General

  • Target

    ef447ab5d2ae0a9d701c838651e09c94.bat

  • Size

    222B

  • Sample

    200601-8y6pgd59e6

  • MD5

    c5368e48c478684dfe98d32e80ae5937

  • SHA1

    306390ba49636df25818c32788ed3fe603394007

  • SHA256

    80a177482b2efdaad3bf92dd550933e4a859bfc987e2511c301838d687fdfe86

  • SHA512

    080141c425524360ce79c56e3de9f7196c4527001ed7c763056876ef2c5dd078a9751f7e3a87a0914928327b218428870e07f979d1c26a29390112142df55fbe

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/ef447ab5d2ae0a9d701c838651e09c94

Extracted

Path

C:\ak80t6qf0w-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension ak80t6qf0w. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] WE ARE READY TO PUBLISH UR DATA TO PUBLIC ACCESS IF YOU NOT CONTACT US [+] [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/25BA0DA33B40EBC0 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/25BA0DA33B40EBC0 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: AEqipts24tPSywk+1CdbsLGeTpnJ583lIyZv7H3ioKtkY6zmd4fFLAhRDvts0L07 EpQnd0oV8wHQJ8g3eAhC8upbq4Y46PL5iIlZSiJe06IlUBTvOXuOIfFqS0ibxABc 5mPSf+dLKYCIg7vuJdYsSXDFq1m6OwUVcmvIS8NfA410ok/SSUHIQetdfVgXEhbr hH/5wJ0yp/HGgH1of2h72xgzybL4AiSXtTPBVILB/L5bp4Sda/zHFT8NoQ05Xavy SGeIKM+G6UtrWsVlDTXQ4XCNO0HszjIjfQMz8Lsf2Ogjouj6Rq3FBLQHJ6IM91qV Bnr5juccwYIK+2QEA971IYfadg/ClAfwWffO0umkaZJm2uvp645GkngF3omSqjqw gmso9iAtreAkLVUdG1uJAEJY6AvYGnMoKu7KrerXgq2+WADlgTn0PP5KLYuVtedP VNj9ifM3USSyRNAzb8JV7wjdrTyYf4hKTnDLWwvK+y9WZQFL/uNszqaxs51v/BtB SwHMASrNWHUVxlaVkHXyzaH+1iOV+MmeXvyXISh0sL4nsmrHjOyzNM+MU5W2l+l0 HDAgtBMNkJWEImjn1JdmkkUJq0FVzI00BwWRoa/JxhptqGtN4A0Q9D6+EZnjXZMj EMS2Lx3DVd3MYP/hmbkmKs+t16n5N1WcfuvH6quQvvLkG9WxhsiQDJHc5IaiCdUD 410nfAj9paYV5nme10b31rUjtV6OUVCe7GVRlmkCw4/swp0NQsd83CpgtNIz2TJJ e96d9GKFl29NQmc9bSzsLdRafwafLMYyfk4GEb380fpxR7EFEmRu2onj7AYIF/MT TpILiP9J0+BULTknxagGN33dTJVvPUa7O5cNRYz9q1An6B2zxH551nVN46Y6ewGb HXIzetBuHBbMyD6yc6Y64fPCqtXl+cuvhEGONaTmRf/xIrX7O4lz9pQB3bsqIDeN nTznhUfZngHRPCNIqFzTO2xR6MHhOfkXIoyYroCs9Ml0g1F5fGYDEswNrT/gUPFM /raC3psBCWcZ8oZ71+M7IPeWOpFKmwOvcERkLfY8/kRJLzJ5SuKPsRfk9YqP1qJy VUX0LvbGaiTNUjYafmvYgeOf4cflYD7HTNaw+Aim1ic5wc1SOrgPGwm4rg58givB +n3BKx+5kmIQwXNtmX8jkP6xbqEcD7BJFqlbpzFjMnOBVr0Qgxwsxft0sYtEfiAQ yumuFZFRqVczqxXDXUGBKI1gGnOrInuqdW2Sc38ykfZCRzT0LecQgaxh25Fg5KqU QEZN3D9HQExUa625FBRHA8eyl1xOw28ZeTxb0OiaRgXZgDp34zqDwA== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/25BA0DA33B40EBC0

http://decryptor.cc/25BA0DA33B40EBC0

Targets

    • Target

      ef447ab5d2ae0a9d701c838651e09c94.bat

    • Size

      222B

    • MD5

      c5368e48c478684dfe98d32e80ae5937

    • SHA1

      306390ba49636df25818c32788ed3fe603394007

    • SHA256

      80a177482b2efdaad3bf92dd550933e4a859bfc987e2511c301838d687fdfe86

    • SHA512

      080141c425524360ce79c56e3de9f7196c4527001ed7c763056876ef2c5dd078a9751f7e3a87a0914928327b218428870e07f979d1c26a29390112142df55fbe

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks