General

  • Target

    08d62202634f8b1ef5c5b10ef8db5891.bat

  • Size

    219B

  • Sample

    200605-7gvc6ppwve

  • MD5

    616c257a819adb60eed0688846b302cd

  • SHA1

    bb40b235e005c837e96ba5ea9ceb2748952808ed

  • SHA256

    78996c71b494d4588386237c37101c663c8420c13e7615a1955195ef483a0e05

  • SHA512

    bb70e6beb231053af8ebd208547aeac3efea4570339377530dd88d9dfae488c85adf06d515e90d2d99d76f16f8a5daac52992ebabcd08e1523d7569d224755d3

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/08d62202634f8b1ef5c5b10ef8db5891

Extracted

Path

C:\2eicj9-read-me.txt

Family

sodinokibi

Ransom Note
---=== Welcome AMMINISTRAZIONE IMMOBILI SAS DI BRUNO FAGIOLI & C. ===--- [+] Whats Happen? [+] Your internal network has been penetrated. Your files are encrypted with strong military algorithm, and currently unavailable. You can check it: all files on your system has extension 2eicj9. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). Also, all your business info copyed to our servers. If you do not take action to contact us, the data will be published for free access everyone. It can also cause GDPR compliance. “Article 32, (1) – c states that “The controller and the processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident.” It can hurt organizations where it matters most – Penalties can be as high as €20M or 4% of annual revenues, not to mention the negative public relations fallout. As soon as we receive the payment, all data will be deleted from our servers. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/6D33E591A976E8C7 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/6D33E591A976E8C7 Contact with us in chat on website. You have 3 days. If you need more time to make a decision and collect money for payment - inform the support chat about this. [+] How will the decryption process proceed after payment? [+] After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 7QS2WNzx642n4n08Ar702Q/NX6YoVunQ7DGZVTyEWQEPmPD2p0cvZ4fzZ215eh79 vKrq3UFDxmJ4Vu5d/uV53hqdR5lG/sblQw2kTBLFYi1eh+xaEq3GAN9KtJi1Bnoe ZrqlNHV9b62aNXxgT8i/6KwUTSV167C8L4wZhiQxn2U2ZfDeaWvkNP9Y7WOhN4Zk VGs5KpMWbq8/fIq8vwwBqazVMIyh7Rd35gzUGcono95SkfYSgu+wUKYOMj9lQ/iD pBwZyfDZ9abP2SL3ECBWRrq7oVOvPYOeTHuip7KVZCuz5KvQx9mnqWkyf4iwZBbX uC97eYJt7zxMeIzSyz3gORg4A5zgpnVviyZu+iFc9TM+CLJYsHcLHPxPc5h+4XW7 wc/8ScQq8pmSIWCZ4Kw6ISq/VaFAfqKMx5eDF0H2/hcqDReiY3Vc88NeX3t+0GSB 5KGMlkaaOLU+Y7e+V+mA7qm+CtIAyuys5RNF/RTSk6d51oPkpdgR644EbbHpUXv1 bLFE8cXfMMq95p2xZOs1pNWawu1be0rjciqxxP114VGl2i8vtRAbadNjiJhoZ0XE rFyjZU3ZiVBVfLXEIkzvYED0cx4qK3xoVl+EGRh4z1weWtnjoJxMS2S+ll39R1xT 1yrSDqNNJOeOsVXhXTkwCPXrWmV716N1Zbefq7IS7ESz2yJpYJjQtMsnFolm8un+ ErHimJdIaXLJLrqP6F+VxsgjCo3hG/eVGMMoG3+4h5OPa7TGb2eftFy0wK2d5Rbj e8uJzgljZPzGZVzbvVhoIk9IQ0vA2NtH6Rs5d6vlArERhhHNlJwhAjAatcWudiDW vVSHrzN5vxJH7h9RyFKvm1Gz8V67lS59pde75diF1+sPHM8bXHFJEBP0e+X8gmcy 1+meIwTV93PTFgrRAI4s4GHjjodSDTLQ0nkVi2J1zQnCreZwhb4Sb8oF2IARoMmY YF60oxEzPb59k+pWjPwZpvNcENEwoo7TLeTAoKgVyu5btMElRgAs3nJ4EqWxQWHN 9t0C5gUC7fSkXwgwy06kkqFcsZrq8R7BgSmPoP8HGfepKPOUk/HkDLxezGRj0h+n Ih3wU9w6KgksQQhV/SqNnB6NtVmHP34saABlt9/uXsEYx0RDK2LPF/9YkrDs6cU4 hft2ftJKpHfc7xQxJeEEYkExU3WI/tM/idRinMyfBT2jnsSoyaHdmifCNv2RnXH5 q1Cf91kRX91La9jymPLiNAcSae7uZwqqbxGEd1Fu2epjk5Da6mOGl0BPMmg6DoA7 c95ZLIUtic9jg6wFj0Obj9sRUiMIeGELVu+agBGbgBM= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

Targets

    • Target

      08d62202634f8b1ef5c5b10ef8db5891.bat

    • Size

      219B

    • MD5

      616c257a819adb60eed0688846b302cd

    • SHA1

      bb40b235e005c837e96ba5ea9ceb2748952808ed

    • SHA256

      78996c71b494d4588386237c37101c663c8420c13e7615a1955195ef483a0e05

    • SHA512

      bb70e6beb231053af8ebd208547aeac3efea4570339377530dd88d9dfae488c85adf06d515e90d2d99d76f16f8a5daac52992ebabcd08e1523d7569d224755d3

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Enumerates connected drives

    • Modifies system certificate store

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks