General

  • Target

    Me1udSVB.bat

  • Size

    196B

  • Sample

    200506-ydf6zev3hx

  • MD5

    92449589b75088e99026c11efc758a3f

  • SHA1

    4a9dc4d04a9850b99af10ba65ea589c4ae0565d6

  • SHA256

    f1f555330316b69cf9d50580d41a4b4372689e6d37c90bd945b94140fde7680c

  • SHA512

    b9d4481f45a1acf8a62c195d8a1212d221d3a086fd401a352d349c7ae9b3c9ee31e95d383a0aa6ae03561e8e44dc2acd85c1c76acf6beff68d76d23dd7f4d1be

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/Me1udSVB

Extracted

Path

C:\ckg4v-read-me.txt

Family

sodinokibi

Ransom Note
---=== Welcome Alan Dalessandro MD ===--- [+] Whats Happen? [+] Your network has been penetrated. Your files are encrypted with strong military algorithm, and currently unavailable. You can check it: all files on your system has extension ckg4v. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). Also, all your business info copyed to our servers. Personal data of your clients and business contacts extracted. If you do not take action to contact us, the data will be published fo free access everyone. As soon as we receive the payment, all data will be deleted from our servers. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/246EAF4AF2A85C1E 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/246EAF4AF2A85C1E Contact with us in chat on website. You have 3 days. If you need more time to make a decision and collect money for payment - inform the support chat about this. [+] How will the decryption process proceed after payment? [+] After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: QIw9RbDfa+a5Y3kdlTb5hcZV1myMgiVn6MGTdFMeNCnOkZU1unCbJL/FfVm5XmKq qX4sB7wua/kCw8Jl15s+p2N9UIUuNVpJzeRtQAUmZYNEr3M5hb2UVtpQXAk3LxRa oT56Z/qn/ccoloGl5oAsiY0M/pCsszM+un7fyPjgnT32A8WD6xxAVvDLZj4tRXyy cqwWZpqluXFHAr6Pq0PsbmrY/o0vKS/4bSLPH8+QlFvplHps3QVHlzvtIQCOn2bQ MV66fKBHZa043KLnV1K1Sx00oUKSX9wKwunx9rn9RVyhU7Jm8ybRDiqz/lXrrTLo 7GwRYAH/lH2J89MwCi6I+YAk+4qLVDZaSUo2dqWX7A1pY8ytrO+ZqKXWWbCqmAnN nGvUUghpRp0aJZRPe0hNn2VdFWE16bFwtwclpoExSIOruQXLK6JiTTW0MJHrY8S/ Wi9l6kSKoI7luyLe7GNu4ZctJvp6JWy7fpiMII5sNvVkr9zoetv9Wgh8Za/IP5o8 FQxO9X8nn6L3DgRXUWXsII6ZGF2kNKCArUnju2uH/+QX+jVXhSNSuOu1C0F4eYjH UOSMYvtSxgHa57QynGGdYvzlZKIeM+B/xZ/y+lJecq1qbfFW3HgoUzglfoFM1dqp VoEo4emN1iuCICl/L5xG7OHR+C5Xv3WKvJYQR4zZVRd30PyqgQcuS7YyJ6hQjq0C oBKelPn/jK9x8X5HIvXH5xn3/bV7tPAknR8N6ql9fXVCTWT4f1cWDEL+ULWvyYLU bBjfTqp/PbprRD+arJGIteJcZ01m2+rndNTFxJytRI/iyuGKyK7K/YZJ3rvdzPt6 2xaJdk8tz/+WJ17HOzDS8hikF733PYOMlGNPVmMSi50fLDsbFhUJzJ8kTIuhG6nj +juom2mIWW9snIz1vpBhWMqLi4Ax3Oz8AqjWQ7IH+4SGBFP59LK8/IPclTi81MWD 0bLwOvoPBIPnpyzgHQ70djejOFab3s1XqkclokNzzMTxePPmrpQIfTbdD6HSy/6T aBHzpu52gpzJSAPMo1FO5hzuUBvaL+Bkkc1PeyqmJ0gnXFJx4eMRHaaHab3eTdnJ IffpI4juf/eFSZiur19gZ2V2lPqRFAJVvTIWTYT/xOQtsw3oihC5vvjbRmUO9Evx 3AGImibWY9HZGVtvDScNS/giQjpuJM7fS/eaFOnb1LA9xKe7gMQc2zzNaawVxbVy eA02fY08q8h3TvQ/qxVPN/nHMl0iW8WO07bn8psjqHDo3yhbcKT6dz5IrhJbGSuv UBpIXIvSVQLFENYlflbwSVoE3jIZYvYhX3stohyp ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/246EAF4AF2A85C1E

http://decryptor.cc/246EAF4AF2A85C1E

Targets

    • Target

      Me1udSVB.bat

    • Size

      196B

    • MD5

      92449589b75088e99026c11efc758a3f

    • SHA1

      4a9dc4d04a9850b99af10ba65ea589c4ae0565d6

    • SHA256

      f1f555330316b69cf9d50580d41a4b4372689e6d37c90bd945b94140fde7680c

    • SHA512

      b9d4481f45a1acf8a62c195d8a1212d221d3a086fd401a352d349c7ae9b3c9ee31e95d383a0aa6ae03561e8e44dc2acd85c1c76acf6beff68d76d23dd7f4d1be

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Enumerates connected drives

    • Modifies system certificate store

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks