General

  • Target

    rzDStupp.bat

  • Size

    194B

  • Sample

    200506-nrddt5xqgj

  • MD5

    88f968f6016e0ccfae99c5210480d46f

  • SHA1

    5d8e6250516a9a9f8d93f96a07618340863afd63

  • SHA256

    32a97b17bda16742f5329e57ebf39b566810757f179c5482f1896663ca76c657

  • SHA512

    c7792bb16e9d624ebc386063652515cfcfe64e7c5cd32c9ca59b30971599288f1f319e5518bfaa95bca890817c341046a442a03247d7c32e413191834bc45ae1

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/rzDStupp

Extracted

Path

C:\0q539e3g8-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 0q539e3g8. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). We have copied financial files and other important information about personal data, it will be published on the Internet or will be used against you if you do not pay us, so if you do not want such consequences as customer churn, media coverage, fines like GDRP and other damages, we recommend you to contact us and pay the ransom. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C894AA2D78BA1E1D 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/C894AA2D78BA1E1D Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: h/FlRL9iNJQBQ74/WLNTFFeUwdAEvfZDMp2den1kOW6G+MqqYqcctbyuZ2ghMMcc hPFkg08xI57BiFtZRMvGSHaIROM68AZKqlALg9OGwFe2KdxXC5DP5ZwMubwOfNN3 9b0weCx+G8QcYYkXCXX3VEjLz9x0eU6QFS6EnZaNqhMmeioqjzzjLWkGQxHbAvrT nsIA1lmVLlvpRnTOKVJ93ohNUq39gMiumi2aUSXvoCm1HitbhSx6TY1gl/0Up1bk YGPNyFqTCv1mf97Gyrs2TEZc2L2CKUohXLl05RmbsNTQSR7vfrLOvuRgPgoZmCqD ot7RhzPXrmVWiDSAN1Z6nTYmKr39bRc/2fzSdqcyu7v0yDRSZmtgAW7Dj6KLAp4l Q+cotv+EeWwq/RQpbS+nMNuktRjo7N9mwCFeq13svcYfDCcqnKsnsEdrky333wUI b+jiOetcbECRZ7zbc7C0/pSGNlrj4PQds5G/J/fvytwHe2vjJQVwYEan6f70Fjta A/N0AjMzyge+GlGgT+WK0kDOxmuMKhUCwFpsX8MDRIAnEQRw6wX55zW1YAmJ+kNd 0m4qrdPYNyzBmPssZRrGRDqQIFo4QxFK+OmcKaAmg68DrYkky2gbSMS8r5rYqg8B YmFveTCDUIp7qDqKvYHmCCSffNQy7AZ9Xux7msgy9CCGPNmUhRXOjL6D2Wa3H2HV o8SPRsk6FOtk18hfFBeEuE/Epaq4krnF93jAYcdwYMRGmMErAxCMua0YM6SgXbxX m6foTvA2mPvDuo3zYlx9kws3H10a3AfF3K+3AIEdvF9T2bHkuTgSbmW1WJwCrryu 1kgP91+g4fy4eO5CYpwaIE7OVfG/u4D2YFh94ZSQqXdhcrcI7WngeQ1NkVy3LlRk EBn5ilCpiCTwjQnkNYe5+y+HxqrjlXtgmYuWuxfDNDQmp3pHi/I8zEWV7tUVsmZb r69wtgpZaEXNFtQuhDVeUrkLClu1D3Vc2EvqxAeutgpkqsRTmqtRpEHwgfWBf/05 LRYNkkkAhpSYJn4HztprygE+1lqS84zfZuP+seMmAGSXjYGzzBIGI7so+yVs4Aqh K6j0PACZQlSM5Fb9m8DuhkHM1Wv81m4NbC8YDkGGEBqq1/urZokAzvI+4UOC7ibo 62n0v4laVD8S1BOThvYOT99n19XN11v1+/MqjIQrzl3JA0XBl+L+k+QKynS10xQx kiPtvOl0J/rJ4dfkWETP26BaCtqZDIHb6Gj++hoScHTHOLBSe6s08Nc0YsQTSZGP w9D8iRIsO6O3PsWgSi2ZX0dtYkB6JFR3mjiD8Bgt/9eV6dHceds= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C894AA2D78BA1E1D

http://decryptor.cc/C894AA2D78BA1E1D

Targets

    • Target

      rzDStupp.bat

    • Size

      194B

    • MD5

      88f968f6016e0ccfae99c5210480d46f

    • SHA1

      5d8e6250516a9a9f8d93f96a07618340863afd63

    • SHA256

      32a97b17bda16742f5329e57ebf39b566810757f179c5482f1896663ca76c657

    • SHA512

      c7792bb16e9d624ebc386063652515cfcfe64e7c5cd32c9ca59b30971599288f1f319e5518bfaa95bca890817c341046a442a03247d7c32e413191834bc45ae1

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Enumerates connected drives

    • Modifies system certificate store

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks