General

  • Target

    f4bc334e44b117b825bf6ea74bf8306a.bat

  • Size

    213B

  • Sample

    200620-ks6pb98vfx

  • MD5

    77b3d11eb5df3e1e5555caf2db33be1c

  • SHA1

    1e66e03c4214e808d5d4b796d372938862be3cbd

  • SHA256

    94d5147f9349eb4d28ca422092c7f0d81b4085c4ca82d9a88e465ae8d38edea0

  • SHA512

    dba1003d91200c9f488ecf18ef70bd5177914c9a69d811185bcff4a7e0512419db4a7698cfc1a8618677c12d8f8d9b5322102e4bf8898a2c5314d48e34da7606

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/f4bc334e44b117b825bf6ea74bf8306a

Extracted

Path

C:\2nrqa8l7-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 2nrqa8l7. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5E94B57D9460FBBB 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/5E94B57D9460FBBB Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: kheI0yVJAhoNrdrp0/O4i1QPDOuXgE7BG8ucgUO0sBcGd731oj2mkLAHe+0YXeso KZKl55FOdZRGaKJCtoJYKOJz72gVXceVtcY2TnE0Xt3FyQPqw1XEMOL8e77H/a0n pK/5vTP8omZ0r7mvu+ZNSaoqwebC/HUO84vyQdgC4HzeaRWff/q97TNUr/7dmRgb 1NSECF5hLv7s/vjFbflwY+GmotmpPq6GjvbE7dkTsdVuynTvtDP1KNmvQXKzxfpF PfWEfydCAZGCb2ILd29ecxOzoe9XO88pdPNE+fXIJmdZ1BKT7OMZLZMq7z+FkMbp I/KZq7AmWInR11tI4XlnwMHQEtovZEV7VtauRursN11wZVtlKss///JDGiPQz3O4 AGGd4MiZqXUriX7CmYfNYNZqtA54ClmiY1ksDdw0i0Gx6GWS6KmcY9tLGSB8WoH2 AG8obCIgr7vMEspIyHvPtNpdcP6fn4f7+1Enzn2K+2+xdf5yf7BR6wqygFVx2wed Gu79hB7CDJaNSucn4ah03zl2p7vajBqzRlI+zZ1IkqGQ/kyt0j6njSanmmZKZNRC FETbeDNgpz04D156lKp0/N5imiiUbP1T9DYX+IccjejFk9WmW6g8ckxtN/WUqemF IRMeiyeousFrznfW3va9LAQtyHJEiB9wfNPUDygkR1mbNw/GFgbhse8yUvwLX93b VYyhy6UcBUMTL8hbOYaEGon82flQFedJtQtkRq912/zLIXHUE2hqWJc3Rwj833nR 0PT1h4rYU/XMCdL+t3THzMnhlOppfS08iUO6DVxJmyHfC+UbK2IZCbAYUxmTXyOO H4tfNTtJoOca1/E4m+LOKJQ5fqWqrNbK9J9jVkl1OCEm9ZrKcUw7mOgDjRmltO+N g6A1eLEngqlmX1p/XYzMP6I97QtY+VsXHwn+UbZnG/izjmnMPYEAwOawG/2T3MCO 8d8FSGfQXydN5FGe9dHCC3uML9kBti7/YIDYIsHKpromMtJBCY6m7KaKnj5iXGWW MWE9on/O+HQ5gc9CIm6Zp3th7HjCOoPZpnkKN8flHukKOFVffgw9aZJ//vVSIbAs r1qI7XxtSdGe9RSFwHnS1qzSGbVQ6O3WpS2MWjQ47zZ/6xC2R3uW4bpV51/R55wx 16nv5qorUgNjM6UpzDwpsj2yEOjcr8thsC65UJWc5DYAo2zVT5gaZa010mINJjZE VveLnYnCNNASAtRcq5ANlkGlgoN5Tz9k+BsGDY7BkUxjCW9ZFHFWjpyPt7BpfZc1 NRaNQsIm6O00TWMMVbzHJuTuj2uU78Rw9JXiEXTL3hVUpkdu ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5E94B57D9460FBBB

http://decryptor.cc/5E94B57D9460FBBB

Targets

    • Target

      f4bc334e44b117b825bf6ea74bf8306a.bat

    • Size

      213B

    • MD5

      77b3d11eb5df3e1e5555caf2db33be1c

    • SHA1

      1e66e03c4214e808d5d4b796d372938862be3cbd

    • SHA256

      94d5147f9349eb4d28ca422092c7f0d81b4085c4ca82d9a88e465ae8d38edea0

    • SHA512

      dba1003d91200c9f488ecf18ef70bd5177914c9a69d811185bcff4a7e0512419db4a7698cfc1a8618677c12d8f8d9b5322102e4bf8898a2c5314d48e34da7606

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks