General

  • Target

    0a68667f99524ab8520068fdbbed1678.bat

  • Size

    221B

  • Sample

    200807-qcd6a4y77e

  • MD5

    cefe88b45a372f35cb4fffccfe53cbe0

  • SHA1

    b3674eae09ae4b809ee9996ace3983b9a19a67b8

  • SHA256

    2205a70334b25bffd2fd640431ead8e205972aec23afb40445acc07551125122

  • SHA512

    e52d33a82535394ef297031ff5c51169c0859959c6b043f8f6ff33eb93cf5e0750f07060e8d36f3a47248ce9770a632313cc15544c3c2343c78d08701fcb23f0

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/0a68667f99524ab8520068fdbbed1678

Extracted

Path

C:\lu3p18it-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension lu3p18it. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/178BCB8E629819B6 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/178BCB8E629819B6 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: UW61ljj/j8aRgVB+mL+RD7YSc1qZz+s0gsXHoPJdns826+2awFA8//qy5XUSUJ7K hPgW/yV0mGjpCIQ1zh/WgeP+gz7wU9wlrfRP2aC0Kajnvlz46W9DYBDp61MsjIm3 gzPN38ouyJjHL0eZ/3ykLVdPIp6aGM/60piXijWYCJpM7sJMO8klxl4A+VtuOXjp QbHA80xeSkf1qTgj7swt1Jgb00L4lMLHxpdWy0983mq9mN9uma9/QxZVJd1XdScM akKOnL1wzgVbqaTLwKR3uzgDmSgwbxvxlOFfmiQ1ZHrtk6m0jBWu6f1fYQyBuqPU tmOPh/q0JPnu6+Chn4iVEboVQKPDJs5Yv3TxQKlNV2rWUfLpil27dbO8q0+5oFyC 6pI4J5GEMRIBfA+78IZHFzj9OLtlxBBQaJddYlghxewz2OsB+KCP1nh3tnVef0P7 XlGmwPEsHDl/nl0tqLWRjamnjR/7ZbmH7A/YZVR3l0M3tmICvpIXrIsT4h81bScH wN4wXxBTnpNY639Q9/WE6sJforj/Dsasg2YurYxJysedexVdzAgx+Ye5F0KenNT5 ZIuxzCzXoMaKuhyWlBx6EQ02zxDGjP2A9lLndnCkCFY1zzSa3KCqmVgZYiros2Hw Bj5HwmEV5hyiUviNWSQTMbiUZQBg6NKz6ehv0YWPXzAWpH+2h5UCjWngWOMRAnP/ 4usop1T2if8j3IuJumHZFfwRFFEhQ+7ZW6PO/AJrByVgXpGO9UWCHZPtNpyDGacF WdHHvJf0Cygj6iuNq4R2QhbKKaU7ZguJciV0DvKRCPDej1ox75p160Oy+ClxSxGt 4Sa2hLZxpfZFS5zBXLpF+FUEx+DnB0jgwW/QcWOYIiGjzYr7yJjBOAlofWZyaQG7 zjiQF2ntxuYD8RO+RaV+QwIwqvDU9bgPpTigXRC+6FLGEykCJlc8Fhn9YFP9Q1XK IU80i/Mk1clB36HBK8cVBU139WLgySpM18M5BnjRqnRdp4CGYZO/O7HLoWv+U3EM xQSZ0ihgH/0hwSbAvvUhNfJWAa4aqATAeXZIjfInsj1rHU4qb3VAG3tmYMEuweqS qa3ohC5zcr6JOMsbSgeH7RZW8BZ8xpGCbUjiDSVUaXT876EWWkCNc+VvSsVbnK5d I5Pz2MCngZRTV3DAQJjgq5YJ4BogupIzCtiT4P7HIViI41KO3hMVJ6rzrERl5A3I D3CVwJBCnBf4w/NltMHwqELBKmC/nQ/fGK+xkFoqKLPR30FUw2OCYZ9Lr0LrgXGb F93RyLoGlC2byDe8bb9UPRV6lixW6A5ojBTN5aszxYUx+4Gq ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/178BCB8E629819B6

http://decryptor.cc/178BCB8E629819B6

Extracted

Path

C:\056414l3-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 056414l3. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A328ECD981E1AB4C 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/A328ECD981E1AB4C Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: iuZ69HdbD/R5CojKfJzON4mrkeB9te3nGMNTinZ4Wdxl/mgcnm/ZPQZJlpTuqznT 2HMxni2Ef665Q3ewf8WvktS254cnEvL6C7C/CBG1AX3dDTUEWYeJCeMQoDMUkEVR 52x4FrsKUNeRBW6yW4mBAPkL6aPO082ZCvWesLFmza7H3IMZyc8TDOeVXuTmQ/K2 3IP3X0BrbXLYIntaNKBE2eFy/d6WPlIpzRPKnBb73L61bhBUglztLzQWydUItxC8 X+AZMyEo+b0BpWCWLc/yDiGnem7VTeivrMgcaYLdm3rFEx8lspdBclV0jHykTejz nwnscERVyBNQ2Wz6biU8eQLr28EIh0Vb6KU3wrXwRTlzOjuqjEFWkYbtEy3UuiMd WxGU4PhgTKU5PI2oPFK0Xa54h2CNnUQpPPnOoT7Wx2RWa+m359Gy/TV1zzjuzmG4 NIbG3SsvIfF2nl/7SO6CKhyIoQcAGkmjySOYwuF5idWH95KjY867K1yp6KNZp9Nm AnI72sHwomSWoZ4IQ2YiTSXy7YTCyBG51XwIqHzKoktf+oi6kmDTiVESQEilZVHZ q6FD0z4Crb17ZQUPYI8SNsYgrpbJLO45qgRelRNvMC6ETUbIsZODQrl0cEffF3V1 o7rouMOccDBTOqOmb2ybFQufwwRamU9uAjdCBTqiIAgYYVEKSQZrIfk3f9abvJyl LLlIThuYyNP9A99+0eLh96MboOUHcB1AOmXP283CAuIhRk/Ey+jmy1mujpg4mZXS 91duR4JOvLeGH9bhavEWo+rePfaOeqfpwXAOuodBFupV162GDn/sSWDPFngE1trS g9T1Y3kN1oh7lz2kpCZWEThisX+RmG1rlTfLXzJ7PJuFLCORzvDy1p2w/o43QeKU po1KX2y1OxnRAF1LolMt8otARSmzp8bQw0jRhN+sYtgRwNgx1XWws9FwWIC68slK gHiVcetDJb8BVvjuJTnhoUsm6caeTN881g4BioYodBU+KUDy0JhfGEIUkmDOdaVd GNtLSsSPFHJRT7hUggNSRWsEkWAEtzJPXhdO2QTHZ6jE5o+onV63YBVpVxDtjQy2 VZQkPhhPuVz5JwAzH0ra223FAeJAmV2lai8EpqjCWWZYrNmX9aw15NitkksXtIkL r915eF4qAwmlKr1vCG/oUxczPq0bjnxu70E0/N3iiorcZFh/G5eAjvItiXGtcrT5 +lU8/re1SO9DF5bOEbx6KYPqkRCAaJeKDFFWBg9tm3QSrp4bssHiGSSUjAZbDh4W 3R6yNWBLWMhvykUoQdB06+dIvg4= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A328ECD981E1AB4C

http://decryptor.cc/A328ECD981E1AB4C

Targets

    • Target

      0a68667f99524ab8520068fdbbed1678.bat

    • Size

      221B

    • MD5

      cefe88b45a372f35cb4fffccfe53cbe0

    • SHA1

      b3674eae09ae4b809ee9996ace3983b9a19a67b8

    • SHA256

      2205a70334b25bffd2fd640431ead8e205972aec23afb40445acc07551125122

    • SHA512

      e52d33a82535394ef297031ff5c51169c0859959c6b043f8f6ff33eb93cf5e0750f07060e8d36f3a47248ce9770a632313cc15544c3c2343c78d08701fcb23f0

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks