General

  • Target

    b63535d35f9c9567c0746741d709d3ec.bat

  • Size

    215B

  • Sample

    200519-w2hsrnw3lx

  • MD5

    af820466ba8a425cc2616229818a51cf

  • SHA1

    9b8b46c04b3e16d6c6b98db7ed9423b2c7ba78bb

  • SHA256

    1a887694ba9f6fda88acd9489627ab0c6aecb03059490ece4c94af2007d9867c

  • SHA512

    eb7f0b0f20201774182cedd5df9a0d22be50128cac83341bccee3521d86cd8f029f2f921b54fd17da28ffc9be3eb579dcd12207be8abd4c109bc9148fe59b186

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/b63535d35f9c9567c0746741d709d3ec

Extracted

Path

C:\03jxs-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 03jxs. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5F471805E27ADD53 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/5F471805E27ADD53 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 6ULSKQjVw5Jnb95s4VD2wkq/LnaCSRsXkbc/FD1/gPCeAKwhJQJHRIRbxK2zfNZB hsaukMk+1DpkuYybk+Z5ob7UZ2gCqolUlhvC4ci+c0moO+Sjs5tTTovOElno09DR 6sdN2Jiu+lZUdY60lJBXKgD84VGK8oQcn7TBB8///MyTyauBNFn2utf+So32g177 fczbZJp+s89OslD6KoLn5o9uion94NmebcaViO3fDO+SdmCMVhOPb+WD3CGt5Uqe u0oyzJA/abBpxrJoiiBH490ijjiQ901zB+KuucSOoaab5nJwzTUGln72FuNGrL7l 7WzAebE2GBeNf7AI2IT/XS5IgECan0EX/Vj/wSQ5ba7ZMIt8uNxh0QpNGfj6yWTy WPTWdwCr/lBvPC4rLHtnYFOFIqJUGGyRp4br9p1tKaLsYrVr/VFcHVZR9OuQIJ1e RH2TiVKwFjCdnsmM8oWa9B9eCadGmWq+MHFkMm0MLSXC0daL1dx0yDvS7SsWDTcH m4n8goAJtevsWsFxcuzgDejSStDfyg543bomtuViU9zcdXec8b54sMhIxrwY3UuA PtP0QsrQh1bjlIJhYDDQ+0vO5sqt9Emf9TdhgH9rvNhTiHhscPiUrU+yn6+xANI9 MDRZzGtU9em1aVKYAKUQ2nZGByZY9fz0cyrUuoU3Ugh7MXnbeCCT5TKnL4EESueD rcfG7oUmP46cfS/fexv09Yek2VXh5m+Hatk7X4ifHgfIaGIu9HOqxnt70IFh6l7R Jh07DbeK+5M5OuFKb3ez8KbA09wpZGXFn0272bW3cIDMRXdofaiDHwtdjtrwRcIc UcsUqGiIOHNkZlFY7tdUgraykAaoAv9lLdlIv7LSI3cZar6WW8dgv7RxsF0LPzL+ L98ubf0yjivBprvi5uJ73Bp6WI2Uk7lFSz9r/L3f1KAgXQAPNzQbFIVwEQ+nvf9g 6BfYRnJoDb9blLgBDaz219aoLqQY2Nf/GcA1rxMtCr60qGD9laqOZc3RJ9Rk/Z8D HtSVh75lOZJ31Am6IRU0jygwrI4JxTAXUjHjOpQQFvoqNdgXlBC4Yahm66qnXgXz 1wTxH0CWhhKxzJCLzu/cL4K4FUHyz7DdykTkxy9nEd3t2rUs/GjCFeiN2WgUoeBp XqG2b2GE2hyfdDaaHHPeT5F1eB266s4S2PapKq70Zl89nXMr/tNgSSIpxnnr2ZWi bxmpYht6K5WpTazne8UGqR+UCljvcvvy84Dq0+PRmL4VQqm/R+CjgfsEyTA4ejeR 5eMnl8yd2/+FbMkdSuhDniMMNnXFMK/ROvwsdSiF ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5F471805E27ADD53

http://decryptor.cc/5F471805E27ADD53

Targets

    • Target

      b63535d35f9c9567c0746741d709d3ec.bat

    • Size

      215B

    • MD5

      af820466ba8a425cc2616229818a51cf

    • SHA1

      9b8b46c04b3e16d6c6b98db7ed9423b2c7ba78bb

    • SHA256

      1a887694ba9f6fda88acd9489627ab0c6aecb03059490ece4c94af2007d9867c

    • SHA512

      eb7f0b0f20201774182cedd5df9a0d22be50128cac83341bccee3521d86cd8f029f2f921b54fd17da28ffc9be3eb579dcd12207be8abd4c109bc9148fe59b186

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks