General

  • Target

    88ea52ece97c3ef87a6578a6ff5aa53b.bat

  • Size

    215B

  • Sample

    200515-h7bc11gfhj

  • MD5

    bad8d40efcd5a8f305654d21d142f03d

  • SHA1

    7e5f73600b271c57fa3f5252fbf522d22ac7688f

  • SHA256

    7b1689d0497644f88e4553f05420150c72f332950a15562b4f19d5f82510b01c

  • SHA512

    47374ec7bc76ba136b2f679650a7dc2c9b2209279f9324ad92422d2a98b00f4bf4f90e7e4686c95e2506289d2ac20ff8d49e15ee2a97952c517c63045946e044

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/88ea52ece97c3ef87a6578a6ff5aa53b

Extracted

Path

C:\31v7y55-read-me.txt

Family

sodinokibi

Ransom Note
---=== Welcome VIVETTI INSERIMENTI SRL ===--- [+] Whats Happen? [+] Your network has been penetrated. Your files are encrypted with strong military algorithm, and currently unavailable. You can check it: all files on your system has extension 31v7y55. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). Also, all your business info copyed to our servers. Personal data of your clients and business contacts extracted. If you do not take action to contact us, the data will be published fo free access everyone. It can also cause GDPR compilance. “Article 32, (1) – c states that “The controller and the processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident.” It can hurt organizations where it matters most – Penalties can be as high as €20M or 4% of annual revenues, not to mention the negative public relations fallout. As soon as we receive the payment, all data will be deleted from our servers. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/007D0287C0932AB5 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/007D0287C0932AB5 Contact with us in chat on website. You have 3 days. If you need more time to make a decision and collect money for payment - inform the support chat about this. [+] How will the decryption process proceed after payment? [+] After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: xtO3BSvUWYu4xh32tsqgPd6MxGSB0vONlAqFoDpS4V95qHrafDp9sgztIxW0w3Ya EQEHODFCsu5OOlzFqM4h98jOSGtKD6rOb1YC6ZsQBX5PSi5BkZ6KDJ+khC9FecIs 4uVFgO2H0czJ5a2QVSTnyvQk+D7H56CyhFTG68VdsSSaPzGE+qr3j8kh3OuowGjW 4hL/wqUyZXuPvKNCyp4maqqhVOCZKDtwiwdEO6BA2bJ04cQqPaZpPDMNgdujcu4B uCR8l+ja65J66dYRpXe9dIoIHhiHc1Qj77AJ3hP9FP9S/HqgEXFPoacBX13t2iJ4 +PRWU5hhWyfEyeKE/5FCs0VMH0unT7v8hmfwgmhYVNEhkS0BWMejkaCEGi5CLnBf QHkPI1UkKDyftGiRo0t7raLX/5EaT57nJCyKLzY5SAegmloSj/sfIYZG1o9/GHKT WWgOWGIl/wL46ou1zv6lzpQaEgb83BiutKUNgxtqZAiWOM5teui+/xuiCWhMCW6k rIk+xZyd8IxEdPTEUq0pCFssdcddaM/6WqMfqR5lU1PvpyoctacT3AaVlz8rZhij LewFZHy3SpYJmCV7aWUz0Ss/ooF0SW2F4laj8YuzslpLTTgIoFqvykE2mMx2rft4 r0AbehMF4FgyZ4YVtr0oJzf+UfRssAg3KwRqEjVJP/qnK3gZIf5V1QflkKDOSF4T hToGBh4MjxLR+vbPqSlWwCdaQVDarsQ/gh8SRdupJ1BNQEHeUJfuhZNb2lPeeiNE Dcbhv04G3dRhvUutIq+lw9LYnbtPN44ckMVej19m+FCVMVwhbN+iVCUYqdMBACF+ /muXrvQz6dhrD3W/df18a4zzC+npITzXdllCe4gp2ZDDMxEthgz/6gozhDKL9yrB OmZLmrdA7YZdXu7um1VbFAc2P9RtRAewxdQsMXkpUQGnT0hNBC7KKDbHIY8Lnlrc Gx4y4BaAXeP/uPK9jcGr8JOpwb+/GiFY0FEhLd5iyBKer9CHeNKVyeL+Z8LTS0M1 LsDY3VdapzBZrVox/uijNwbdbyarH/VPin+67tJdAEyzAIZ8oR6VXL3gfXY3MdMq O1OmjXcW2ESiYtsVpQYYNr2HGDHPfMt3oZm+RMUpsCGvc1NuEk80+6xv3PmBkJAT CARu1S1/9c7WW7hICrAh8LruhFr4dItD7xajy25iQ+MTeOiblHruX0VdhSLlBeDG Rl5EGreJO3G5iftDaKiqWX/JRvGCNrGRSrw4/Q3K/FqydFLaMscNacp8+peyxN/Q +D0l/qZ9vc+ZuOdFpHpvRzrRIItkuwLZUBkpc/Odv8NEmw== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/007D0287C0932AB5

http://decryptor.cc/007D0287C0932AB5

Targets

    • Target

      88ea52ece97c3ef87a6578a6ff5aa53b.bat

    • Size

      215B

    • MD5

      bad8d40efcd5a8f305654d21d142f03d

    • SHA1

      7e5f73600b271c57fa3f5252fbf522d22ac7688f

    • SHA256

      7b1689d0497644f88e4553f05420150c72f332950a15562b4f19d5f82510b01c

    • SHA512

      47374ec7bc76ba136b2f679650a7dc2c9b2209279f9324ad92422d2a98b00f4bf4f90e7e4686c95e2506289d2ac20ff8d49e15ee2a97952c517c63045946e044

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Enumerates connected drives

    • Modifies system certificate store

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks