General

  • Target

    a1ced45242d2149282fc0a7230280012.bat

  • Size

    217B

  • Sample

    200520-fdr261gy8j

  • MD5

    41b00aedcf17cecfbeb6362ce3bcd14f

  • SHA1

    c18a004d285abadf2b5840c9bb31c5cb9ae3a80c

  • SHA256

    33347fdae792b3a0eb66bd0476b6ddcfb4aa1334e8a0de8a7f0aa8b2d07daa50

  • SHA512

    1f0c5e210b4485ba274345201f4e5e5a5c30e5d217a347835ff2e759a8522f322d7428d33b9a529ad134930f9d65ccf642f8c84be93dc8cca8aeac40061ec455

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/a1ced45242d2149282fc0a7230280012

Extracted

Path

C:\qyn76iw4-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension qyn76iw4. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+]We have downloaded your documents, databases, documents of your customers and etc and ready to publish it[+] [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/364473B984C95D99 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/364473B984C95D99 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: JZ+G6s/9SeVfzprwsId63d95HYs9muSM7abu+s99yiFJb/DKf6Dj4q2xFq0v3Pu3 xWscLi1Ios1TnXzCxjWKeJif+wfm5e8s+CSGgLYhyXzXd/GQFqPL3eN2llS6PIsw 7qJY6AYUfsKR1Izh+osiXO00VQrtfoBkQsVNIr+CdMkrSlM2gSKr25HHIOQyo2gS slWf+bYfHP/YVKX/9yIzan8SwxOrXwn2PkSDPdH0VMWplXUEVmLt90sbrBZQ/yCh eIGF5KtNylR07zwGrMrgy0KJwBYdLvBim13HaItEOUItQP9tYhnfSvu9zv338z06 FDqqAVHkdPh3Lc4zEv7Xrw0lbRX5pse7yawISHtqeznOYC5mLySlhMT2YFiSTgmy jdbuZWeeGzleIKn023ekg+LIBQZ19EeY8Co7raxWtg713Wpx/IPI8ikwggpCRY+w IsDWqeFN6W5+RBH1SETHmVROnNA4YBbn1hl7W1mG2cLPaOCaYZkjSBsgAWxMnigZ 2Y9/vYf5VpnXAD32HhRB65vINn5OknyYZ6X/wY/8n2gquHhNYQ1SH+uAwCtecJsz zKYfTwaHzKtYpnj1PNIv4hMTlS6RXr5Y3DCyAV+ZkXt755MEzr6rMTWqP0JkhUOm YSxwygM6hpw2RXXiv6zGEfN62z9NMufRwCUxrcyOrj5dVk2kuxvIN/cm4MGrf8yi hl7GCXY/n/WqwnF1P5o6KUBbt1DcxTYFtmzgneQ4Qeue5ENJ6k4CKdxNvYqi8qQS spwZo9ughl26pFpgJ/QCFnkhyZIOtbclr+fYjWHg1E0CiVSi8IqSXIa/DKXNSg95 RBjOF4Rp5NhRslGwmyBmoh9nWZaCG64DQWHneRCzWfUQJZ/K9zhUVr8bYsAIsLwP QB6FvPOFrS27RBDGbMoBXihnyXgv9gHVT2jZg21xyLi5bD6/6e3fxUX271FH9L69 axQZZPFYGxv6tE1hFJHyiTQKct1IOUHxJzPxCtVe2QQ6dIjaEAMqV8PVf1AAKbxE 3YGWUS5IZzMv03aKOOjKxrl8FTrwTAQIU+x1z9Pk4OA1hqzPm159gS/rTExXdEOl 8XfG7EgOI3M3HGTS8P5Se1dE1JwGC+pyu8SOc2lrz/1Ab2JpFOKbrd/7Grg/pizr QupEBVe08EBEAusBS+sCXZ2Rgxwp4DNsHaOL5GGcXrCDvApXlHpkc/X/kIDs13uG tM08aXAXa+jT7BF1pcszVVq9vTd3JwBOJrKd2kR6UBYGfvz1BRJaCNiQd/fYeTxA peL0/W9xyijHVKZWT27JHsOEAl1Dq9eNT2OqjK1vcVTpMQ/V ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/364473B984C95D99

http://decryptor.cc/364473B984C95D99

Targets

    • Target

      a1ced45242d2149282fc0a7230280012.bat

    • Size

      217B

    • MD5

      41b00aedcf17cecfbeb6362ce3bcd14f

    • SHA1

      c18a004d285abadf2b5840c9bb31c5cb9ae3a80c

    • SHA256

      33347fdae792b3a0eb66bd0476b6ddcfb4aa1334e8a0de8a7f0aa8b2d07daa50

    • SHA512

      1f0c5e210b4485ba274345201f4e5e5a5c30e5d217a347835ff2e759a8522f322d7428d33b9a529ad134930f9d65ccf642f8c84be93dc8cca8aeac40061ec455

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks