General

  • Target

    7dd11380f39c84448a7000c280f12a78.bat

  • Size

    219B

  • Sample

    200602-lfn2kmmhze

  • MD5

    694736c7cc588c0f7d4fea15b4f4e074

  • SHA1

    322715308f98b4e097a6e8eb88c84cd75e6dffa3

  • SHA256

    45b6d83a99693328a71a689d57f8b722e4e74c34b984569bec15e1108852bebc

  • SHA512

    c93891f9542c5b111d290df367ff1019cc46f5b23f32df4b83989ba23a79215906029cbe2568c45f4226e650d3c55e50dcf6a5dd6fb382721e99f6da47bdd3d8

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/7dd11380f39c84448a7000c280f12a78

Extracted

Path

C:\7vaglni2z0-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 7vaglni2z0. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BD0ED380483BE43E 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/BD0ED380483BE43E Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: /kiBgX4IViKOmsdBSE9teaAp7eOFtKSqu0wpxqbZMDeXkUmrMAbj0REk0gqhmjM9 lGTwxWXQl4IA5VUCp8mFOMfrkapFZnHTqGDz3Gsmyi/GozWn9hWRiCIhe/DJGAFG oyAJOtA96Z8XxZEHxX+dQouwtNlXyBCATIRZuy/I5yJCnuDJaTPrlfAIJJiNvFZ5 bFCcO2mz81ZUiL01W32mQqtqiglhITT7Hjk8Im7uGsZ9Cv5939Gn70U2EchFDOWv aT8CLh0qWiDAKio00Ht2B7tlIcHeHjsVzMo906xf69w5wpa6X8kcO5KwmX71MMTx GCuyfxuYntgVfs7AQ5JGv5+cBS7eGGde8pvOeLKFEKaWAv2t3rkMDWVRtAgwOg0F 3OR6Eq1JAq07yp7oirOdihgGe7z0imZ+bSfqkfPlS62RTEDZSPvWdeY+VxQBOphX 1MA1isj1DGmtwoo4UapcjfUnYfy5uKPooEB/nchc2B9hwqC5e9QiH4Tj7Qi7q/eu 5NZ1jxHjQlR4sNTqixtBDtJeIJoUTVp3/Dew177bPc5SsCVey6xxM5yQYqp0SZet 7jE5Fe1ch7WnQtRPZy+hSJm8LE3inbK55NFTwKYqxyLFdz359KNICSW74K9ErC4c 27OKAeBJEcH2hSZcoilIv3PQ9yQV4l/cF93EXtMplCIaQMAa+hcBfzzzFkOFpr9y qMcd1SQbEU8D8hHmPathGLUU1S+S7D1docrKYxPC0GQIxmrIOJLmWqumjI5KEvLy dk2AFB1cw8TX0uZ3hHooltbhHzdw0CSSBpjvo1h6vHVhe2nd/IlkNkiwjPo2VdFY 2pMrnuFoJLClvI8zcloru9xd5RyftRB3saYfgPxx/c0EYyI7i7V5gQ1XmgBZ6U09 O83RKfpkTAjWtwnhGUT4wVRsM/KVbex3Jzd09EZfGtT52h3W6AQPea5E6FdEcOlM uuWKWxB1/sQR/HRP1YN5TpW/UNlDuaiMeaT3NgKwEDg2q4vl9szTHZB6tZdJnlef /s3ay7v5eN1udqMcL5Z4JBQ/yEjq8RGXg2uwaBv+GMZ2a7dRNhEDabPoUYSqf+kF 1gI/8aSgYMAhZOpdRMWz2QPN08kG0LK4bOs6SBN5WXzJm3d0DKW8r3FRn4TuTGZj 1Yv9/rQkgFyz4cJtgO9A/ajCO4mjtC3eyzZg8gQNa9eRfBETI0Vtb2pDABqBnUfh s8nxYgXb84hnZEZ5zuxToVaurP7SEWjo3q1nKTxsBuVaxrmjgvJ1wJ+Gr+qCqD4Z 6CC/WGqgqSN6saeYbkT+RiEvlS1qr5ZNUl5ncphzpwfzWqjsFPUKtw== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BD0ED380483BE43E

http://decryptor.cc/BD0ED380483BE43E

Targets

    • Target

      7dd11380f39c84448a7000c280f12a78.bat

    • Size

      219B

    • MD5

      694736c7cc588c0f7d4fea15b4f4e074

    • SHA1

      322715308f98b4e097a6e8eb88c84cd75e6dffa3

    • SHA256

      45b6d83a99693328a71a689d57f8b722e4e74c34b984569bec15e1108852bebc

    • SHA512

      c93891f9542c5b111d290df367ff1019cc46f5b23f32df4b83989ba23a79215906029cbe2568c45f4226e650d3c55e50dcf6a5dd6fb382721e99f6da47bdd3d8

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks