General

  • Target

    4eb6ba5ba6c21ac7744e462c7de7df9a.bat

  • Size

    213B

  • Sample

    200726-d9b88lgpys

  • MD5

    c706ae9c80ccdfa7c936b7c8df7cfa76

  • SHA1

    5ec96eaf49a1004e20f9be597ef6c78b7bf69e55

  • SHA256

    b3a094f34f9fb134e07a2e0b414bcbf01c2097dd4b14f98127ecdeb46343d4cc

  • SHA512

    6299207c06345ea343eadff3fb433da135526d9410b863388597cf41c8fb91313a78509c7c69aae221f083a90cc6347a1d31642bbdfc3ac7c8dc5a5188d01ff6

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/4eb6ba5ba6c21ac7744e462c7de7df9a

Extracted

Path

C:\4nl5390x43-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 4nl5390x43. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). We have copied financial files and other important information about personal data, it will be published on the Internet or will be used against you if you do not pay us, so if you do not want such consequences as customer churn, media coverage, fines like GDRP and other damages, we recommend you to contact us and pay the ransom. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5A83B5160AE50FC5 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/5A83B5160AE50FC5 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: V5xycx7mR9vUQY53xkqP8Py04Rm5nw3BarmZkZ2cK13fWE9h7iZbWZ9I8BAlrop3 eY5/XrPNdEErwPe0h0Mbgv3nlZxOO+OTP2NTSH5nxeltcdsUSVMS0s1831NK/c/s cC8Rg01w8gafVP1Dfh2CwyZ5PfSwhAwP+DAAtNYbgvZ0FJsePvvhvdrPwRBMT/Ej 6ULVwZidjifrBw2dtcNqCo17wT1Vw3KAKGbA8a9HwhezK0r4nvZNOlL9sS57cxcs xjTtXrlCJ8fvbumQBE6vNovSD3gii6qQsvOyjngxcFdib4QYzy4G6mVB9+f6C5zC wpAW07RV4IuWuiXyaL+i7oaXG++Cg9i/scSKjsC4O26kbLqMt5miK67AHStxlnh2 2TOt+pDo6crteAgbPNedLc1p/OqxajOJIWFgJPbtuKYKUIxY26vTaRkMjMRoDhcd V+epi6MMoDcg0CBoiCEY7YVjES6PSow0kpk5Slz4d0I7IBEIVU9aBw/SNV/GRmu9 7Qv7AVt19dKuIr2ERUldeRy2t1uhh5yC6qdV4GSLad3f2T6Vg4S9cx9VAVmCsYds 71+BuDQnHJN4fUyf0oWJjmo5I5Kvfr6yWfgiHS9T2LUzFloijNnz9syrfA6hT8+h gx3C2ZRdPzjh9QhMJEDuIZdT9R8WmKVdPhF9VTAdZwPg84AZiLOdC+CilK5c0eCT UGJr9rESm2YWjwarvgLzHSdxhb/21ZCzfxbnhkFxKma+nPQrSvZJHTqXLOKvUaNV bQr9uuXSJl/WIH5ETRFexlx3uORYpktDBtnA9wzbIevC9ssiJ1DTenfVxYFxHk18 +Swd9U8x+lYfwYXqwTttXixsQ230yl5GLhLfufXQeRToNVcXPHc+El2FikIEVdcO NJBOJrpjIOku53x0xg6Yd83scLk/6y8aAi4FxrcDUc1HpkS8WqnhnxXR2Ca26mNq OY/i3INJCQ5Xv5oy2UsJE2Au+ItQSdEckWrBynHKcp72t4wO+/bTjDFqI1LB8apC f1T8iELJQP3N20q9kxsG6Rmma810ZM9tMgP/8pkYEphJ9t3wR6nz2qseM07xaovB 9toO5mj7dY3w76Uj9PPEDRmQlU0y9Y7hbfpP/A+Xx4FoyGPglcejsbSHh/a1xxc7 4c3CKDwSsiaLs2caWW9WCHQ8FnWFI3WDCJhS1Z92fgWg8QI2Pfhow2+RFW4FEg/W ViC18sd/17aDiiaAXfHLZDiUhSkWS8UIdgvlOk6pgVdO0hhhzxUZ9GmCy6Ansd/e g5lEkT84AbWYn2q0KHcYiItMqGd2cnj01wHV//RTgJF1oUnpHwgD9Q== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5A83B5160AE50FC5

http://decryptor.cc/5A83B5160AE50FC5

Targets

    • Target

      4eb6ba5ba6c21ac7744e462c7de7df9a.bat

    • Size

      213B

    • MD5

      c706ae9c80ccdfa7c936b7c8df7cfa76

    • SHA1

      5ec96eaf49a1004e20f9be597ef6c78b7bf69e55

    • SHA256

      b3a094f34f9fb134e07a2e0b414bcbf01c2097dd4b14f98127ecdeb46343d4cc

    • SHA512

      6299207c06345ea343eadff3fb433da135526d9410b863388597cf41c8fb91313a78509c7c69aae221f083a90cc6347a1d31642bbdfc3ac7c8dc5a5188d01ff6

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks