General

  • Target

    c6ed6f3350ae9dc790540c8267fb38a0.bat

  • Size

    217B

  • Sample

    200601-a4wtsfnwcn

  • MD5

    0c60f7ecb1fd2c47aab73585757398a8

  • SHA1

    34721c29de0d1d81960abd13d7c0f25525e584f8

  • SHA256

    23f68579cba61c408f614172efeb479148851a6bd3da41ae3c07973ae5cb258f

  • SHA512

    90b9512cee57a6ec7969a611ba125bddb5bcbed3fb3ae2cb83c897b8ea1a2a8f3f006bc6dbdd9c4fc8608c0486e911979856cd2e34806203ebc02c70c6b03b32

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/c6ed6f3350ae9dc790540c8267fb38a0

Extracted

Path

C:\ymlt1-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension ymlt1. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). We have copied financial files and other important information about personal data, it will be published on the Internet or will be used against you if you do not pay us, so if you do not want such consequences as customer churn, media coverage, fines like GDRP and other damages, we recommend you to contact us and pay the ransom. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B5220888DF7426CB 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/B5220888DF7426CB Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 3voEAhWTkubVXJFBwcNQ+5ii7B+fvbN+MkRYrJW4ivPf99BP4eav1gXTa+fe5fSH q7RlKsPzI59eePaaOWdpXjbleWa3KBUhFPVq1yyrKUH4iOUH7NtIukML3tjBMs50 gt9/ORAXnkt8aV8pCSrjTG+d/yKJrf5aEZTI8kkqec3ac5pCGljVn2X/XL6vAKkv QyFZxJ741QzG5cH3JSY6BruEkVWU36t50zCUuCc/peH8krYVDphScA6lsQBdtdtM qkQe+KdvdLwFQxRyfN1vPLPMuKi0BlxOfM+3lcSlQivXvE2Hm3sgctcs9xpsbiPP h4txOdZfftbQa/0lFRCq77vZ1LY15gbYV9TluQYSdziln3lcgx4S89HOODcRpng3 JZS6cNyORe538Zq1+bDQRe11nNVOGR3ddK970efm1aqpGjiCLbq54OpdcY2AIaKt 9nUwBuvoY4+HoTuagj7KdWgXwgW1FFpEAPnOAVY6Tvw4nFvVWpbut2IvfdtOG1YI WApbMAj+ZVhKB5xBXsIPwPDT5Y0W8JhHw4+gD1qZs/10t3Yensz4apvwcO/ShQCH or2oA1RaaYeyP79AA4bK8mqPfidkM3Fl/Dbdsyv99OiuYsyK5UYSgajiYtLl4jQF 9Rb4bBk2kiEPEqzEXQCRPUZA263ruhQr2wuM9bZcWwW7WNooDfPUrTNmOCwVzxNf YNDOqSwCCm4xgMaGSZ4FZ3BDZtSDJQvoZH+yQhFjUW1jXTJL2cEJgjQXjITaJdzu L7nSO7SCwNr9M9kTd59q1rTB/Z0i8OUJqsgRPmXq9b3ybbQxPXFd244N9EETCEUN GpXumTkR5Vvl/FR+JvplkOOenZZqv7a/vb+Pxwzlt9bJOKFkKRiuJ1eSbg+K1raU RgnBVjkJWVKByBQgbwGY8dj0yXlhIxFiu01UHkYyQh6tmX+vK9G21JaG6hqw8BMd Lu7zCDje5Nu9EfybkbOX2uOY7NHqdPlzTbCqx99IK6ZM3ruOp2sdVtuLPLjYw/pP GYy0Z7qDwVmaZ99NhKMsDLXailF7LnSla/f8961dm6f2VpugCYUBjm4Ra6+xPLBR O+wmJireFHEqT8QlQtdu51L1QgLCiufZLfo8ZXzas2JdV9WJfVMQbpwZGgUvAHIt SU6iUPZDUI62LQ1nja74rCY+alvcCRtIjLBpdkXC+8KMIFJEQSORD6Jl3KXdkhLe uVAnvf9ElLp1uQZMkvk6dX2rlOpJShIiuCkSyh+4FebE2upEMeHhjgN2P+y1+2wB QG2e0CLIR4l3XpsJwJCzy1i4nGNE9B2Mt7tw6USM ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B5220888DF7426CB

http://decryptor.cc/B5220888DF7426CB

Targets

    • Target

      c6ed6f3350ae9dc790540c8267fb38a0.bat

    • Size

      217B

    • MD5

      0c60f7ecb1fd2c47aab73585757398a8

    • SHA1

      34721c29de0d1d81960abd13d7c0f25525e584f8

    • SHA256

      23f68579cba61c408f614172efeb479148851a6bd3da41ae3c07973ae5cb258f

    • SHA512

      90b9512cee57a6ec7969a611ba125bddb5bcbed3fb3ae2cb83c897b8ea1a2a8f3f006bc6dbdd9c4fc8608c0486e911979856cd2e34806203ebc02c70c6b03b32

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Enumerates connected drives

    • Modifies service

MITRE ATT&CK Enterprise v6

Tasks