General

  • Target

    bd978ef89b238bfae52044568aa42c75.bat

  • Size

    216B

  • Sample

    200602-3l8t6t584s

  • MD5

    f0df01a4173ce448321aea96ca779d4e

  • SHA1

    ad432c315a539443f75f5c2456748c6e8b5d5c4f

  • SHA256

    0152af15e9235a11368c7777e3d71e92c99fadbe9392a54acfab853445a9c50d

  • SHA512

    08f9b9f0067ace92197239000cc1bed35239c6cfad5d60e2e388189b38affebd639a6e2c52e120e2cf8ba58c8e00b2035ff9536d00a41d844d8df68556504055

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/bd978ef89b238bfae52044568aa42c75

Extracted

Path

C:\i6u41-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome.Elior,SeruniĆ³n. ===--- [+] Whats Happen? [+] Your files are encrypted, and stolen, we already have your important files. You can check it: all files on your system has extension i6u41. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/691FDFA67D07FCE4 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/691FDFA67D07FCE4 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 4YFQiLy5Hw6o2eNMmFYRgSblAClWEOVletwVr+UgkXCsLwnfovLtfqJchDCzsg7i GXn9vO+IJ044D2p3swojNk4uxBDkJpB/d3eDM74jE5WSrcQ3bB5CZWdzi8ezOoQ4 qn8vUAXr4Ka1GFSsWEz8z841/pKiCPNzkHSaYVhU7RzDsYpTYupBi23HBEPKf3AW rHBHDMEtA85GQbz0+jGgr6E3Jht2vqwqSyoppwhV/24WvTndUj1fXisRV5sbhkO+ OlF2BxS0PNrzagI6+DjeaALPkBJmbKmeOhk0eY7LNgM2JGsYgjYhOxhz2JreeHJw A7Ph4Vnep+L573bieaKDR1nC2LaJfjfgAeXs7A75XeAUByLygThmOaB93qOyiBcE u3C6dwtseyTFGOlfZMRXYFBcC4zmtOGgW95/UwOLQWUll1M1POBUW3LS1RWjnure cisfSI/w3RReNhyQhAiEjlSJRhVzjD7sc+nrUIWTBLN+UOkSXr8td+3FTJtZk4fB ffDLA4hW9H4NKaibnySpU+IGr7dKd4XiLYjqBKIje0+0peHe6k1bO6wQShE9WXwr UZ+7Ik7QDEiOPqHMdCfwArVcG/O/bj909Fy5KktIPCxEm5jsHWkaAIgpiWGEHLh8 Y6RamXLRGvC5ixTtJGhPmFxK8gySfsrinNgTA4MJBzo0Zl3Uw+1KCrcuBL69Qehw 4Wc7wD9BaReb7i3yNykKcsGmRVIWdQtjdX03VONNrcADeeRq+WsWgpb4l1rThNS0 ZvyWb6gsf5R1QL2GVMJKJamK67bU8FdGpy56fZARSqnWse3r4SyoYTAvKapP7bfG 40PaNLxlRkKDHiv2egLxXI0EMvSlXmF7UIsq/Fg/hX86OrJRbYzyAcp0iy7LrGCi QugMUH42c9+c6qFbDwHFiWdVyxMJJ517mDFvkgjvTYba6gb1TWJBEckNaIk2VqyB j9HyfFX8UhQWdK3cKH4WzjcY3vN303a5kwVdj8oIXCZFP6F3lvi9kWUSKvkHYdMC T6tOFXRNXf69NRnAlMMO3iadtgvBqniuduBTeA6lmJBQzVS9qppJth+YXuWGrNlr NCb6auvZ7bZZCXtKmQwCZG6QfRUktrnrk/L3rFxTmHo0yWvvT00LIBBhiTuVjw1g Jj4q8IrA+LHu4097HlWnws7tWUrrUGLarlBQ2KQy3iskSo4HYc5epF2+9xvBH15C Ku6L35ipD9Knx9wblMjjFt4JpNjUFIC3IlORjvGyYkQmnevmnoFjWFw6WB+RM/RE oPLmd/3yQ/PHUzLLFqw/hTEL73e/AV5WIRP0w67e ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/691FDFA67D07FCE4

http://decryptor.cc/691FDFA67D07FCE4

Targets

    • Target

      bd978ef89b238bfae52044568aa42c75.bat

    • Size

      216B

    • MD5

      f0df01a4173ce448321aea96ca779d4e

    • SHA1

      ad432c315a539443f75f5c2456748c6e8b5d5c4f

    • SHA256

      0152af15e9235a11368c7777e3d71e92c99fadbe9392a54acfab853445a9c50d

    • SHA512

      08f9b9f0067ace92197239000cc1bed35239c6cfad5d60e2e388189b38affebd639a6e2c52e120e2cf8ba58c8e00b2035ff9536d00a41d844d8df68556504055

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Enumerates connected drives

    • Modifies system certificate store

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks