General

  • Target

    b0d58156fab428d26b46727824eabf37.bat

  • Size

    214B

  • Sample

    200602-arcdr9x68e

  • MD5

    80701ef329f0effbde1182ab9f26be31

  • SHA1

    b948c5f5d1d8d2f7bb793db6ed2119d8143b8084

  • SHA256

    bfecfd11f233e3531ec0241d1186c28fd737e3b476a51e4000312296ab8c0c1c

  • SHA512

    f2a24c2587f2621b2a9d571522a4e0126af41f482d2e942579c199acacb98a4783dd03f06635173f59c6e37c2ad55f8778a7c0841e4848dee533ddf232ce5b9d

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/b0d58156fab428d26b46727824eabf37

Extracted

Path

C:\70f6a4-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 70f6a4. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5E2B4ACBB61DFC6D 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/5E2B4ACBB61DFC6D Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: GxmjrCzyQeNH1FlGGQDxvLkR+J3lpO2S+0jBi+tKvB0w/Qml2KLnRfVNg2aOscHZ Oe03VnTpSBvpBwFg3KabtyelDqauDLEj7kt2bbvum+HaU+up9rWq2oSImTZYJbE3 Gl/VChelPlviDAxGFacrh08WYDfAAoxAi9edSKiqCcfcy2NcwbFqlkpwpalUVI8j a236R2j/zBXr55FdHafI+4Jze99dz3hHiHEEU2UeiY3CIbekDW6tp4qlFQyVcaLG WCNPULVZpDGwpLlwracd5mK5zhODMBf44YQUsQgnUwzchAuGXxXmlBlAz41vkhlq oWrnvPpLdiItq95Bfkaj41VyVAZdgY2ZVpfFVavaSCMI2UcunFvzqWhcdr4/10Xy AbA3zlPuaVvMP4yxMAk7aNE/a72uf5+tfN0lfNBchceVtLGYGZ69VavXSMf1Izzl AGpjbaffnqAstATNQwbiK+kHVYU2mLh6UKxRFh24q3SrB1ScvqOs5o2WviaJRbxz /vTIlSO/9VU8HSsVgfqPuxKlOOqUw6jDXeBida7srY8iKeBiTF46HxNyl9KxqVF5 xLr/4f/P2SK6+i0EYtVJJAAn6x/ubfEeJhiAM5u2HkUb3rtXgFPVKQ6nILFjJK87 uRoaqGTp4+PX775Eayua+BdgyF0WuAm7PgAkNK/4kcte9lSU9xcBJuuWaATNAvsj qBxf440jqCrKOK8NFD8epyNv6QIeGRtkp1/oaLmfRR/fhfdmlhUvobgnlMIgpu4q 2pCBjha6RDlSh/rwf95dsZkn7+aenw6EbxUgg7noNDJLrmsFKj1nw+LDvjRJkQYn csyFpMLJwn7DvYL5G5dC6wlXfwIVjXyAC89xaRcaTWgsogwGRa1WGOz5CAGDJ3Yi HwkZE6vsjNs7gLTjElqKhXE4QANhjui0pSZFKfxoXFeNRgKBJ5Bxrs/gPf0UvgkG IDs7RUD2ETVEoSlXenW2UBOh138U2me54klxCpVp5bTtMut6fSolaFWUPMItEmuc bRpp0uU8fpEZvtCFwJfDKvUP+fcQXiE92jBS2G+5uMQ5bMKD+l+HZm5bd2PCJeEz y/EGModnN3fgmXHYaNf5hY61gFe/XieGKDTOEPdCiGPXGR/dJ/w/yT3j1gC+wZom yDUMSmmiFQzbMySs7qXU4CrdTO9WRusMr54RSnzjZKfJjeKidulh508YRkVoK6SK i3e6In6leZOLvBp6C0km/blreO3eccCAJGJ4ykXm0/LPLMXub8Xu2rF8p00K7gB1 4Lm2whNj2S5i2Kk58PiRyprMxoq3ERkYZ9pENvptsUA= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5E2B4ACBB61DFC6D

http://decryptor.cc/5E2B4ACBB61DFC6D

Targets

    • Target

      b0d58156fab428d26b46727824eabf37.bat

    • Size

      214B

    • MD5

      80701ef329f0effbde1182ab9f26be31

    • SHA1

      b948c5f5d1d8d2f7bb793db6ed2119d8143b8084

    • SHA256

      bfecfd11f233e3531ec0241d1186c28fd737e3b476a51e4000312296ab8c0c1c

    • SHA512

      f2a24c2587f2621b2a9d571522a4e0126af41f482d2e942579c199acacb98a4783dd03f06635173f59c6e37c2ad55f8778a7c0841e4848dee533ddf232ce5b9d

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks