General

  • Target

    55022f44a9c2dac0916e9db3842398df.bat

  • Size

    219B

  • Sample

    200515-qegrjvaydj

  • MD5

    07ea4461f7fc0758bb7fb455966df5d9

  • SHA1

    2df15ea78ad89a7816a69bab5656274115bed854

  • SHA256

    dd540cd255b16f023dee940fffa52d054726d7f2c1c9aeaeafc4f594a3e2a5f1

  • SHA512

    b0ea53a6359157114b09bddf227d1bfedcd7db302c356e99e1086b736fc003b6a2f40647a6feecf6f5642104bbf8e7b9a49668c29a5f1c0857fcf1538419414d

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/55022f44a9c2dac0916e9db3842398df

Extracted

Path

C:\8hf7h555kv-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 8hf7h555kv. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A44A9E362E12D1C0 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/A44A9E362E12D1C0 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: am4uYZPArBtlvINMK1D45Dpso+4truUgS6TcUoPGN7B9apsiobMu9i8Y8GmN8AUo YKqagjKqjwdmmEQd36ZHWjHoQtrligCgXiUT/kR1shaaruVEi0aAhCoWcCIsFirb 5X4uNXKXwzlDRiui2ZiLVqQpgKo2jntaxysWBRwzyxgVEMHYhRswire+rGWyFHEB AH5ELsetkXZiPwrDB3dU4FNT0USsfdE7pyw9n3Aznt/ieIralFc2xzvFvaj6HOKF RaQDPA5X6AffiDlTJhC93oojllJNOvyJxk7giofOt3oappHiHq7eI6alw6GOJnFM cufF7Mp6scKeHQo3VtfHLlJn3hQXwVQsTw9rOaHaY7kTssAHnhw52vTBd8nNhNhR B8ZB2O7d064sgrP+YJ6lHI8HvGppnbDk3BHemd0TQxFEOnDxm3FamRuBnhLhVFd/ q6H+O4Ohl5F0AaxXgflv26h3dU+cF0zPSWuwLUK1xbDJTU9PNSCHi20oHeWrHRSv b3KQ0PnH26VRE2pHQOgttchl8sf8HyYN69HmUCrvp3Fsy9Dp4DI/W+cYw25LbLRj E8F3oKpXx0jew2cmoFNkUdbIgJhSCIvVST6EGcGqR12egDQv1DEnOba1L1PXP12R sv/K3vAx5/AJn9v9+uqzopCZ04quSNgA8QwaM7I3FLtxXmP2a301ZNLgytgpjrKT xrkl66eQ3cfmBHEg1mETyHnysg8fBt3/0yDnitx7SOfPjuq7aUQSFxAKzSq/LP21 m6S/ecorj+XdP5S1/UhScDy3ApTKEWbYhpo5sJPb+5wgsbXk+eIv9jAl6nu7XfNd X09J4tCwXAA3VSWugMShUfrvamMHjQesS0xH+9VMPAM+tI6PXjycDys9B4LtNTl6 vHn3zRIj/XPpNH/nz3e6FBQq3WY+HHsgdETlgD8bHwQKqpXAJBhwO7OcnsYDq13d QzWEQGDuie0D2aolOAALaRlsmn/Xd/JTLipSwRWRfxslK4IakBLBE2uNNMPEOAA3 6/K6rQk+2AvV3yQtrPbO6Ror5F/Wea1UbOIYcZJ//aY5vUsl2JlQm1PtGdJ4IITA oQE2oOddxhCaWTLVjrlQMNEyp4q501QJFB64alwVOEMeZ2Kxo+R+6Euy8s6tDnRD ERg26QiOOqCQv7ALJCw/BbHrMe9fQyNT9bBVq+EwMFOkANtN9HpKuPrK9WdcSiQg S3t37xkG6ObfsWxpISjDXSMB/trejJbaZoImUyqx7aSj0RuwFTxElyB0PwzL52o4 GmekdHFlYalG8S8Lt7v9qKBZclytERDs6NBhz2N6U+luIT7zixA2og== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A44A9E362E12D1C0

http://decryptor.cc/A44A9E362E12D1C0

Targets

    • Target

      55022f44a9c2dac0916e9db3842398df.bat

    • Size

      219B

    • MD5

      07ea4461f7fc0758bb7fb455966df5d9

    • SHA1

      2df15ea78ad89a7816a69bab5656274115bed854

    • SHA256

      dd540cd255b16f023dee940fffa52d054726d7f2c1c9aeaeafc4f594a3e2a5f1

    • SHA512

      b0ea53a6359157114b09bddf227d1bfedcd7db302c356e99e1086b736fc003b6a2f40647a6feecf6f5642104bbf8e7b9a49668c29a5f1c0857fcf1538419414d

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks