General

  • Target

    XxNTGzKz.bat

  • Size

    190B

  • Sample

    200506-8hwzf74jqj

  • MD5

    3678f90ffe3dce18e97095fe049f6cc7

  • SHA1

    8e8d141ad77c44b2c8b835eacd67b039f0ee62e8

  • SHA256

    3a7e391aaff6e03154e366b5df819a3d550d260df5a13e107f691b57c4811f4d

  • SHA512

    1466e273b77eb1b62b58b5c39798c9a8a2ac44a1acdd3d893e2768b8a34ff4c0815004c8ab497fca8e40a6b1f65c9a6a2df4b19bdece5bf3ee9471a18b893716

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/XxNTGzKz

Extracted

Path

C:\prd6f4zrw-read-me.txt

Family

sodinokibi

Ransom Note
---=== Welcome Alan Dalessandro MD ===--- [+] Whats Happen? [+] Your network has been penetrated. Your files are encrypted with strong military algorithm, and currently unavailable. You can check it: all files on your system has extension prd6f4zrw. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). Also, all your business info copyed to our servers. Personal data of your clients and business contacts extracted. If you do not take action to contact us, the data will be published fo free access everyone. As soon as we receive the payment, all data will be deleted from our servers. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/163FDCBB382B4032 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/163FDCBB382B4032 Contact with us in chat on website. You have 3 days. If you need more time to make a decision and collect money for payment - inform the support chat about this. [+] How will the decryption process proceed after payment? [+] After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 6P4S4SuP4ebJIQxAi5olcDW+oPT0OGKMzCsbpNg/Ia2obRLxmlOlxv65LAMMbAsb xmAmqYTk0aF7EPbkC/C6F0F98cLNzQf5Kb8nb0/2EwH5+OI28EVaFYDeVHRIqJKq w3PVFvXReUfPoE5QwBZzieYqR8e10bEWHof+KeBcCVFzUx5S/OXXsqEBu1qQIHCy wOXh56GkoFXYnwT0VcjEHJ81I6Kb0BaLWEa1WDOJyeB1eY3wLakeDg9f3fikwiKg IY6GKl9SynHIMhv7BwdDYgygtaEaGx+ceCk1+FNd39Mc0c2WJHfiGPRvNH0gS+Sm PA55TE14QmwW741TgKVgf5lkRLZNPXrp9Pa7YL+PKYxIffXxEgAL2wGY+gqX6Pj5 LT3HETDLUtrTUKTPRFIlN/y+NilQ3gQf9P28FiDXMatvN5XIt4A5MR8RfCF6XfAB Eq37GNzyRx+H35ERXfyA8nBOMCBPSRa5nMJmxC7rZLX7YVPl7YwKtKOvDuE7WqH1 l4CIKwgyh2SBWyOZrSsQvL242F6zmd9qUZBd4X8QVDpkEFEbH9yVB2Oaxy3NTfQF qdg/+as/6o3/+WxILezRntJFVpVY9GuIC8ywZZJyUnh2XSmqwwLO2A6/jjmNKrIS gCY4FJSojd3hsbLY0Yq9OgvPxxOVlPWqmBXh2O6Oiy/2WC0utyryzmwzAam85axV okQXdmQXh7RH81SfYMLKE/2bWVP8ifv0ELrIfeCkezLTPqwIZNt1nMzpXzFY3091 Q8EGSaUlWgp8l+8WtQ5L34yF1+W3W64T/uSOenetqrYdPTPC6sUgBHTsJoiraHxi qMvO1I1qlJPedH79B64Iy8HmchwIsO410OvrIb4rwNJcXKa7Ux+2Xhn4MgUV46Ec 9KU86ziK6k3BwwmTphQ+p+HW/xvvTzwYyf3Vaez75rWQ56kbW4Hln9Gdh6uQZ7wB pA58g9GUCgbbwsJr6gf0f+VnHGkgNXogovjjQSPVvbzjgF/c9NWVgd5PfH0KW8V8 4eb6PzIbeHJzG+mD6M56YeYb6cQSihxD3sTGMuxBm6byYP8mbFwtHcJj5kJpOtY7 vOQrpRc+AeexEofQjXuid88ChgP3v3nuy5mxgcNN4t7pf7YGbY7i4E2FEOF5VKe0 Q27O++ovFi6zlxai446EPtKMf5o4TeAoD+2my98qyzd/jRRcOW9e4F6g6J7bm6TK QKs7l2nrRuwSuNw6fXcXrhRLpp0I7cTXbzq8iiQ03kbAGhqyv08DedZxrPfg18RF C85S+0Uabmj+vaSDfTCLxL9NPWRw29wPbPcVsSvt+I7Gre94isc= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/163FDCBB382B4032

http://decryptor.cc/163FDCBB382B4032

Targets

    • Target

      XxNTGzKz.bat

    • Size

      190B

    • MD5

      3678f90ffe3dce18e97095fe049f6cc7

    • SHA1

      8e8d141ad77c44b2c8b835eacd67b039f0ee62e8

    • SHA256

      3a7e391aaff6e03154e366b5df819a3d550d260df5a13e107f691b57c4811f4d

    • SHA512

      1466e273b77eb1b62b58b5c39798c9a8a2ac44a1acdd3d893e2768b8a34ff4c0815004c8ab497fca8e40a6b1f65c9a6a2df4b19bdece5bf3ee9471a18b893716

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Enumerates connected drives

    • Modifies system certificate store

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks