General

  • Target

    e311ca0dbd0eb9014f1e66e9c74a7634.bat

  • Size

    213B

  • Sample

    200612-4k8m3f5k5j

  • MD5

    40fe3c2a1ab5a72052998d4af7cff154

  • SHA1

    4dff0fbc5e91e076066f61c666c1a7da294e0d33

  • SHA256

    c9587e50149d6b16f99a0ec810f89670c4e75cc8610641973f55796712ad8fb8

  • SHA512

    bca3682a5e819a086ef4102fd599fe8ea60d5737c005274af710a378054da7f4251e719b1ad8c799b6d50b51787fc7ce81956a7f3f5f6f533f0c0c403a19d280

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/e311ca0dbd0eb9014f1e66e9c74a7634

Extracted

Path

C:\9402gukj-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 9402gukj. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/2F06AC9FA31C1D27 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/2F06AC9FA31C1D27 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: d8jFn4NIxVaGkYYcw7cbpKB48024EZ/bNqDe0DWNRwi4fH+M6QT6Lj+lD+qDJmEd v5+hdocPKaUaYSW7ruNz1aDnRpRisN73CYn8SqhzVi2Z3U6wDzugAvqoNOZL1Ycw XEM44QZCN13uQ+5OgN90+7Zm7ihrYnjLa5yMeS4AqRWl+HazRxEuLH3yD7MMMZcN iHC86XKkvEeQu0S+VqMzXnWu6T0Wbs4GB8KQTxspoqnlLuPLqZOzSmqFzKxYaV97 vykY/M+QKUD/fxFlZrDETZbDPxVQkr6sfeQfLxRgwlhq2crjfkoGnqHVBbMDHWpr 4L8WTNLfKF/5UEaBlBm7kFnWkrh5/xF0XnQTRMLw0IibzkYqzrkBkRlTY8qzpWDK lY/nXAemc+5qijhni48D4NjHgYdccPm7QVRT5LtND/GLrL+ydV1AAJvo5kG63ADr B/HTCPCrWHlwCie/XaRxAtfi1EDhdD3bKYTz9xVn5gY4R1dUZJxTFvl4MB8o54YV oKPt89Cywtr4J9/RjrUTx0bWPVAHmBuv+VLh7DKhBthEf8WVrcGS0fJw/G3VEGMu MlU/H547rKPijDQkOBszQBJ7p4wXj98We49u5GnSlmojDdGryLHCeB2Duy0XF1tP QyL6yDrjYkXfJKP+4vX612URPd0fGw22PiWhvk/uQQUDVhpH4R2WuusJvQYeSdjX lDbD5A12sr9yDpjMbEGHg3Wpg9HSvspJrtH2ou0yMChAFqoPLtjycerGrtUFUW2I pRd7N8Wi3ExAvSM6ntT+XZRGmT07MLfh9IcF8+c5TqYhRiDiw9W7GptRfj5y8HSK /UR92Qa2LuraCSIBkrygGh9kwJs7RcHFt8BzOB4sroWVx8B3YYSv/1aFtui5hGrF RqOAWp8nmfukNI4zcXofp1JiSEqYA/zcDxqtvaISFWRzoGkxm5zv3tnQKaBWm5+p 1egPlVBQ8o3M72oFWgv0lAdMvG7DtfKut3g32po8QrqGVnZGm9ciqrKOxXNyVR1C 23563MldM0kdpyHz/69HhU+r567TA4un/ZweSjcSiuyZSkDmF/VJkcmt6wJmpQdv ktVsvCQDcVmJ+UhtoG//jGPospS8+ky98yCbvd4/msYaZBPmk8qOjQRsb79saXTx esB4wpO246kAXh4x1xEYnZjMuo6CcCYPWbVbUZ2TKNi9FlWy/VE9b4sMLygV+fPV 1Xiv1WoA5Vschol/NxjEsTyD7YgIzjYgTjCFV5oNCiejA9TxVLaE5CgdNd2I0UDo W6gQF4r9o1DNi+WFbQASB7VnTSI458eWeCmE31K9fmawUDZX ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/2F06AC9FA31C1D27

http://decryptor.cc/2F06AC9FA31C1D27

Targets

    • Target

      e311ca0dbd0eb9014f1e66e9c74a7634.bat

    • Size

      213B

    • MD5

      40fe3c2a1ab5a72052998d4af7cff154

    • SHA1

      4dff0fbc5e91e076066f61c666c1a7da294e0d33

    • SHA256

      c9587e50149d6b16f99a0ec810f89670c4e75cc8610641973f55796712ad8fb8

    • SHA512

      bca3682a5e819a086ef4102fd599fe8ea60d5737c005274af710a378054da7f4251e719b1ad8c799b6d50b51787fc7ce81956a7f3f5f6f533f0c0c403a19d280

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks