General

  • Target

    35e5f8eb351e284b90bed66d0023236b.bat

  • Size

    214B

  • Sample

    200620-v7jl3se1jn

  • MD5

    e2fcc310d8119cd0904e78336960fa89

  • SHA1

    de619682273fc1b7211126601c0e1074cc57e246

  • SHA256

    1c34218a57d25359c281518cac60c8380aba32fbeea82e9e61585a0c33db7574

  • SHA512

    349b96ad50dbb441a256244f07e83cc22f96e212c50cf91ae17d372259c9a37af69e3b548e6a396886b6c50b26da816b897704579916deff8862c4ae77ac0fba

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/35e5f8eb351e284b90bed66d0023236b

Extracted

Path

C:\t4sq3x-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension t4sq3x. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] WE DOWNLOADED YOUR DATA AND READY TO PUBLISH IN PUBLIC ACCESS IF YOU NOT CONTACT US[+] (USE TOR BROWSER) http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/posts/95?s=5217f460ed11f8ad24cd554955668a2d [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E12B58AF1A942FA9 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/E12B58AF1A942FA9 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: sKpuXBiO9Ic4k7wYbuCsEYEIgJ7+TnfRacFhAaVgLtpPaW/ehsZKvbYcUtzmpLOs 3bgx7iLqya03yebAOJdYVLFfGFO0TmkaV+SMBZuqwjW/POlB7MnLageBy4inu2PQ 5E9YCBxCtXTSNtDwHxnz0Ha8xmjS+qKxl9YPego6N9nq09yYNScIyc+D1Sf+uh1c Lsv4QohAvO6QQAIo0HWAzYkLG+CPWBw55XeLHBVeBZxXd/+sYwHEXuFQKcWvHAFJ 7UbbX5EmGdUEbsz4vKRMDY1aCjr+JbSpcYm37dNVArA7I/y+kFROL+TKifOlQ9jn Xad/YuJNrC4ROMZ9xObd5vibsQBut0l5GASN35wPm5K0AzijFlL2ovS0WNKIF2kn NO0R8sO/74plYMvRHro4TD6NBvxPZ/QtOXcHGmbmUf9Nh2MtkZzVQBUVBs7Y06Um XVskxunD08qcY3PEXIFoz5gNaG1yylBUDvfI2YYQxtmp0PAro0Ihlay7DD3ltzUG bn+E68H7wFhXBadg75JWL+UUgjV9dHx9lT7s32K9amz+IW2wun0Z9rvmtoWuMpWQ KwRvt30kiFWx1joZSPl1RdTIQT92dsSyB+hVNIr0jZBPTKQmXtxgPZdCR2pFt9+g TNA0sm0blMmC9EHkL6pgU9/PkkjwWcsnvPckS0ZDQTbtXtoPCc/rfZ4UOGmTsWol mxh3fQ+/IzlHAqRB/I0xxxpPwvh6AcMdVr/V1HVKPgXi1REFXNZ/6g59Xuy/5Zlu Jg2UJrpuWa8K+Tgyy+pg2BS+9tQENY3lqwfgEvQ4eF/Wn+ghl3vbOsIGnNQeG/Ms JRlYXe3VljOsejHfYbmhx9tkDJYq4vUUoem1TAkAX5fs+TDrjELrYEKAkbjXV+kR lnxAJTBuWMTU8KC45ppv047G3YRHv01lQ1JKkb16EE+LG4YbHT+AkHj0Vi+aq2WB pp+Kl4pyIQod69P9XOaCNqPf3ykFoiPGhzt3HJXblpee5faxGn1+9imG8/GQi1rI Gi57Pe3p+PN1aQ7J8AyOdBY2TSN+iXPnC57VF066NzDxYt0jzVSXuw0N+pCWmqmV BsJEM6Vxidr3kbnf9X6Sq3ogDun3SjDaNq5dDAlBzc7Fm2XURGWbZXOaadFy7a4Q AJ3mW0J7VL1McuIw+fXq6Qz7oOSH+Ji8IrT9E6N7yLnBazIH9jxXOR5iqymesqkH S7EtSLfre6YP0+B5T8hchbIzwmf9bjGjUr2IYQAeAh9NGi8kXODAJNEKCZl+ppWv HahIRUzRkXX2jGVUBWRd+Hw3euwWGqs78v8T3fnR8Y0= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E12B58AF1A942FA9

http://decryptor.cc/E12B58AF1A942FA9

Targets

    • Target

      35e5f8eb351e284b90bed66d0023236b.bat

    • Size

      214B

    • MD5

      e2fcc310d8119cd0904e78336960fa89

    • SHA1

      de619682273fc1b7211126601c0e1074cc57e246

    • SHA256

      1c34218a57d25359c281518cac60c8380aba32fbeea82e9e61585a0c33db7574

    • SHA512

      349b96ad50dbb441a256244f07e83cc22f96e212c50cf91ae17d372259c9a37af69e3b548e6a396886b6c50b26da816b897704579916deff8862c4ae77ac0fba

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks