General

  • Target

    30c96bd5d55b4ede2ca100b6224868a5.bat

  • Size

    213B

  • Sample

    200608-zcaqj1tn92

  • MD5

    5ae8dd965aa55e41ed206290cfbb9a9c

  • SHA1

    6d948a52ac79ff84600ee780122920ddd586ca62

  • SHA256

    2f7e36eabad58aa80b8ad798095771fcbd5670e8d4684ae942666ce2a086bb24

  • SHA512

    0dde15a4d13e9cbb065df025ede606e37de6f6be2fa55495891694f564a4b776884fa1eaa2b7d44cbdac9d79cb24d1d5f16ffc8d347fc3626de2959515420629

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/30c96bd5d55b4ede2ca100b6224868a5

Extracted

Path

C:\3b8h58-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 3b8h58. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D04A4DF1C363A8E8 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/D04A4DF1C363A8E8 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 8EdLINKuuQriL5S9verHvz3XS3ybYWhk8h8TjvxC90bvNZFKInzm6ue8NHEczTO9 GbnZKn5yL+DTpCfsBMVWg5fAhche+xKDQyiFKcLMJimMf11q4Su5RFoOYZekg0na Erig468ObyI7DCQupdvn07gqjPGHMkm/D/tPh/doEZI2Gbt/+5Vp6XSZ/XPJWlzT rEMKhFECCDt2vUaEt8fKGgEc7CNGa5gO2nZUTqWRXZ6gnAJYlUV18EyoYpoyCdSS SQI/e+GWSKDqDgcHbyDszNmqjBphqy7aRuXl9fNYoK5sNzwD452ExA+n5McMALGX 4lzNeFw0sOFolEuNGJGrCOUlvWTdqnXYPV4WQ6/D5L6ao35jQFhecGfrWdevZ6PG M30MtvGRcxf+hfDBYKg1k54Gt6Q/72q8JVd481TgR8Knmc7x8p1fcv05inaMXblw hvNf4pASrWqdCjMxo7j/iiI0lT4LIFf/5Tcx2n3j2JRvaabAfrzAOGu+4cTLOcsw Crgyp3evalDU/V9sIloo+QblsxeYi5u0uE08jfxDPJBX0CKN10pg8NefqXBJSwoO YiDVNkkG+P6H2HeFAhu16AT9AYpW5ymaivoGwQcjA4Eg/aoP+usLRNnhkK2kEXgv 6FN9RSJD4vyC7fovgd/Jw2KyNIEHfHEdtDsuEf6ggEzXoc+F3zpXGpOya4/yRUgx QJs5bi5Nk2nUbXd8THam2zTJrjoT8qlKmsMYTVGH7DR/lKqlb/Jqemkv1nfAFMBP gEwCWCLiOHoopIk4bC7WogEedESS3oTxRrtNFLb5etUXLzwaZ42f3hlVbPm9nu77 B/jzIzlaItT7+olNMK78PK9NWqNG11tcBKD4um+5Fq9/mEcwJkcjSNz99pXQPrUW yCNxFiBB+FCeHKDn0xoD/Y0cFFxzj4JafoD1nK/GjyBPJ2OEhz9FiaiAvj4E6+HE MlBetKT+WSIg+KJcxlpaw057RqqrZhsTkW4sq+CU3+GEqH9eO2Em5ww+3sMeHbT9 UOcinjucfl9Id5Sc++KbOnlTD8UDTQ32QyYW1dT7YyJTd6owD0IrVbmVYXIJ43Jc nCBveuqOcQTfAPaK6/FC5fniQ493Y7iMtrIvgdlNgigBcvQ532DZ4FnEbZuBTTy/ FwOXOi5GnMjWh6FLw92yeZNaYbpKzYdYoApGaiHwuQh46UavZwf1dVqeXjtW0k9a PsuA/gdf8/g6ZSleU+BZApBYRjqgi+iiVqHCM7Gf7Vr3ApzF93HADEEo0+lt7Rlt DgdcSOwJFPyUaBl6CIaIv/J+r8B+FhM9znWd0prtVHw= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D04A4DF1C363A8E8

http://decryptor.cc/D04A4DF1C363A8E8

Targets

    • Target

      30c96bd5d55b4ede2ca100b6224868a5.bat

    • Size

      213B

    • MD5

      5ae8dd965aa55e41ed206290cfbb9a9c

    • SHA1

      6d948a52ac79ff84600ee780122920ddd586ca62

    • SHA256

      2f7e36eabad58aa80b8ad798095771fcbd5670e8d4684ae942666ce2a086bb24

    • SHA512

      0dde15a4d13e9cbb065df025ede606e37de6f6be2fa55495891694f564a4b776884fa1eaa2b7d44cbdac9d79cb24d1d5f16ffc8d347fc3626de2959515420629

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks