Resubmissions

04-08-2020 12:18

200804-5gbaqg9a96 10

04-08-2020 09:10

200804-cpamgtpr22 10

General

  • Target

    c7537637f0d43130ee366e47192dafee.bat

  • Size

    215B

  • Sample

    200804-5gbaqg9a96

  • MD5

    fbd7beaf39f98a9eb0c56a0e772d389f

  • SHA1

    73f16802c6fa6a0c52971bc8d8a04eff13c47a84

  • SHA256

    7172e83cc79ad9bc4d5de2683b447c5d68bc807882c369dd2c0c9b04839189d7

  • SHA512

    f45895fc63492fa4e179ca664a275a614c2326c04fa85e9438fa5d9095498bc916cba1ee44b47b8148607d974da6cf3821d6022aaa0eff886c445dd1b7ca82d5

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/c7537637f0d43130ee366e47192dafee

Extracted

Path

C:\a45cy4f5-read-me.txt

Family

sodinokibi

Ransom Note
---=== Welcome Big City Crushed Concrete ===--- [+] Whats Happen? [+] Your network has been penetrated. Your files are encrypted with strong military algorithm, and currently unavailable. You can check it: all files on your system has extension a45cy4f5. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). Also, all your business info copyed to our servers. Personal data and business contacts extracted. If you do not take action to contact us, the data will be published for free access to everyone. As soon as we receive the payment, all data will be deleted from our servers. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E683635F9D274AD4 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/E683635F9D274AD4 Contact with us in chat on website. You have 3 days. If you need more time to make a decision and collect money for payment - inform the support chat about this. [+] How will the decryption process proceed after payment? [+] After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 2XQlBXh2SBYPYyFvwbqx0Gc8OeB0S4baYiR8R7TwpmLY/0/W/R+u7arA1FzTWBmV 0fUtCyw2k88RwlSkT5SM5obMMFtUJdGMvRGBk8h0nPXtGDMjms78tf9+wpbBbl4Y enOU353ePUSdvYcwMPqnTBWfzmJoFZS7tTaFGISLhTZbti2btiTOGs+8M0tLbxsP VFWNz6pJgxMPHXlcXowL75zebAzepMRUcLYqqQZu61/h7G/p86tBJrxY3SR+MzuM EqeLZ+IJbhTPpG2HBuU3njE3zPNRaK5xUicrQafF53T9DvOxSraDBobRUinKFlqD syNbkZQZO+PDC0B9/14bfqZSBD+lJIbjPwXrGveY2wZN1iqA5xRvO3WDDNxILRrQ 0NNgCv7j0NvrIakTnkEmzOFbQZEgK8sFWiZnH72hFcRPeEMbLYvPsDcI2QQZS5il MOVB2AssRsjlACGcgmVjf8rk6Lr4bVJlp6Z0UFjXUpvBvY5zC65vdtSJuysQRvhD JaucuCO93yGcRmS2wuhbf1ey2DLMrueenAyo63po9Ek2Ghotojv0iXrja01+FP2T KNpxQ3kaR8Vbe7o2PmcnbIZyG8n7lPfpls8KEOjIE53wJgkOEbjRJenXTPvXrkt+ hbDxSCeTWcvsZm04rnJ6U0Ho2IjaPNeom3s5kglRGpD0WANjpzmzINW1dnMYMDc3 70H4FVyGQLc946HFlU154LVsVYKB7fjxr6hrG2A4qkJB6aVkFmFmqtKABhyOfQqQ XtDLlDqp0xP0rRHG+aCSpNsTT4rrki+mew23nEHNSu34MXu3vpUaX+JnMfyYT3iw w0tR2gbIlN4VmdQ0JdQVx6AK3RYjd6+GbyVOkKwuO6jJdjKloWAqgoZlDT9LRY/t UQubzaSzrbjuAdBw6VAbkUdhsiKfo46VQI+wcy+VkEwtfAOWwe+69SZLq08hwxLj 15kofxyby+YmUNOlrmtGq48pKNH/FcVBB6OF6fjwV8z3ecb1xkkUlPvSDlQqhaK3 maIZjSAG6QR1WTZf0N1hx8jsCw0zEIK6NPbWRquZXvJgGZdkqpAMXf2eE0Qr8JMj gdZkkv5uo5oc3JwACtW6yk+oTkmjLMNLZzfNRcmfHE20anzMdLymRobiDEyiVeJy 2yrf3+OVcIX6EKB/sYiBaefpUoKl2RvQwP68ABmUiNhIrtQh/UawzMcshJN6Gc1t UzKD/1ZjGkn2Kqt58IEkKw5nYnLeg/YAaiv/hlojOCHsHSUIzLnDl0nrDQZWXh0W Q7dr7uVX33XBSa2/Xo36TStJoEB3EF8qHLUvyUaqrRcLjNNx ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

Targets

    • Target

      c7537637f0d43130ee366e47192dafee.bat

    • Size

      215B

    • MD5

      fbd7beaf39f98a9eb0c56a0e772d389f

    • SHA1

      73f16802c6fa6a0c52971bc8d8a04eff13c47a84

    • SHA256

      7172e83cc79ad9bc4d5de2683b447c5d68bc807882c369dd2c0c9b04839189d7

    • SHA512

      f45895fc63492fa4e179ca664a275a614c2326c04fa85e9438fa5d9095498bc916cba1ee44b47b8148607d974da6cf3821d6022aaa0eff886c445dd1b7ca82d5

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • ServiceHost packer

      Detects ServiceHost packer used for .NET malware

    • Blacklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks