Resubmissions

04-08-2020 12:19

200804-etrwz5wjc2 10

03-08-2020 09:10

200803-yxgv5hf29a 10

General

  • Target

    2b4587aed40db6e44cbff092b52b841e.bat

  • Size

    218B

  • Sample

    200804-etrwz5wjc2

  • MD5

    c69dabb8c2f1ca155fb5fe3b0482d0a7

  • SHA1

    b3faaf0bd82fe27b076ec814b2123cf962ead51b

  • SHA256

    99824d3ef35b84b0fc40214867e3c54e5518491efa1c5c9d796b1acb2cbe81d7

  • SHA512

    c5fc762e4d76e921bd55faa68fff86efe13f0b49b7cbeaaf2d4050cbb8e65f400399d84acf4056e36c8f560a8e9a7fd5b9c711fcb0ef23f65f14ea0724eef174

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/2b4587aed40db6e44cbff092b52b841e

Extracted

Path

C:\73843qq-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 73843qq. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/18FA4617919C31AE 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/18FA4617919C31AE Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: wdeyex0t4ly2PpMLfGRATw11+fh+yXAoey0UAUStfiCVtCT9ynGD+L/yYFw9DFUD Q1zMRnkfny1vhKp9hKjIU1DiG+hx90jNQjybpj0N67Xi6KTpM8mb+VFEsykdasjQ OS5lF/OVKm0ibFTcetxHpAw5/Gv/uMhpwSuc7kZ7SUjxD/KoPk4OxiTbHO13Y9sx pAOwKXYhWLGvLrGjp8g+IBr1IyFfZKex1B+9ArsO/s5tAHFkLaeYEcPyHetlhtJk x4C/1ZYMqVm1TmP3reOMh9B/Psn5RRDxU1fcOyYt4iVJmR7XhNQHyN9tQakeWIPt BUHbAN8bNhnPht3HNpzJzeCEtxjao0vtIS9s0tn6wFH0VZ7j7hkvr1SXtS05No/V bxp6pYSnJZwLcNWJUZOK+jr0dJttlAyXyelmig/lgPSz1KoD6kkSzUdFhygwD4wC irV0y9TqmjaftZi8vzXJidKcuHWc1NeBoObJCg2bJ/mC3V8++JZQV3grDkJwhImK X96PjiEIDKA41UjUQw9Al4MlxsDKZGecJNXaOA2nn+tr1MLdMd/tqHmtuNboIEVN Q3rTLXOAOwxi8bBKnchoR/wHuI78GhnKdXahJs632miqvWruf5CD83KPMEGCktML EMi7U8CsE8ZNXb4baWncNV2DPhtgRcpq1ttuQOZ+iFeUiaTnaUdCVf720xKJTYJp HMeWl2NezAdWYQ6woyNmGCOWVsiIr8Wi8YZi/KP3RtZ1LlB9eeD0tMS2PYP381F5 f0tfzqCe6Q/kn8RngmGRqmYeYc/kq1Em5DSUpOY+2r8E49hDBMxV1IjbcUZy6AUl /8fa9ZT3Q7Ou0LZYUIch1fLJHwROZk7pjdhDuclWN6PuLCc7+9ARyOpIRvXHd+k7 Hvptjfgz79zkuCnUhYBPJlwPmgA3xKqmsI98JPjq+DRbpNgdAk9gOo0YOwLhk8/H AB7UqrX97Wiv3ELoSUFZS8gHtick4Vv4UAgjnrjs5x4Ih3K+fIQOpAOPRWZvgsgL z7MaWhoI6ylfArnlAuLxizWPwaSDPwlPETES4YL2bdgQaX38ixWY6Do9DQKgJmbx 3BWwD5nlAgZ85IXyILqsInZrmk1d4MPO2QkNjQqQ3dy5gp6NxIeje52EgjCZmrnB xH9BWBK9GaEAzZDyCbXv5e7Pwt1pmzzt2JBotHEzK+d/+wXxNGwD4HtIAA+YLiYg dDBzbhohUx13FuIaUlGzUtDzJrV6AyvX1xRN//Le0qCxBPNp1xMyTu7Gjy/L7gpm t/plDKIPwq42q45kZHt1ppf8Pu3bifdP8qC5b0gtkrK51w== ----------------------------------------------------------------------------------------- ##We took a huge archive of your data,if we dont get payment by you,its will be published or sell### !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/18FA4617919C31AE

http://decryptor.cc/18FA4617919C31AE

Targets

    • Target

      2b4587aed40db6e44cbff092b52b841e.bat

    • Size

      218B

    • MD5

      c69dabb8c2f1ca155fb5fe3b0482d0a7

    • SHA1

      b3faaf0bd82fe27b076ec814b2123cf962ead51b

    • SHA256

      99824d3ef35b84b0fc40214867e3c54e5518491efa1c5c9d796b1acb2cbe81d7

    • SHA512

      c5fc762e4d76e921bd55faa68fff86efe13f0b49b7cbeaaf2d4050cbb8e65f400399d84acf4056e36c8f560a8e9a7fd5b9c711fcb0ef23f65f14ea0724eef174

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • ServiceHost packer

      Detects ServiceHost packer used for .NET malware

    • Blacklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks