General

  • Target

    d0333bd53e654eef1380155f828b71d5.bat

  • Size

    219B

  • Sample

    200808-54eqw96l56

  • MD5

    72cc00975d3f7dc5564c1a0fdbd1897b

  • SHA1

    7eac1c6c294cf6a12495a484965884263cd77ff2

  • SHA256

    c489438648791383b0506b31ec255a3f68b209bd6e897c5ab4cb789ffc519673

  • SHA512

    9a76771f5f5e726113dca7e35c9ee71c4a2220e673c09b8fe48dd09385e1a2353d91a7002b198dbf136c03a435fa068657f6338a39f0095b148c8056cacf69e9

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/d0333bd53e654eef1380155f828b71d5

Extracted

Path

C:\80242-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 80242. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F95CCF8219484085 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/F95CCF8219484085 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 4IQZZA2SGXoXFoHthXvp8yVePUq0p+NxB+qQXEDVeEAUkBFuj3BtrUEExOtYQDLz wb1pbUYU/RPNHiimzZUAoi21menF9wq2Tl03KQdoA+uu6S2+GNae4m32k7B4rCrj uOyaTWUpiFWN4PLPQUsAJqbOWqRgZqi5m9zts3F31y+zl7zx/sVwtH3gtnLrxwxA 02bbkdrm/Sv70uv6dQOqJIgS9C89+ttLGuppZfEC/cHjLPt8Pu7XeWiDK0LZai/t C4r27w8LwwuXBopJ+ykNJ+CJtF71qbnInvLHsmEbuw1hHgkWf5jF0CezBEudWQbB U8k3YM5uu1Mtvbxte8ZwnL5GZpEUnLysR7+2Y/MOz6FSw1GQEpZ/psnKHQ5WxE81 aqDem6CtuYdIawRcphxeoA5USq/HtNfx+v3thkFLY/NNHCtQPsvPdWsXGLcRj9GK AkF+yYfH3+qcja/ffVgwb4BeWqdarXKLLGDYt7j6aIr2F9DKYqfpwQcNsmFExX31 Om5EnhSfDt/SF3GUg+SMuzuzTjp65kTOMqGAcZXnw72Y+ImUcXwLQUsxHIsoPTf1 0vIFrVvXO12c0aSPi2zWeoSUpPIqKU/uY//tf6fr8yjI+87K9sI3aglTrLja+mry oOoc/ZufARwFz2rPf1koyqadRBpEfL16k3FwcZEUhdCROq3YrxtWN23UTsI+zQkS j+wTXTbTSum2/HJS3amUxrJGf+sXwQxkVGvTyg+HgFDKMzY6I0zmzXoJ/ors2PdW gzDprKmVR5Ww0Z7Sy3XZba4zwrzqWTeOCJS4s9dkwyHwlv9lWZ/PJ0jJoC0iAOaD +M1FMXHrMoo4Scd0mjAw6oTKipZ3PhNXI3IDgfKSsgRo9vodylRoglytmhNqeiHf eBysIpk2teqXL5kblnTT8O5JcRbWjAYXXuM8dqYo6VyIxMGzyqMl3CybdpArCKNe IyDUDOhNF8CytD+JULg5YcQrX+PtipRmnrqXLjfaeO/7EXy3+7QhfbPgWjLma/Au bYjIJQHXmt5ApTz0amHujiDCdX5jvDr4m7h84ZLfOKCUZIM0pJwukN7Kn479Ra1q VDOwAV4ToHslnHO3qZF9DuboQLGzEGKFrF40I9cxWsvjq1kNXtkF5FPy1LDUCG9b r5XifH1Dmi1ynNH1ClJMLrXl/Sjc2dAHYe7DVJa5TVTfAUodkVWvSf/a26Z42bDv kuWyzsGqd3D5PzneoixnDVNva4UNtEzS7qNafygtWbuo4Mk63tZuG7Mzyicx19yV HlsUlK6+vwRPUwtKiHoeCF/i5VuQkxK1SuRvUfR4 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F95CCF8219484085

http://decryptor.cc/F95CCF8219484085

Extracted

Path

C:\61k34-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 61k34. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B72C4F75A3359B40 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/B72C4F75A3359B40 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: mFSHgG+RLQOIHSqPEUt6ZINlxKutFTyn/UiEzFwzramcxjtfObynXPtYx7tb5Jbu kCRZsc+++g+TSypmbP/pUXjGQhsIT0yEW0OecAWAgLjm+mpy6oTK7g/n3X8mXzm9 BGdEcsxIX18V8uP7ZMFixXh+ggmqjzGHOx720o1sJdvIRUE70RRe6x0FvyW1jpcm mGCrRItsF+rgUcbyWzYwNsLFfEHGg1LOy94Lp61fAUec0ux87Xi/0+Xx8VliEV2v mMIxQfmvc20QL7QoFltKmgNDDSGGaH99CuxZKtXVAC84CYXTwtq/xtKj7zWvnrDN 7wKia5l58EqEhxfub51c/Z7b9oL9ib0sYpWWXksF3bqfaznbNlq3fpvjYec4MC0q zyFYeR2GfdFe39lWf2othtRPTLNGCi3B7Odya+jyAqucW3n+daDPuGkI8TOnk8A7 fmkVbbHHE77auKv1e1hjuMOtEtQU3MDu35C4otXQwhXrwoW9Kubke3rpSlFYGxBu oKHpb8ulds3VK0X2TErg1TpDedBOp6YIbaQyXtHoCpDCm3tw8t96YRzMnh+X8z+C Gn9ji30bN67Z/++85eFSfL+d4r/nfQsbajogkU/bVngL3Uy00CWsifYQYwW1Bkhr j81pDlsefZUNJqWs4KmS0R5X5foM5skIAS4oooCl5Jh57BJdwRQ/g7mPXOeh+W9q i5NEFqg/feGMbtY1yY3JkJUe4PYOAxAd8wJpy5ATRKD2OFe9DyNTpO1KRs4L5wbJ XsySuZYN11vtUSm6cf6WtBp7BQe0iTJ4bKl92WACQg2oHU6eB6Dhh9XYLNUFAXbM 8MUQAizyM2zZFNiGH5nTtKkr5+jrH53Go57FF6Hjjbs/XaltwsRpTPnF+Gjb/qsy 1If5cbMDLoWCsHRwd3fLDRjJ9MQZ23l/2GBgX4K9vlhEOt/enjVH1WY0kBLaOEyo pZKkZsNxJTpZ5iJispRb6iQPXPf/wuJ266BAt9YwUSv1BG6oMThRBZwaYIFRwnX6 P8RqkYxARS+LQ9KmQq7SUlNgdSrBC7sahcy5atMl6s/MOGbdPw03oNQ1H1pXaeFr WV6G+EBvim8DaPDKcJhJd724/G6EeiVSTakNnwsd98Nu3KyoafHZSpD/KrTK+8is V4iZbPaXGNXrm0MmQJqT6Az4zQO9XN5cyhl/8pcjx5Ah5b3X61keXiEYFLgFPJE2 ZHU8HTHTILNuBNhjKys0Q5EAxHreIGylIsFqb7p0o1YLK5AEOHvYO+Nvb76sHtWy vnDI7uab+kDjJpYt20Q= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B72C4F75A3359B40

http://decryptor.cc/B72C4F75A3359B40

Targets

    • Target

      d0333bd53e654eef1380155f828b71d5.bat

    • Size

      219B

    • MD5

      72cc00975d3f7dc5564c1a0fdbd1897b

    • SHA1

      7eac1c6c294cf6a12495a484965884263cd77ff2

    • SHA256

      c489438648791383b0506b31ec255a3f68b209bd6e897c5ab4cb789ffc519673

    • SHA512

      9a76771f5f5e726113dca7e35c9ee71c4a2220e673c09b8fe48dd09385e1a2353d91a7002b198dbf136c03a435fa068657f6338a39f0095b148c8056cacf69e9

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks