General

  • Target

    9de315693c64bdae451a94b7fba94cd7.bat

  • Size

    216B

  • Sample

    200731-vdgrml8qh2

  • MD5

    326e8645188851fa741312cfd98964c4

  • SHA1

    fc88590aa93e65b6d4604f18df31aeb7c78cffd4

  • SHA256

    5f5d0072bf19dad6f7d88f7b7487e08d4a689d9b26d5cf265d54d049a1ae9788

  • SHA512

    e3a8666cf03291ceeaae820553a8b10a474ec611503e7e89f21a4ecfdfb3233fa4c9908b6eb07bf0ecddd9e6785d5e2d74545faa5747a4ddda877484fa872e1f

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/9de315693c64bdae451a94b7fba94cd7

Extracted

Path

C:\sgyx0-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension sgyx0. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] WE ARE READY TO PUBLISH UR DATA TO PUBLIC ACCESS IF YOU NOT CONTACT US (USE TOR BROWSER TO VIEW) http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/posts/117?s=ab401dfaff50a245d377bd31aa4d89ea [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C0D605733D083811 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/C0D605733D083811 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 5ZheYjzAoBRNrNU3dGJQEuTF5h1dDNYYvJtKjIhz7aKdG6MN4h95oWotWvgmdICG nzi0YOt7Ew/M3/BSBmg3rOoqhpgO7bwQov9jOal6eDKBjUKwJDdtLLZjhmdvIKzY Mo5bxyjjhR3Hgb8OYYc7kYBb6Hhg4DzA7AOvkHZEjc1r8RwxJwDEbo8LJ9deNbQS El6dprkdfjYk6+mHDwETb2rBZmXrQERsEzlaVQT/R2izmyeD+SB446cqoX3TnwMv tj4R+bLDw6aXtN6hT8e3nBBlN//hyfWYi6HEDX6p3FSs6VDB6dwggVfqrric8Tqg kMtp50Fktmz0GDwyStmr40uU0FJbij7s7ORQMLP9BH/Ss76TiU5lfLkFAHjavQMY R3N4YJelHGMAZJc0EJ7V4BNbxqSB3JYUiydQOjIO5or0DHvsCD2w4dDonrrXCKBe z5uxtS7YVjzzb1WLMISwLJgyqEMI1QCD57m/DOFdVV9x0dPJrKW4oy4GkDAYEWoI 8VQw//m75O8a5zJNKE04XmDyzZ1H7pF/FiFgzvE6IiDuCUB1rizC/ecGRYEvGli6 HehpjVqpowtoTwvXv9qs5ew8UIumRUAW1/Gm7gy55k2WdhEoQYt90RckBqZdFEv/ jS1H5ot1+rtjC7f+KRTb/gKXGCDHD01NOpJusN3EZVo6NrZMGoS3JR1hsufuZkgc hE353MvGy5nzdyRaPN+m+3nQ9ggOPvNqxyFlPww7lZQjahpqR7GPGiKMb5lHQc/W yGjMRxcJiVU7RRp98HNEdxWuiPnSRmSbqTOtcb9Hhen4getEndfRRN19q0LdLjaD ZmmkjeStJaZbUZpNBIW9qrB/n0wb+Delj1XZmnHWvwBXAunj4GV3p0GfGKDHL7qe tGUVj4bl+IRD6zzFGADYFtChuDmm+EOPvuACXwGh5kT6MKARaAcbP9PFyjz6sf9s gUpDTY9QeRU31a9d0iJEvqrQ1kqm/wQtvpL7Qp7Uuj8n3FQcGPwIa8VMvbhZQpH0 obuDQ/yzUrQKkQeVqWJvIa+PAe/m1V3BTniTqT3s9kVtMrb05RVVkFfcUw5S3F/l veBx2dNZsbYZ0Kfuq43GOf2kTT+wkeu/TYsu4nConJZroFQzLWUEVoCf4RICvFrb a9xqUisqNeHq4IqpiLyIiOOqMPlWMTH5KQOxz3OTWPVkFNuBpfqlqiAZ9kYNcUf9 od7p9PIaLlHaO1VOcmd1HnbaaDQkamvvIjhOr7HMJalUFDD4WjL4wXyp4NLgN+pL jxlpZ5wBCLZFFE3Lydoh+u26jFaak6exD77X9J91 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C0D605733D083811

http://decryptor.cc/C0D605733D083811

Targets

    • Target

      9de315693c64bdae451a94b7fba94cd7.bat

    • Size

      216B

    • MD5

      326e8645188851fa741312cfd98964c4

    • SHA1

      fc88590aa93e65b6d4604f18df31aeb7c78cffd4

    • SHA256

      5f5d0072bf19dad6f7d88f7b7487e08d4a689d9b26d5cf265d54d049a1ae9788

    • SHA512

      e3a8666cf03291ceeaae820553a8b10a474ec611503e7e89f21a4ecfdfb3233fa4c9908b6eb07bf0ecddd9e6785d5e2d74545faa5747a4ddda877484fa872e1f

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • ServiceHost packer

      Detects ServiceHost packer used for .NET malware

    • Blacklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks