General

  • Target

    d1877c68f3069baaba0945b8757673ec.bat

  • Size

    215B

  • Sample

    200515-2s67c4nc92

  • MD5

    817fbcf1b7178faa76c685ba5a0b743c

  • SHA1

    0cf6888a56236922870dd081c5dae021dce11edb

  • SHA256

    a3a05267f69aea3e5267b4decce625bdb02f070329fa8026b9f188dbe2e6efa7

  • SHA512

    5b1ef7769d9ff3c1ebdf3214e6177091f479607ee15f43aed510467b71faccef67a7463658b8aebdd431bc1c942f2b4d6aa3c690974f0ed0b3cb34e36558b64a

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/d1877c68f3069baaba0945b8757673ec

Extracted

Path

C:\t6l3ng3g4-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension t6l3ng3g4. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E617B63C1A7A8EC1 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/E617B63C1A7A8EC1 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: iPS8KHGkVTzpwPEPFTL+Y7vEwa/PI36JxIQcgl8qGcEbZ+7Of/LYhRRFgLtAKzMX nxnAprGQ5WnkpiDoiDHloABKhNOSCU8T1jsFFcfh8AfbQVqsy+iqC1YKCPZXAouA AYCNKMW29YFgE45ywQhm1yZgEdreyBJ3A2DoF+3BKMxYmi7XWG1i/cRp5YzmHbyi MEAweya3NBnkZ3x8KNTKZU0mOs0JoPCASG6WpBH9jIcDf7o+A/FQ3HWycB7coUHf Ok2dRVpjze7HQY9eejwe40sKQOPa0++18Kj+0s927x/jQsUeGqP/DzOfqA3li9mP ookRLOE4yennCedTAoEcxJ4H1Ohhw6Z3WohZ5cDrUrxVXFL6XeW5lC+AZZHBmSX4 IzJKBbQBP0NgdeXrxUpRVr4g9yofQ9NOVAC60C+AkFne0BDCAzzpniNuaJDErdVo MyBopbHw5dJQyCekqCTARZntq05t3VslKHeBHqv1/Zo3FLCgZsF0z5vgsFsmePh+ LvYhlhcsRbV1h6WIi0EoD8lzz3qeD0yu9xIq+uTv4mnKK9/q2PMxiLw72uVL2hFd V0InFwH28GftjOjMsmtCyH66sXa3EDLkClAm6nT+PbURMYI0sMgNKkZhMpOnw6NK d6jMMc6XAY/STa7RQexUhKWQnc9+CuDONB7+88YJI8IflQQTgJktspaxDYLu0nNw zYN6KHnvg7AH1odtE0E7DSDQhw56Iy7UGIW8De37GTQfMCMIZr4m2ISKWSxaCRGl hyXLBcT1DtmNHKOvQnLbNt8f0zO6rY0m5osoYgOpaaFY5dKjbI4uIi0mbMrpFXPZ MI5BbJuuxkuIPsxyZlS7Sw9/ujgIAqEQa6/VM4xwummNwtZdEgneYehMFrhQczdq 5wawilflIMcM32Gias16E0yND2X0qU47yyhSCSNFhR09O/4Js03O9HZoO2kM3bm4 HBsek+yWKoRwgg+uabJT2Sp8zodEIa1kEPiX6kVttK+FVA2AiXgxtViQWHZnoExK A3dbm0XwfynkJ2OxoZyPW4mj5n341knEvMbufsnVYRjMzjdWasXDZ9w+lcmVDsaj zlnMhCbnkmEN3UrASYpadCWYA/JqfGoPhAH5EYm+LJLFbns/2GxRr4bMoqBZKith eE+8472LxVXhPvhRhr+NC8MAFEo7ccLY/fiqn1hmC60nvutDd+mrMVf+XKZ5g2ve XWr97cmW3D/8uIpRX+DhtUSD7PdG5luJeNqhXjtoGItiKTC24IlK3sZrdJna4WPK R2H1H0Gaw8tFFW1Hziw92IkrKSSfn60X3YAYgj8x9oA3OVQPBkw= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E617B63C1A7A8EC1

http://decryptor.cc/E617B63C1A7A8EC1

Targets

    • Target

      d1877c68f3069baaba0945b8757673ec.bat

    • Size

      215B

    • MD5

      817fbcf1b7178faa76c685ba5a0b743c

    • SHA1

      0cf6888a56236922870dd081c5dae021dce11edb

    • SHA256

      a3a05267f69aea3e5267b4decce625bdb02f070329fa8026b9f188dbe2e6efa7

    • SHA512

      5b1ef7769d9ff3c1ebdf3214e6177091f479607ee15f43aed510467b71faccef67a7463658b8aebdd431bc1c942f2b4d6aa3c690974f0ed0b3cb34e36558b64a

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Enumerates connected drives

    • Modifies system certificate store

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks