General

  • Target

    b4c987a88b89ef8fa5c5aeba0b67be50.bat

  • Size

    213B

  • Sample

    200602-4gyy3pjyas

  • MD5

    4eb17a9cecc3bdbd9c5f740e178603f1

  • SHA1

    2789a656216c376ff49aad51a0371dd670332170

  • SHA256

    ce07460453840eb7611281737273b06d33142f8a78b30717f3a197de5471d2a7

  • SHA512

    1c771152007dacdd546e9f365dfc5221ba89223e5ecf63d2f14865bd71d7df5030331d3d794db13db7e4fd26f9825a2b02ceba7972b92c9da9f2d920ede55023

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/b4c987a88b89ef8fa5c5aeba0b67be50

Extracted

Path

C:\lu34t0c25-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension lu34t0c25. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D9F8304DE20EF488 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/D9F8304DE20EF488 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: IwNvmOBzG0tMgwSrWxdjD5kMGxhysuX32aYZS/a8GBclO25Wf2Wb8W6xx2uRkQ2I 2k7bCjkwy7EpoSN805a+XZXjXjRWqHsC6ZoUhWINFjLuWBkFQ6xda5e8779RmANi R//ZYQGmDPF6Fq7EW0ijQvZFGjhOp4QyePQ0LNaj62eIkAnm7iihWDsPO63XTeee dV84yd3tYp2LvzyfQGeFO6PhYy3+rpurcOGy8zBo0ot1EAso9dnObwYk585ZOJHM 9oKYTRKj/lqkicO8rGLGf0/aaIaMKUbykfYfdpGBpjPgQs6i97N7ddSuSO166s4z JEpBYXIs8l+EswFYeKb1Dbddyu2WDBqzfh5e0/LHDDtHyrZ7UDYCsnJnEkEnXFVY St2hOkanBGbUxocp1tfqqt8Qp8jh7TwgyBbCUpvZgvMTShg1a1TEt+npXsGOT3XR P+8fJTKRBcPzc7IZS81AQBSySiBIOYZGm6kVZ8vyAseGUG9bJ3+45xzzbSmjeVpJ oiGPuntI3fiePErCBtGmXA4YPNI4FQ3vNENagMENgD1ilmPiW1rRzq9QR4EdK/ey HmeFmTP5PKuXztf4zCEPVF5nTUgaSwetDrmQMuQqnOaVfeNdsyX5QOJ5568y1Uzp NNG7k7bCGzdmsrqSOzDOUU6zcGJMKuUy2yhT8HAJTv6cuco6xbERVibgKQM9nuVt SPcfLwLtIqNUtoGfNdq1Pd3lufHimclHMKjM3aJg0F7Rql9RC7oufCwccVj8fIxK hlVTosxUdDFy947zX/XD2zCea7/v5wwkZvS0wxiG8ALg/j+sYLPnHmIvQsCeW8Pz c56+ovl8/IJWPS9o9uHmXywCUqO67WJ/V0X4sxmClb6wy9qNVgo+YA/1jMZh2on7 vDAgesWfrLRhQ/Enmo4cpMutv2/A/Rl4onBOcZ+FwHUjsqdvmEZfx77La3UV+GtG 31gJUjLaYkpJrqy/XyBvJYOyoomJ0qbA9U1VNn1zYvN3OFyLWFz3+ZeIfr/388/Z xNfPLmcniCmpix9viHEPid3B/fmWGG7cc2svL+U9jsTCoV7e2BO5M/xu/MVG/YfM 5ZJM4Oj2QL/qOqTp1kIaRzmE0F83ggbbT9YgGTmloO+MUWKDSOQ7DKkRi/P7Ci1H 2gQGXBUpKbInYdl3oSoQjywxdQwUY4uyNl2UCiOQuN9VJ6FRTrWumDfIc1TYzGC+ 5/6PoA2ijRoRFfUxrSboMHYM2tk16y9MZqSG+8oXCZxBOSfnROcaZQ88jPINpqTX mRkouMUdJoEhbO6gcL7POw8G1gtluC8ED9CdVx4bamsstRD3PrE= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D9F8304DE20EF488

http://decryptor.cc/D9F8304DE20EF488

Targets

    • Target

      b4c987a88b89ef8fa5c5aeba0b67be50.bat

    • Size

      213B

    • MD5

      4eb17a9cecc3bdbd9c5f740e178603f1

    • SHA1

      2789a656216c376ff49aad51a0371dd670332170

    • SHA256

      ce07460453840eb7611281737273b06d33142f8a78b30717f3a197de5471d2a7

    • SHA512

      1c771152007dacdd546e9f365dfc5221ba89223e5ecf63d2f14865bd71d7df5030331d3d794db13db7e4fd26f9825a2b02ceba7972b92c9da9f2d920ede55023

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks