Resubmissions

04-08-2020 12:19

200804-xq9kyvz44e 10

02-08-2020 11:10

200802-q7t1yz9k7a 10

General

  • Target

    4c3f9a85e15b5e5ced247c4db5cc1ac8.bat

  • Size

    214B

  • Sample

    200804-xq9kyvz44e

  • MD5

    ab7436a5589cc4e14a3a586cb7986ccf

  • SHA1

    18affc52165f28fa734ce7db7bb3e87fbc6b8109

  • SHA256

    01af7238910c3f7b6b1020bb52d96c54e6bb497f8b4a1531c0a7728cdd9842a4

  • SHA512

    bd7793576dda6727343c8bcf7371336c8a9a46a9627a7eab7dafb2cc606c232f5c42c0be3f69832bb8178ec279840f5071ceb90705d8609b66495a7b3e1ca8b4

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/4c3f9a85e15b5e5ced247c4db5cc1ac8

Extracted

Path

C:\31s9h3bt-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 31s9h3bt. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CD5737086E0A982D 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/CD5737086E0A982D Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: zHNrIsGJpIRYCescfQu0N522FUryTTRbNFiB680fG+FXyPmY9hde0LYxnMT0KG0Z vAn2bMmcMkQj6xYo3MtsxuAeU+BuJd0peAeQ6RC9xWcxc0ZKz/o3PmmGkWhZWhUi JQtJ6ud1LGHl0kgm5YUveCroCfe3eARyKpjSmErTr2fMM+sOruyaQv1b9gwX5xmS Q0119WBGahMHQ3Yx6/usU+J8+VCFjRliFff3QvsMwo85FEq3Ox0mKTU7vvAuNU3Q HuzD39oLSdisjeftpKXgahZ/P3bQRA5vTsNQcAryHmf8GfG11FtockJ6RjRikvV+ yWHcByNrFBecKXdIi9xdj+aITJrl3zAC7Ey2Mfidb+4x2iaSbFMGFRYLJnDopnQs +Z8Zp/1vpW12EsKho6p0VLNtWIwpQuLL16YIboobd6lEtTLKoCkN8YeBa89BmrGR C7FzxrScGvm+YMC/aaV/v4TLmmIHObX7VTzCsgB3GvSCRGztSliljBcxd+WACwId doBmwpXvI2UC/3whqa3hK5WZK2BEb05GamnutiiuBcwSxcjbM3LQegFf3gbGYg53 6NCaq6zUWVobJOdw3ZHAfV+c0m6VkQwDPIOxl2ivoofLGTr8C/qkGNaBV2wWcNMu 1uF9RM/qWaLAKO2fkN1a+aM8//X3SmbPptv4kv9uIYquU9rHdYcTzjuvJJnMZHf3 SZVdYuw5/WHoinPKnWmuak8WY5du5Je2kKaqTeQxPyi6wfU/XegE4/qkNL4x5IxC OJ99ITHTdjzXtbU1RMEvoZE/U71ygQhWzphnwjNMPh97kU/baFxO6F84CuHFi9Qo 2dFR/0HMUN1IBEg1Y2DVwaMb+BEbjSc4dKklp3PZFOw3ciBJgQSOIbcqYBvsnn2d hp5xmz9uP2C7kSTuvQ2rAdxK7PVEWdxSyQAYTLbqazVzS5NwB8kzmOUxFMmrssn0 /jw++jnTRh5mFq5YIoTY80K8tQnai7MMa5SY3CkARNx3Dk6m1BjFVEAAZWwIUZqk 3niLibt/+QxZHMsN6m5Ihgv4qplSFw4GavE7S+MXxfbhYI9S58jz2PILeqZ1QuIJ WgNR+uZ8ivGCUE7pLeI0kx8vIvGU2UnuxPDTefQTSMwR/ATsUrBQxJXC+VQskVk2 nWZXBppNUyhNssTqMUTYQ4/5bvKQAaRIVTOY+ZqgAjEUGAmGr0Mp3ynRVfHNGjAb 1kj75qAPhluNBr5uGvVWAtiG4xWQ9j7YV6YbIJcFT4Yqx1oSXQUxZKYIu9q5XtpV a5zHiXYvyneaq7/CYY6lS3J3jVia6FMDT22vXZeLnxmgWLH8 CRITICAL DATA OF YOUR COMPANY WAS STOLEN. IT WILL BE PUBLISHED IF YOU NOT PAY. ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CD5737086E0A982D

http://decryptor.cc/CD5737086E0A982D

Targets

    • Target

      4c3f9a85e15b5e5ced247c4db5cc1ac8.bat

    • Size

      214B

    • MD5

      ab7436a5589cc4e14a3a586cb7986ccf

    • SHA1

      18affc52165f28fa734ce7db7bb3e87fbc6b8109

    • SHA256

      01af7238910c3f7b6b1020bb52d96c54e6bb497f8b4a1531c0a7728cdd9842a4

    • SHA512

      bd7793576dda6727343c8bcf7371336c8a9a46a9627a7eab7dafb2cc606c232f5c42c0be3f69832bb8178ec279840f5071ceb90705d8609b66495a7b3e1ca8b4

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • ServiceHost packer

      Detects ServiceHost packer used for .NET malware

    • Blacklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks