACNI9dk1RfaSJlkFealD0KJ1YfKZiQBZ952yBpFQslj 88ZhD5Ys/9EeAynOYTPrYvQfsQIukG+3S2aoh13ZIMVaOqhcw0k= Extension name: 8372l6bpv ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/15CF157DDDA55355

http://decryptor.cc/15CF157DDDA55355

Targets

    • Target

      Sm5WHtYm.bat

    • Size

      193B

    • MD5

      89479f503f8853ef6d980710e78294c3

    • SHA1

      816b60d4a2d1038ad57182c3356639a7f595e519

    • SHA256

      94da60b220dfc957c34baa5386d0758c38afb21752e7bc55bf7a0ee19bd752b1

    • SHA512

      ae9a1fb7b5f6e95e07cf2515e55dd6d4d98ae2b40af5995c645bf9c808b8326894ed1f98ebd678594f3ea259af28dffabf29419573e7923a9984a55ea419d61d

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Enumerates connected drives

    • Modifies system certificate store

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks