General

  • Target

    d4a380d12c8f386aeaa2ab8a1f33067f.bat

  • Size

    218B

  • Sample

    200515-n4729m3lkn

  • MD5

    67895090003d0e397d064545c799e1b7

  • SHA1

    b1864fd30e1c39495ed72a9cdf4744446233cc4d

  • SHA256

    3c3e7899e6b30a6296d9e7e6a4c25ac2bdd7aa646176afbea2c2dc5198c2874e

  • SHA512

    3492801a8dda9940ad6fdc7d76d3bd876fa7bf0ed30a62b8113ae39f460eeb7d28ff3b1db77b8c9dc61880be1c2137c1c3e68be77f1f6101741e5054599458de

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/d4a380d12c8f386aeaa2ab8a1f33067f

Extracted

Path

C:\m4s23m-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension m4s23m. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] WE ARE READY TO PUBLISH UR DATA TO PUBLIC ACCESS[+] http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/posts/56?s=f2adf69100849cbb12ac102ec7c6cb81 (USE TOR) [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/48B8DFF1F3BFE3B2 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/48B8DFF1F3BFE3B2 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: uWuC8Z5e7MElFWlOCT7H4iEw9jO4WwkOkAB8ldNZ/0+/T+04766Re+pfDOHkkena H9YWJvTwQRC1humophZEw0JL4zbq3/E9v/Lzch1KYKGqYbfc1jDagzvLhpF3tEbu gxSADoBi65EyHw09RATGw4NqSk/cExD5IpYsKoj1XDimePhPEXr9LHv6rkc3QOOh F2+uIow0Y6EXTwNew3Wvt8pLdE7p8R0Gm+hEq3W6tvDn78cy7iGMdkYzVVp2l6Pw wDVzMnTq5IX1xblDA464x419yzZ6R1qMsxAzU/rLuwKzeu3fQqyQHrwfIC2eQvBz KOFv6hSZWHauMyPI2YeTN4oVz5uRhoAVK+lfIj/RNq04q+u77dTAD+530T1gryEw oKO7ofSXcRa9ZiA6xAQv8zNRJpP/AVUgsJCszZMLeoAp62MzrQiCKQq4QeiaNY4v +ot9isDtdJqwJeg+o+Ad0p6EqUxPrC9zfxIoxLwp5E8ulRkHkXMplb9kg0d5zU7n B5nTbGDHtFmXKO5z6TJB3JdqEnfSwxEgppQgCOq4GZkPueXAYX6k9Z9wAw0cgpf4 UkOl24FVqnBdgs5UuWrznnpenqrnaKi1xuziMb/st0wK7vZozuXpH9nsjQbLS3pi RvunHNcLl8B/xDOSqN5r6h3PWlgR+MSd9Nm6krYtoCIIV3aO1nLLme8XT3S1v+12 NwGvTpksYs5kt2gm0BmPlsO739oABPeUxSpoCllDqA11Fzo7nWDK9Obdi9tJl+gj PkzCuOs2fde5pvIyRMwCKGmv9t8WrhorZ2AyYTc96JfsKoX+d+kh1UGy2S4cU1Sq j2mulBDk48o4wb9w/5MpcH4cejFu0v/YqZUNp03uxjW8L6hFuATuH8avdcDxPQ6B w6yEJrgOOJVJj6ZEV+IkSGKzBT2l0dhawMIvlU5CU3EftvNWA2ta4x+wj2m4cNxl 8ewYMCJ9My2Ng0QPXDAV8SUqFlSklzroh+2wGql8y9MYACesNUg2kGJ7sUxyeLiH Ykj6S0gHVcKfow1zhxF/twzNBGUTNSCzkuw3znnst7NtR7340Y8p1/E9TyQoYAir pb9Ci5rb+BNnTPuImiFOLuTrHEJklp804lV1EFsmvflTjQoB9DC6bcjt07RCrTov Purhr7Ts3a0EN8jNjJGfnOuThNLqdgx/5XQTLKbIx+XMykyEvXXvsTtS4maOd+GK 7NgjquzgawHY+oAAdH2tYcLkt8u/LuUw+x58P8yb+IpG0LDB5+0rgGiPmiXKcjlB 4SdpskCkOOtpito35NMbK6XRaLvwiMtxzf4110lWmiE= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/48B8DFF1F3BFE3B2

http://decryptor.cc/48B8DFF1F3BFE3B2

Targets

    • Target

      d4a380d12c8f386aeaa2ab8a1f33067f.bat

    • Size

      218B

    • MD5

      67895090003d0e397d064545c799e1b7

    • SHA1

      b1864fd30e1c39495ed72a9cdf4744446233cc4d

    • SHA256

      3c3e7899e6b30a6296d9e7e6a4c25ac2bdd7aa646176afbea2c2dc5198c2874e

    • SHA512

      3492801a8dda9940ad6fdc7d76d3bd876fa7bf0ed30a62b8113ae39f460eeb7d28ff3b1db77b8c9dc61880be1c2137c1c3e68be77f1f6101741e5054599458de

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks