Resubmissions

04-08-2020 12:31

200804-v53h6kcqse 10

26-07-2020 14:10

200726-en6a7lrqs2 10

General

  • Target

    e241deaf6f1e1d0d13589a66c942bc3b.bat

  • Size

    216B

  • Sample

    200804-v53h6kcqse

  • MD5

    c79f7f4fe4b00e41b6dce691ba63a8ae

  • SHA1

    b8f15e882ed45e2278545ad4e686e16cb1787dc3

  • SHA256

    2805f33e7f7992595a10507ddb57e5bcb3ed34d8b6e8dcfa984ef77c31037132

  • SHA512

    b20d2b133be14683663d795b6c2abf5fb2b23a2b87cc9ddbba1218dbd5d9704d112d13d51e6cb62f18297c8797d2c3152501bc35f1f97af2821c19d201a40034

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/e241deaf6f1e1d0d13589a66c942bc3b

Extracted

Path

C:\77yes14d-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 77yes14d. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CF8381D06F3BF9DB 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/CF8381D06F3BF9DB Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 0RiIolJW3suTYz/0a4ymOhYmD3eveOc1XYBb9R7noVtD2e54YiZv7zR1yVar4xAV gsG0toEip6/kaGCXMjmJvmI2sgwHpVe7ts23ySjGQV5CnDFbjCRDT8Fons1Do7qO /rp0EjrUdS8e4HTS79ocNkOQbLYmPmbLj1WFloJ+d8hqS92EGl0IECbX47TBcXxo +JGah8R/7tP+UAbBOxjTmCyZN4QnpJQ5Ivc5ekq8xC2nfJ/eRoEhqNQ37kejX2sf AUU0AEROra/fgKvfJxgi3r+7Ns3jIRzCyEhojROZ/tNrqM+iNxMVmsbrLvUX7t2p 8GhtPSkaUZWCF/Uub71xkKRj6bQQ9BedEhh4VvkiGNmSz6LTWe63uxr9M/ImMuRX Lq26VuSpcCoToVLjefhnGAPs/zZnqNaUy9vklHNEV93A/esIVudgLo9BHuCNHAS3 QEF4fDbY4My8NuJRQKxXVskOAin51hhVJVIRqV6Pcx02DXYPuPmCKUPLzvVvQCm1 m2GjD2CuCmGlKw8AI3eg1Bd/ZRuwzp9jpW4HnCHFlrZbB/o5xR0rA4YKVbPLUDLg LhGT5vpVPkrEg7+XVwoidKEirCVGUqj2bDmIw7AgVfFJF/9u1DmCqWFpLbwSTk9Y oTsRKmLe/FthBJ99vV914D7XoZuJqQQ9QZRWMa7l9Cus0spF7ZYZBxnuJGWr/Vqb yB36FqYw19ofA0bcbdmRurSiXa3QNNRGhekx9Qx4ZTGoorC9dzB9CR87t0O4ymX0 /ohld5qKLp/mpMNYwKa9IZMg2GR+7dg25k+h58es6ZmuarmT43tBAJicFtM4OeJE nGFvPEWZJctXvFhru/kso5f0nzJGsWM+6DYvA42wyysbGGsaYfcd8eP7EbtAnE4D 1094lIQcyKM/Yd9U0rI0nCr7YGpZRQzCrAGxA8Ef4YdHll4cpatIQyHFZiU5HJ67 tmoIRdVYJFUCMizXu5taloua2d0MijMdi+iQ6pFPGrNTuT+5vlw9yaqtziPnRVzd C7mpiWdIoRd5LV9LCH+642ZF0028G5TepDFzgHsFSexQHdw/MtIbWiz1/e4vVy9z FCZNW/5hsYF5WihCVyvaQ8xC78aq32IMN6IqYQKVYBLV3n8duC+jXInLR7CR3DHZ /oQtbz36HYjzaZYwcW4uV236YdxsskKRRGvI+i11ItNe2CNKUd7Shzq+CkMLfGD+ 5fn/QwBoPNDJa7diRxAO9wYVFiemDMffTJpoZGuZPRc/kzLG22B0Q/cauifYyXMf 3Hy3a41PWj3zf1urNyiGUlcdktMy7W1PVifIKPuHVaSUHq9K ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CF8381D06F3BF9DB

http://decryptor.cc/CF8381D06F3BF9DB

Targets

    • Target

      e241deaf6f1e1d0d13589a66c942bc3b.bat

    • Size

      216B

    • MD5

      c79f7f4fe4b00e41b6dce691ba63a8ae

    • SHA1

      b8f15e882ed45e2278545ad4e686e16cb1787dc3

    • SHA256

      2805f33e7f7992595a10507ddb57e5bcb3ed34d8b6e8dcfa984ef77c31037132

    • SHA512

      b20d2b133be14683663d795b6c2abf5fb2b23a2b87cc9ddbba1218dbd5d9704d112d13d51e6cb62f18297c8797d2c3152501bc35f1f97af2821c19d201a40034

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • ServiceHost packer

      Detects ServiceHost packer used for .NET malware

    • Blacklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks