General

  • Target

    57b8d7c9360eb6128db3304dcfb1f349.bat

  • Size

    216B

  • Sample

    200525-avp33r1gan

  • MD5

    289f5081ad9d2578da55acb1a22535d0

  • SHA1

    f326802298635d66b7d8bc9c84ee9f9e2dd6b870

  • SHA256

    704944436e9ff0dff889481902b320ce73c1479d15bfddadeba11eccc9de1f4c

  • SHA512

    5eb166eade908fbbb9d6baacd2cda114d06620644b8082f6f2c2cd5918b2f4d1b18fae626cf6a609014f376c431972a846a22db36dfbb341b5aa025e1fa37e4d

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/57b8d7c9360eb6128db3304dcfb1f349

Extracted

Path

C:\qq5z97o6-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension qq5z97o6. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E9A5298CB4C3D401 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/E9A5298CB4C3D401 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: x7RPbLUK/ZyV7YOneEWAi+5/LAuyq6UulEO7mfJik8a48WTEugqZ1cm6CnM7qNzs xPt4mHK6042fo6RLvZSWkf4hWNsbMh/g3a78KcI2/Mbv2Nog9P4kiCgBbd997ZmO toXQotiT80pKeAdGCwE2Grs33bcoBpnjB8pQ+QZ+uZtOFQrpEE7Zui4GBWn6zMo2 RCqiT7pMDYppcc7sAKGA0R+ytcLosD3K62Tltm8rhFHkrnuR8p/u/F6JRPK8q0f0 TUaHd7DKDoy+4cBYAvm+PPxlN6q/NRShhTNeQfL5SPMs+g90AzKSdn3cQ0hW1I8V s6YvhVDHZXixdYeWzZ2eku8VdUymb5/lQ4VnhjGy/SQiDtOTe6sVvuuXVWf+fcC0 8LBE+5ZuXoUOxSW76SuJjEO8ia1J9OZM9MrnLZ2BXtUWcP6pBIoFo9unwsyDF7Rp IgX7TW2opP6/s619L5hvAC18klq6T16O7AyrYvoTIwC4HiVgan3OeK2G+xCU8qY1 CrpL4vftrzWfxji2b4dxbqr9B510y0KEmJvgb5QP3UI5NMPzXQBPZ7jq9G/YZoFV tkgyGCyM5Wb1ckfvDi6PpsQ1WAFbo1K7Dy9acKgtfu82gDvA+tJh2hiDqCWep/uN 1cpNupXBhA6fbw3oFZS5hYAFmrjLuzWQITwh0lmsbrPTjTR8mxCDS1pp6YC1C7Bj t/6pYNebzE2NyHFIwGXbW9UF5PsKjwj7kl007iKX91Kd5TeVkgIhJ8V9r/ZBvOct uxspihTHWnV9yM2bfNFICafiyEzfcFVA6LJ5nCE4WpARGs/jQwyXBbKyk+gce5IM 1g+4iR6Oi0lsEXyhO1vwj/7XZeVkbG4B46ZELC1y6BOeaUBSeQbXKSI5rd359p5t 1Q+IhZy7lCQ23BjVYhq0dzKkQRrcGvpOxq+6BOSd9KIJpDW1gb4EG5A7IXzB0q7C SRaADVlB6gMStKSzDbxU4DR/GSRAER9zqke649msgfpTk53ZSFmvtSWe8nlr+I2O +h5oAMcOw0/jfc1JmvOguA/1iJhvWDDMyJUu2n0zHq9oh8Qf+Vgzi800IRygfebr nRhbzwhh+oyezJKP3cSKfK46sPZ1v/ydgfTAbDcevDypsH0F59V5ttqEiR1BG+FB FFk8bt+wiX/q1Zvg5Nb6FMO0CqaB9cV4y36YYDt7ZZP4euMJO8nq2dbwQitFeP7q sNwQuEdBMYMZQ/yRdXhlHX908fuy45FhMrl0ibHZWEVg5aH2PNcBNtFF+vusmj5T nO4tv2dpPCrovF7ZGaiAC/dfPAUd/nYZUNMneW1+hZ3AyWLk ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E9A5298CB4C3D401

http://decryptor.cc/E9A5298CB4C3D401

Targets

    • Target

      57b8d7c9360eb6128db3304dcfb1f349.bat

    • Size

      216B

    • MD5

      289f5081ad9d2578da55acb1a22535d0

    • SHA1

      f326802298635d66b7d8bc9c84ee9f9e2dd6b870

    • SHA256

      704944436e9ff0dff889481902b320ce73c1479d15bfddadeba11eccc9de1f4c

    • SHA512

      5eb166eade908fbbb9d6baacd2cda114d06620644b8082f6f2c2cd5918b2f4d1b18fae626cf6a609014f376c431972a846a22db36dfbb341b5aa025e1fa37e4d

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks