General

  • Target

    4f48d63ac6b0afbdd886788e6f8ffedc.bat

  • Size

    213B

  • Sample

    200629-wtrzar8lce

  • MD5

    a993965c059b6842adce33d63976a3f7

  • SHA1

    5278807d8c213fd3d37f5963caded7f9a8bcb809

  • SHA256

    0cbfc1e83f332a219ecc239f418d2198df69c296bfc963df07d1f9581da8a16f

  • SHA512

    6852c3cb07fd4dd0bb479dd95870c29e06b1b57c4033ac9ef862c46819c7a71ebbcf62d692aa367c25e5b4839c13c44e24bea2a48c14f575fbf3c77e5bbee142

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/4f48d63ac6b0afbdd886788e6f8ffedc

Extracted

Path

C:\55812m515-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 55812m515. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/826F3FF2E34267A8 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/826F3FF2E34267A8 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: sm6YZ7bv+Qh57c5o+YoWXXncGRFX8fM6KvQ0sHrr8DqJ1IvojZVGvjnVVjIuEtk8 JmCxGQ64RCDjExuF5kEb3+BQhnF0YmoL6fNPphQ31n+jS8ZdmFlEV+bncGUnP+f5 fMQ1ZAkORggffHhW14X6K/rooAmcBR19bmqzzkil76C4/uG5+MrrpwRDYpRyKwi5 pdwTdDykmIk11ve3Uik0FLTJKhycfYNxL4aNfqD+6HDmvYof5bwRGaStyPMEwfl/ WipQBZAn6v7fEOlQ70Y4YyQbmdWEZoL/yRd9f1W+EurfNWEl7icuwwctCB/pkg8C d2Oplkl3UlMSnVvuepor3fubfydakuGIEde4UIr2Ul0xUGOqKBFy+1K/Kchb2Z+O sfa/d0d+z5UYU29ZVVZ5vKC/8aW2/xelGJ+qCqVb3J7T2CCP/vQabvqnFVAAJyNl YY2NdNmBhQra/PnZtr7RkOje1Tdmx7Dk+ZFD2YCmuJxR6Ha/SBhOf4a8HNC03Zf9 I4bL3O0ZdMuk6TlHVx8tDQDk2FLDsX9mkHuXvRHLrrCjf733FcvWpEl49JBYIun0 kH/3X4r63HrUR56ilK1hxCmu6HTGMtXyCFmTFGak5k/dzoVNbTdoksa2kuBOfnqO zrVku3jdN+iEI98f3bFL3dnE0JwGOZdhPSiIsJ9hwOyjQmYtI8X0I0FsfZ/zRHzg 1mUaIH8arSwz6OPV2RddjuVnGmPKYOnHoOOWqLgaMcDse6fQgj8iSwvAoU39VJMr fuKn1T/Q6Xs+7iBwGy7ZlxSRU40BbpnfoeB6tXXActV28pKHkRFXZS2EGzrc23hd 11JTH+CT3HijwaDg6D39TekkVndS7kIV8Losxz3r1B2wMF23qNMgavw0bZhbvDVT j+kHLPzDxzW+VlwtpilaCVhYK/mwhbKj2HcDE2kZmRQDWzD/W2bIVqx+bPpccRas uBjk65AsPjSamJXi8uagFDCng3TsX6sovLAGdvyHKNVPf1mYYe417wcGC/4hlAfx Z2pF99/Ak5k85F5hATO/97P8eIFuFTKCVSLGqJhm1hpOitnpnKyfVYS2AgCO+/i5 iTaltZ11S1cGv/G3OxCwOqGCG/mFE8vhPMN8WdJbdPAvcHpe47I8UuP3aFT18hM/ oybv/4n5whH+kBInpcgonfAmJee0y3RMY+9TS4ZGlFAYMuTBEccyuk0ro3oqZW/r d2Ex5O5XqG0MLnluRgsQZQ0Wx4chIF4Cair7mJIQUiTbiUzOgmwlenP/3bZEG1sN vurfiHsE23x2+hqqD1ME6751y0abaNIb3FfI9pt/rjGcX0aXY8E= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/826F3FF2E34267A8

http://decryptor.cc/826F3FF2E34267A8

Targets

    • Target

      4f48d63ac6b0afbdd886788e6f8ffedc.bat

    • Size

      213B

    • MD5

      a993965c059b6842adce33d63976a3f7

    • SHA1

      5278807d8c213fd3d37f5963caded7f9a8bcb809

    • SHA256

      0cbfc1e83f332a219ecc239f418d2198df69c296bfc963df07d1f9581da8a16f

    • SHA512

      6852c3cb07fd4dd0bb479dd95870c29e06b1b57c4033ac9ef862c46819c7a71ebbcf62d692aa367c25e5b4839c13c44e24bea2a48c14f575fbf3c77e5bbee142

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Enumerates connected drives

    • Modifies system certificate store

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks