Resubmissions

04-08-2020 12:19

200804-mtj74qqgb2 10

02-08-2020 19:10

200802-qs8g5ktr62 10

General

  • Target

    21b6d26f5616dbe4b9f07bd5660bb62d.bat

  • Size

    215B

  • Sample

    200804-mtj74qqgb2

  • MD5

    d0dba6d8db0dbf8637507b05349fd02f

  • SHA1

    e3795cff8728780bd8d72ae5f7e317ee93075e93

  • SHA256

    085cf732d404c2443d63dd7fef9f872f0c4dc0ef5f0c048bd308a20aff169bd8

  • SHA512

    de33e169bfaf0170acb3053f62d40e115e162671c77555e7c0bae5e12579f7900f1172296279167f120a3821566ee8b111e5e2e366711bf0d5fde9e5e3340b7f

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/21b6d26f5616dbe4b9f07bd5660bb62d

Extracted

Path

C:\207z8wza-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 207z8wza. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] WE ARE READY TO PUBLISH UR DATA TO PUBLIC ACCESS IF YOU NOT CONTACT US (USE TOR BROWSER TO VIEW) http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/posts/125?s=7ee0235fc7f67403393ad971dea5809e [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0391F0FEF62C0D9B 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/0391F0FEF62C0D9B Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: q45o9pNglRTlwBTpNuTh5RnhYNFe/Z3aHdQILgr+gQOoYLJCSUnWZ7xwLyQs0NQc ZsrmOM+x9CtewYNWk5vLVXGGWLCUq30d2cnVMvMS9A5KbtgDJMFpaUvxo4envD14 HGrXIocyKMlWo3J66Qd5CNlQKHfHzYCa0bDexKLAMxf/MJtZqHgFTq9GqWeXhDQ8 GxvZCho6OXAs99pMjRDZv5WfzA87Hm8RwCj8GUHfIa9bx2KvItDGMCn9JKMAATEI odpVhSMxoLErvzbF1hGBKzb3dYfYDLKwd8VGMqUmTXD4+yJoqsyPV0PoxMlsPSJO 3gP3vNTwd039oRzfXf+EW3I1phSdqEy2h0PbZtfld2hJMayZNmAddvtXYZy3/7Z7 LCYV+BBEZ8pEd9p8X3LAR5UcpbL8AXS6Zt22VV64OocgmbWANb1avIzC7a00UL/J wMPjpjPMhDNZyGFvQ93QihzKW7xG+UQRFV+qk892nbhWLXf5ZZw6WMsdrqcljP8M t006bTO+MAZCXZ1Gx/IZ3V9lrBVE+6dgn36FxeTe7G+22SQP9SO7khQ20mox5Bb3 XEwIs8hb5TwACH8a1hpIg0O1hCmTOblJ/8z5n0VhWrhJPLICuQ+JNq2aSU+2nuKK e2Z5i8bqiwDGS9+RSMtGuqf0RTjFrnnsBaxKOKVUkR5jh9Y2aMyrYAaOKM+w1l/j nEkID+6LDmP7t1ZljJZBbJueBZZejX9+/C9rgm6p1RAhJ5tSwPesgQmlptu0+dUx 4SihG3+XI9CJHXQfUbtyowWtbaJxmQLvK4j3BccbcWyELxuvivJKH08Ye16o6+xR dUySs+Y44L4YmCwcJfrPU6gDxgzTISZHvBx6qVzDhvXlwj4RwYanxOKDDcB6aaOQ t4P9SjJyc4RElKnXh+haDyukN1LNek2lsGQyP3ZI5jv52s0d3NyDG1rYJSy/p9F9 zxnJJ+VaW1JEAMdu78QLHIkFdDiPMbdVXNd58Czyhgr1uj1pRIFsmPuHm1J5ZAai Dtah8mMAf65XN1wjkIzaVbNJB9KmrUaoVsVJp2g3A4SIeg3NGHKDFtu5rmvSkTFs nO57Z02FJHGRV6osMsWs6bWUcc4TETXplEkekM1xM8W9+oSPO0XQIaAB3gYsHMz8 rUwbt2WLHDCotUPBKRfqv44rr+imkq33LAkj7a5FzHQo2FXa2m4vhzTqEV/0dJvA EPSux3RDDpfbUf5+GVRaWALz0N1o4U/3TGQatfTBhdILbeWXzY0H/LmpuQVz5g6i KiQlp2zII7BxC6Bmomv0NGl/2mw+GDk2zyIQGIlHpuPHQQmd ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0391F0FEF62C0D9B

http://decryptor.cc/0391F0FEF62C0D9B

Targets

    • Target

      21b6d26f5616dbe4b9f07bd5660bb62d.bat

    • Size

      215B

    • MD5

      d0dba6d8db0dbf8637507b05349fd02f

    • SHA1

      e3795cff8728780bd8d72ae5f7e317ee93075e93

    • SHA256

      085cf732d404c2443d63dd7fef9f872f0c4dc0ef5f0c048bd308a20aff169bd8

    • SHA512

      de33e169bfaf0170acb3053f62d40e115e162671c77555e7c0bae5e12579f7900f1172296279167f120a3821566ee8b111e5e2e366711bf0d5fde9e5e3340b7f

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • ServiceHost packer

      Detects ServiceHost packer used for .NET malware

    • Blacklisted process makes network request

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks