General

  • Target

    4f6a42934f34216c6420c04766ae463c.bat

  • Size

    218B

  • Sample

    200520-4zr2w86wba

  • MD5

    d7072273beb15bc6b69f0d896b3c3a67

  • SHA1

    252dfb1b0b89545b3b431bfde9c616a85236b34d

  • SHA256

    172b87c827469bb03962118ed3294645fa65025b5ed9de5157c0f7d5b4ebef27

  • SHA512

    cf89e740f3547dde583dec727b45569f2c3a5d072f01420d64f6bb6651e54dd8c3a3bac098f3fa59f61311e99d65fbde23c1d96562274e1943dc9b28ca69cfdc

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/4f6a42934f34216c6420c04766ae463c

Extracted

Path

C:\9zc68-read-me.txt

Family

sodinokibi

Ransom Note
---=== Welcome Luttrell Belting ===--- [+] Whats Happen? [+] Your internal network has been penetrated. Your files are encrypted with strong military algorithm, and currently unavailable. You can check it: all files on your system has extension 9zc68. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). Also, all your business info copyed to our servers. Personal data of your patient and business contacts extracted. If you do not take action to contact us, the data will be published fo free access everyone. As soon as we receive the payment, all data will be deleted from our servers. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/045690A9772B7A5B 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/045690A9772B7A5B Contact with us in chat on website. You have 3 days. If you need more time to make a decision and collect money for payment - inform the support chat about this. [+] How will the decryption process proceed after payment? [+] After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: moFaaHujavRxOSFjlfp1IRWP9eVr470LJvbnpkj+06ORbC7TXYhnUmSj5w0c3lfe v56vIWwmFPgojywCHzxM+OZ8eN/9Y2s8iKs48W0L3RI5vK3FefJ5Ov+It8dKRXL+ M0Sl52V6dhCKIu3FQLnViq0oPPQ/AnUuNKXoEdXndrJsysQhicvAuU7t7too3GgQ sa8Sc50YvVbTh8s5ImcQpiLbmd3lQv0sBTXKH3utnjlbtpkuB4BedtN+fEfJEqCk NQcv1urDTo12nkW2Sq4d+orL7X0YIMxVf38sZ3dJAcvAKDKGu+acJx1XWpBBuE57 91hk7kBxfS9Yecc+ADjU1cyLFR7xYtaD7EEohu0aWQKaPACZo0wlN/XsU2mCLnY7 ECiacqfqVzw7jgHM1wSkIrgqrAarNIbImt+Hs86OyOlwgqt+ZOgpJ8thGBNjfIxo YmCoaK42Urm0pw6al20qFrK/WyAEfwhGHVtdaMTCJsONVstjBKUo7lYh9Fhyj6EC TerQ/r3hJgpC16+2hBRASipfIGFkBJXECiSTBKkt5X7tvrWQFYe+c1PnC4guUNqJ wZLT4HIMUtINZSx4AYOuvPoV2p1ItImtgnPwiKMnTE025PcPy+nUEdmW1TKIC6qf Z72wb4zTFTRNMTUuTANsBQVW6URHY9JoQ0jLa3CZcgVVf/5/mkK3VWUFtpci/3q8 ORBb8RY8gSxdGpvUU3wDS8ZxpK0bdZzYeC2EqvC1fvH6ugtVo93SoK6fXW22wlFh 07jsXuO0K2YXRq+00gdAYm6PqFtGl0m7tNqj0rdjc0FxKE0yYRedvci4PC8GoQZB EMV4ipoeowVjy3bsmbsnUxs7Sio07LhKCu7jTkBaHi1gfeefI/ju1orKsSPhsq9G frsDWw0kIpwhoJZ8WtOiheX7XT6RBqw6N5SoQ6WR5nJc2n8aEfEO5a67Yxe37+x2 zi8091JFOCFdeG1pDyH7zTlSqzjj9ssFbTkNOhpaUfjaUiJbP2QQqsU5yQXmi61t A3HToiImLSA0bD+qBwanEO8VTAky3s95t553dauFR6RZXnpK5nLByehl8/3PZOwS kAwlmQd5SAVPkbfST1n1sd6cdi2l6W5NbHOyU/bOCQcUWW7QtgdG1TskFwZ5eNb9 +wGcpI24ZTeb71KUm6g2ourL7ZdFegAKLbW/V50/8lwKpMokn4puSyUSjttIRE4p dzy0XNprnKoKwKa0DkWT+GG6XE2SW4ZAPBR+C5JXaWiQ21CrPQiPKRBrtFLTn2Cp roXdtw94XO4QJaRyxSU38H7uOsBeXwypR4uaHeKZ ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/045690A9772B7A5B

http://decryptor.cc/045690A9772B7A5B

Targets

    • Target

      4f6a42934f34216c6420c04766ae463c.bat

    • Size

      218B

    • MD5

      d7072273beb15bc6b69f0d896b3c3a67

    • SHA1

      252dfb1b0b89545b3b431bfde9c616a85236b34d

    • SHA256

      172b87c827469bb03962118ed3294645fa65025b5ed9de5157c0f7d5b4ebef27

    • SHA512

      cf89e740f3547dde583dec727b45569f2c3a5d072f01420d64f6bb6651e54dd8c3a3bac098f3fa59f61311e99d65fbde23c1d96562274e1943dc9b28ca69cfdc

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Enumerates connected drives

    • Modifies system certificate store

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks