General

  • Target

    5356d4234ccf138172e7820bde48cb1d.bat

  • Size

    219B

  • Sample

    200807-ycv3g7fxxn

  • MD5

    7ead0a1f8df272b28f265e05b4f23088

  • SHA1

    07c838862750645da66de62f19d4ac32d852da99

  • SHA256

    e4133ab28a0c8965753d56a55beff0bdf47d6bb7d711d708f36f7fe985085a21

  • SHA512

    b9f721731cfdb058f37dbfc3e42eb519485916eba77b8f1cc3b8f0a1bd7facded50dcf3a2bb6ed87b749f7f01199962061a3005d179184fafdeeef6dfcb3c1b9

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/5356d4234ccf138172e7820bde48cb1d

Extracted

Path

C:\gst2it-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension gst2it. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A632771ABD9B4A1B 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/A632771ABD9B4A1B Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 9el/1un/v46ZjkxXuR1WLpfEDux62gX2CXSVMnxbiGcCjQmvG/rQChpGDHWl6ghx 1+WB2l8r5uchzIIYWOD/TXTSwytugi+haQ/YdJFUC7pF89S4qZ7LCAMcYFQq9SsF b/wuRx1DiwbdaEM/kfSViD/AzyU+x+AA4/diZytQQizo4toDLAWbtKiIvJ2VY4Nh 2zqbKEIbbX4PCBHOjrvnRcR2/2WvBBOqe0BeZFHvltUGstniE/PyryXOL+P5RZAl Qpc7TobYzTNp+YdRa4Rb7M92XMul9NSvIJqhg8NGKlLrxirY1QZnzpMgp0RTlzS6 IFZyvE5O+Hp5PZzABdrsQWnhaG+SrVo+L+X2XAQnHr9YRTsOUT80ltOV1XJFoHSp QcWE4H7pAzemJKR+1fO8tW2hY96V5Y9n+D0ze91qOucG+DkD5DOhqlpb604CBgM0 VLJqxUdFZvt5yS9nesgYnenCVevtGDdVDXJgzQ2azQ6u8wZV/56jweUXo2ZlAMGw Vr4hSAK0YzAfqRdeSypfJFlHoKGSjfz1Xk5yUUG3KvlSmDr4B51Gkxsa5bwlABP4 irz/YDxRXzHdA8FsFMEBxsrYqWD95ecrG1FVBNb8yqMOm14tIYCia4NkGNn3AKZ/ d05frYz9g3DgHb9zRliFwEZp2+Mn1+7JlwO4MSRaMKQdwt7H+cmjvgz27TA0k8SA mGeHHCeJoApJXE/KX3ZxVxH+DvRHqkgRcrHjK4x6QnZH2bwz8u5TOsJGhG3c1Zjp QlExi6j1egzYwod9pHQgH6p/rdC3h2OcoOhnAXgI5BW3FPOBqrD3USUG9Yz1nGoQ PgBRldp9O9YTA61Z16cZcKIhJqUaDnYL3MNYGkqILqrZaiuzNsbjnFobcAXfRKtM zjUKtst56jxK/DZZhwxZssHSYArQJ8BwmXlkhz6tvcB89gQ+diwxfPuIGVhXdudz 4ZB0wQDqErGT05ukf/TgVFG8r6I8VdkJ9QIvaN8od2nLi+A3VJLsmK4UBt5v4yVM aNyHv++qr1bSbRgcSkomiqRpE2GWTBf5TJdXrDPMgLZSH/gk7Bf1WmZVEdShDF/O YgFZ3IUQU+8XCCnByR7Pol9PeRpGDyRhevazpbHndEGFMofDZ7h53BD3V0yxa5RD ir7JL14BWp9TvUq12BFtgwk00lKRmlW2/2JhEcM0BeKAIOM8RUnWj4n5Jdww4trN +3NO4k06y7eGKnZ8mG9ZBuErSVZH+XfobnTJ93gh+jObUa9Q2cY8W8KaR0Hfx5jD Xce4gNo4qgo+PIYOb9HGObec6tbI+SMHNEfu0Zuq898= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A632771ABD9B4A1B

http://decryptor.cc/A632771ABD9B4A1B

Extracted

Path

C:\zjdvlwo1-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension zjdvlwo1. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/326EA3E7D1077C8E 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/326EA3E7D1077C8E Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: MDs01J36P5lhUnHvVX9ROIGfBfgEmu5uomEJe/Huz/mMaD/mmKGJJtFv9g1t+H1M 2U/rDV9CIwPUrbjRUMZGrOBpgRRdQIv+9etZJODKHfic7Ie3HYcprYe0HkW7GyTi 1jJzqUS9ukA52Fn7bFpqmr0VGcu6/t6k6ZwgUM11zc2ObEe0EBCPQey/LKaCw6vC w5NjgCFWxa767CF+NNgENf3slzQibzyp5mhUJNfANHtV50hs+LrVgNKUNzKMih4A pK6dXSCHKo085ee/wON9KvIQCEMVrJ+ZSUASMFUf9gZF2oTFG3F3HFiLcLlnPTmY /fFXEUcnMYX1X8S25X2BbJbxgJcohJgYxuYUIIQCpAc/ZsvjvrWq8Jb5SZ5nqRIi 9wkd0clgeYI1zafAXyFTA3ftHkInLR0SyhZBlcQ+x8uV9dmpTLUtbsq8eE9fY9hy SW627l6lnjd/9iaHHzfFMwdlPIBGeaEjk4ulw7+vRkO1kF+U7lCzMxwD3O+FTvMg F8aVKrPPPaOBEoQtQcoony+OqdJ0gdZguwZ1gCaCAIAVSy7n33LyfVeN5HrMUYf6 A4mivqxgQUcRIDDfjXow/XJ0RbAvRRQkF5sLoVPPciaMweFt1veLE2Gvw1K1Lhzd OxPFbo8goQ8LwCm4oNjn5/klZX2xt2R2BinphBdUWeGY7wGJ4HYtWAx8IMB2kJL5 KvarIPUmWM25E7cCY/dy9TqQC4nSztkhaSRVBspFXbJnX33FYAcrE/Oo6LIw6bYE SfMspCsAsPV1LkCiK3nLFPSyyXa/LQne+xD2k+GNlkjrNv6uqqS7Z62tHGs/A548 mFqaQUV4Br7OHdpiCinnrh9W9irdQG92iz1EQRry3Sm3dIDTcfGHtXjyAW+KXEMk Y8zcPhnU7u+PzuQ1BWV2xaStEIQ1jHBHTxXL5+ajKDsB6nnyOVPG7i0cJs/6Ee/H k+nIw/iTbdfqmlufhSazT/ac3MD6WZJg425kOUvVhtDHagh7gEvOC0TgPZvnmvWq 5Ao9cdG2ouSIOn5KK5jdP1Byd08sqWIx+vbTRt274iIt6ajDgkc+l6iRETDWuRJm gHNkyPPTXg2xvqH/bs4zV+cYg9oEj+RBaEODH6tWHTgA7Sr1hIWeS0NNVBgadhiU h53nW3fNCQ1Fwd29lOwb3eozca8/KpGT94nGFOwoOa6DfxM5nWakVIXCZGTFm+ng V/+vAt5I1qqWyldl894qLnt6vwDOf9kum6aKcGKyTOfVXnW5PTjNI6ucovFc218I IoPruZgI0nzmm0OjKL+pOTryYbU= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/326EA3E7D1077C8E

http://decryptor.cc/326EA3E7D1077C8E

Targets

    • Target

      5356d4234ccf138172e7820bde48cb1d.bat

    • Size

      219B

    • MD5

      7ead0a1f8df272b28f265e05b4f23088

    • SHA1

      07c838862750645da66de62f19d4ac32d852da99

    • SHA256

      e4133ab28a0c8965753d56a55beff0bdf47d6bb7d711d708f36f7fe985085a21

    • SHA512

      b9f721731cfdb058f37dbfc3e42eb519485916eba77b8f1cc3b8f0a1bd7facded50dcf3a2bb6ed87b749f7f01199962061a3005d179184fafdeeef6dfcb3c1b9

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks