General

  • Target

    5b00c321fd30e47ab9f92f8c1db156a2.bat

  • Size

    220B

  • Sample

    200605-952s7pfcnj

  • MD5

    be8734dedc115b61707e100ef0cb4da7

  • SHA1

    d74c59a065110dce06050a9ed77e332c594a7767

  • SHA256

    dd942abf87ee4e6ca4302dcd7aa5bdb1320f89a33c2b3894de45a5d23652334d

  • SHA512

    04c2f2ca6f66649e1a9bc9ad1e154f95c44a41f9a9a9575a28f0ac48ce8e648cda993e542e9ccfe085503d3ecdb2f2b14786da8af0a7f8f46342aa2927228bd0

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/5b00c321fd30e47ab9f92f8c1db156a2

Extracted

Path

C:\853gr-read-me.txt

Family

sodinokibi

Ransom Note
---=== Welcome AMMINISTRAZIONE IMMOBILI SAS DI BRUNO FAGIOLI & C. ===--- [+] Whats Happen? [+] Your internal network has been penetrated. Your files are encrypted with strong military algorithm, and currently unavailable. You can check it: all files on your system has extension 853gr. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). Also, all your business info copyed to our servers. If you do not take action to contact us, the data will be published for free access everyone. It can also cause GDPR compliance. “Article 32, (1) – c states that “The controller and the processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident.” It can hurt organizations where it matters most – Penalties can be as high as €20M or 4% of annual revenues, not to mention the negative public relations fallout. As soon as we receive the payment, all data will be deleted from our servers. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5C1D4FBDAD1F36F6 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/5C1D4FBDAD1F36F6 Contact with us in chat on website. You have 3 days. If you need more time to make a decision and collect money for payment - inform the support chat about this. [+] How will the decryption process proceed after payment? [+] After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: oHTr8V15XBil4jcnp5isZjPg8mTG5PfT0Y7WVFx6QaiHyVRvHhNhO256n6IKplLH fH+5t0Yy/C8I2TNVHK8p8+UCDLQ1wA1DTsZ8w59pC6DerVVRfVAd32ROiGbk5qBM me1VWok8XO+VNG4grD7mSa18wF/mfCUvvF2ZEtReIwGhn16WQldBHDeHLrPR6WLJ AidgzxFB78Ds8XbWsuS2ANtCGBSAizA8mQI7nQUS4WuQTwlo5HsWNOBidanYK7mD CorxzBiTPH5/JXcmk6i9FBXVYqtAZHA8V9hRoe90Tkig1UDMe2zvgPm7b5CAzqYk XUWZBLT3GT+9/hSMuIgMUEcDIaYI2Fq5zDqfv/3HY5Lxk/1r2zOpp0v6DB39Vh1w OTTHPctmrKJjwrgCDpz9jm5GprjC3M7oEzyRXPhN9Pck0ligx84Qqiumdi5bESd0 yER798fvkTflYw8aqfdqcuUtPI6M168Cm7t+msAzhJ4kVXQA9FItGOF6QSV6mR5j 6YKNY34PI9SjV7nxW0OAdLaVWYh4tyWn3c/HPv9Gbr4oR3tgDqitAomr3m8svjN6 GmL1cx3hYlxyDOOFGGvRKBykDF0kjHsfhXPq8O7d1ABV7mZ4pzHuZMkzuyGyB6PT ByQtQJoqw/Kix46Wj80N2J3AR2BqU4kD+TUITwrx7qWg8qlbvEmASeiSdNlpAnq2 UVQM3zGR2GeivHIKDnMF8it9mmQCbpUy3Gu6ki/hMMFCIrb/Vg4gVNXl4ttsOWbz ROuCLTx4DriOUjKKk28XGFw79YArrqiBidhBypGslDMqPDMFotwG8ujSLBaBZxRP rv4Un+T9M0lZzvCZDzIlkBPQCdynVJKFSHzVD7pg8K4xiriKrl+229VmAk0eQixR GVFfGwgjo539aWa8ilSpLapOB++qbNJasJhWPmXGNb8DM8JbmN5rh9+jL/wZ91vg kQcuxQ2bvx/ZF9x4Fzb0EuJt3xH4O/t7IErQN4GlfJvE3+hFh8Ogg/cFvN+GwyYv RNHWSulSTr6v0bHZQqKx/O72XnGFp7rXG7Ho+gZ2kGxTabp9hbdZvKtIYrfPw09H t8Lye806vb4iCadmUv9k7/LjSHqxqP2hw65gpSGTEiODOAeGhUdR7nfgugBpQ7Z8 2jbozbGLJXVIodLgHok1DmraAKCdk6yM5gpp9Moo0Jld9SqfjevE8heL34BBiFzP 3sr0tKgowcdQdq2ECR4PK+LnwkPlRhp9peloZIvpXa+uFy7q4X/Jf/Ueo77AUiDs +BjtubKxdwAzATQTo6XNsxYJYtMm55I0PC223+7Q ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

Targets

    • Target

      5b00c321fd30e47ab9f92f8c1db156a2.bat

    • Size

      220B

    • MD5

      be8734dedc115b61707e100ef0cb4da7

    • SHA1

      d74c59a065110dce06050a9ed77e332c594a7767

    • SHA256

      dd942abf87ee4e6ca4302dcd7aa5bdb1320f89a33c2b3894de45a5d23652334d

    • SHA512

      04c2f2ca6f66649e1a9bc9ad1e154f95c44a41f9a9a9575a28f0ac48ce8e648cda993e542e9ccfe085503d3ecdb2f2b14786da8af0a7f8f46342aa2927228bd0

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Enumerates connected drives

    • Modifies system certificate store

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks