General

  • Target

    99360af9cc861d59bad7a24e0049269f.bat

  • Size

    222B

  • Sample

    200515-qb488gv7m6

  • MD5

    2ad8582ff0dcde1f8bd57ad18112a3ab

  • SHA1

    3fea34e4ccabf59c98ab20e4e1461db09d3a9c09

  • SHA256

    59b5acd22e28997947f8bf93c568b5825c9d053840f76ce881dd638080c3cec3

  • SHA512

    f3c5e8611e68bba7567da0723c4236f95480b0962e729ca5741af44e87994afaa87b84e2d18c86aaa890301bb87972e1ec5812aae5b931e9b6e9068ab5b4c977

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/99360af9cc861d59bad7a24e0049269f

Extracted

Path

C:\w4087hlo-read-me.txt

Family

sodinokibi

Ransom Note
---=== Welcome Northside Mazda ===--- [+] Whats Happen? [+] Your network has been penetrated. Your files are encrypted with strong military algorithm, and currently unavailable. You can check it: all files on your system has extension w4087hlo. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). Also, all your business info copyed to our servers. Personal data of your clients and business contacts extracted. As soon as we receive the payment, all data will be deleted from our servers. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5A6DF13A92924BD8 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/5A6DF13A92924BD8 Contact with us in chat on website. You have 3 days. If you need more time to make a decision and collect money for payment - inform the support chat about this. [+] How will the decryption process proceed after payment? [+] After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: V2rJ8S/QINdtXnF3FvMlJd55Rv+OgG8hD1qJQ7SWIl8sNGFJUTl+mTlfjdDSiUZ4 g++GzuEhyv46MSnqtUGH2Oa55haVuJbvRrFXbgD6wZxphGc/tFxuuArNAWMaxPqz S8KRo7UxcnRGbIGS8SmraRM0p+sA9r76LLmcD3zPNEQDht8vkfVGiFDcg9u09c0b GQ+EJbAcH6aOM0Ft/BEQRgQa3sbO4enqE1GYhEtjv8sIpF3Xa2FO8VAr4fyxhBZI iIW+oeWBPhncxWrqvVXF/wSZu+cvZVlvpiomuyn9makEYOp6aEjgQbhJwvSDIpvn 6jKLr0UaTh2aO2KG4zgLDAzp729zokGQ5jWaSikCIFKSD8ZxTUFNVWFkbPFjo+qt wQnFKFqqQwYvXdEWAa7qQ2pgjBd8tTQtng8qnZ5TW4G6k5hxroRNlF929FXZqJWx hxx+E9SJxZEhVxEVd47PNArHQFNWzh4Q8deRlrNmZCxZe6+mrORdQNPWvuXLJZpN wtLwBH+nRlIW0TXEAZeg7SlGp9CtiGWukSI2yJ4niZi1Y/O6heuggmjA9jMsOgJV M0sOfsKjns0v1uafIQa6OBLyuJVU5+JDspW5BubUTweo/XxCmoF8sita9Gyw6/CT NL6HLreZmnWcP0LNpZRP3O78gzu7JY2NBTcCTThA/MxLj3Qbh2xL3AxE4nlh2pMh JnfT1MBQW9VeUhCwav9GQFHctcRd9HXUdjEtXLrjJWsEgIyKLafE++0HapDOTdYY t3PBJvy/ilY6wptSW96CjTMqpOO4UPUiHfo3/dswjl/eg6ZRwz+YxgjjAJgcmNua fWQTFQ59su63EqCRm3n35Ewk79XhSxuAC+OSavZUORtH77mFl/58LBT1oqA+yvJL GtHJvKQzAqnWpL4cO6IpBGc+HE5ZVoXjcABNTY2wARhrRJnwmdDDUqwF5QwZsNXZ peQw4MNiyeKLHqWOlkEDX+GFwXNRQ3zZzz7Z2HQ/pLrlhZueoufEcG+6Du8t/PbH w+zRR1jjdV748uKC+KQdW8fKrFs9Kl17gG35xK9QtUGWdcGCIfh1W8XQ1co6iNci zBOkRHaq+sVIzcNajYD5iE4WXB/xrWUFLCdBD3gsZS9Tv0Y2oW91ienonoRKjMS9 ChpoeD9z/022FjaIEZ/Jn8nV06CCu0NfirxdSLjSNtzvLhBPQIyAXEysFZGL1iHf T/T894/D5BZLwLHSiR2KEWniGzZm5R2KJUE128IOrq9UjobTVb1SxJ742VhKgipf w0ytAfgnT9OT//pU3pvbbGwq8rRedonR5T0gJx6LctFoSv6U ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5A6DF13A92924BD8

http://decryptor.cc/5A6DF13A92924BD8

Targets

    • Target

      99360af9cc861d59bad7a24e0049269f.bat

    • Size

      222B

    • MD5

      2ad8582ff0dcde1f8bd57ad18112a3ab

    • SHA1

      3fea34e4ccabf59c98ab20e4e1461db09d3a9c09

    • SHA256

      59b5acd22e28997947f8bf93c568b5825c9d053840f76ce881dd638080c3cec3

    • SHA512

      f3c5e8611e68bba7567da0723c4236f95480b0962e729ca5741af44e87994afaa87b84e2d18c86aaa890301bb87972e1ec5812aae5b931e9b6e9068ab5b4c977

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Enumerates connected drives

    • Modifies system certificate store

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks