General

  • Target

    d03ede1599b616645b141e5d90789e84.bat

  • Size

    222B

  • Sample

    200808-6j5zbng1bs

  • MD5

    180a15a1b7d22dcce9a9aa936e0ccafc

  • SHA1

    07e595572456ae39c6d84f62e8486d2279ff8303

  • SHA256

    1e9091ba6649709dd03185a10f4ce888312d9f98edf3f5e4fdf802030d9451be

  • SHA512

    32c1731267ed489c6eac54ae0299d5a171f9f62f5aa174937bf79e993c58b24d613ca51b8ecf81785639fc6b9484c364b43151b4788bf39db92ac7cf6433b3da

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/d03ede1599b616645b141e5d90789e84

Extracted

Path

C:\4l05q35-read-me.txt

Family

sodinokibi

Ransom Note
---=== Welcome Pillow Perfect,Inc ===--- [+] Whats Happen? [+] Your network has been penetrated. Your files are encrypted with strong military algorithm, and currently unavailable. You can check it: all files on your system has extension 4l05q35. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). Also, all your business info copyed to our servers. Personal data and business contacts extracted. If you do not take action to contact us, the data will be published for free access to everyone. As soon as we receive the payment, all data will be deleted from our servers. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CF8381D06F3BF9DB 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/CF8381D06F3BF9DB Contact with us in chat on website. You have 3 days. If you need more time to make a decision and collect money for payment - inform the support chat about this. [+] How will the decryption process proceed after payment? [+] After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: //pC+jEutgi1nJmbK+EiNAeVoiDk0ZoUJP2uyUW8bCBzcosGgOHGGQET1UCS0Xiw aTrcUzVTQn6oGIicLvxdd2dmgoJ5JdbVjcJ5URBnUgCRB2bbYeQUrbDIiFZ939iG hX2LQ/c/hje/1gEZfCjJzixtti+oKlKv/c30HgVVhAhUBHROo0dQgVyLSkoZ1sOg ZKmTZLmDIc9GpK3VcnPZ4or7cdg8JkcaOZv3y25SZe3KhHXTbBEcx/NgdmM7p2O3 Jiyhkdyz5L6qZ/X34qZ78atW5iBIbATTRT26iFc/GWVeA+pmU6TlRah6S+UcbAV/ HXcpgHc0bLJGsgEHN78lB7wAnIkP2vkp3tZ4N4jn/OOD6t+ELQ38KQwQJflJ/R05 Ei8cJOYFtO3sYRw9xHnyXiSYQhx7DxbeoK8eD7Tb/jiQkdq+vZpIc2GX0dBVdVA8 pPzCUqKhy4HaUIL2uMRx1x+9skkmSfAIFz+JQRv1LgaVrNK/P/ypR32h14WbP7Mn Max6BuPbTmzXYVCtSKp7n0qinWoIYf/+N7XyaATsXxkXmdMANdxUM8mA/vJBHWuH ZrsWhXVZTJPqEV6Lq2J+qPeqlUygEmOwb8CKG3mIsLJgqPGBMvtjLWiTCxvhIHKR i2cg1t0zeKvEGFcp9J0nH5DM57GWrSAkuOd/1PjWEvXTV//BkngdxmrN87DpSziT RrWbIEQfLwxfOI+/IoA1FlgFIIAFGAeUcmsogUQK6p9Xm8088h8eL4RWvyhfXhuv dfyJH8jjWC9R0YK0AxyhQc3bP8mEyly8SWUndMGgBYtri0hnaNpKVctSCKlo4E0C OSePttIZgrenzAVpxjtZ56pvQTS0IeYBdEWJ15Df7rKmspAtWL0PQNi/XhodECmZ RFxOMfYVTymgqWiRd0VkdDOlQUf41cBbF7xFHhj+rbXkH0BKEw3j+a/j3jVcCY6N f4zIC2sSNFtNby9N0mIO8XOSusnFdLnUvbl1k0KiMjTUD6jYAP+hFLHpRRDS6eQf BKaobq5lTKyAsJd2FP6EtUQFyeFY/CPnSQih6SN+sjQNnO9eb29BbnX4b1JIijvY XxC84l4ZyYY8wt9SBykXJSCD7tCiORte1rc3wLE0cfuHQi0CvoCZVDpAmJIxheoI OWA3Q/C8TYKVSNF6BXDc+P1pf1rJIOo7k1xeMrQrY6e4akzTdGPNMS5avh5Fwd/e 4V4rj8KraBq20R/i52AwL2iyFvrfOfTI2ujGj2SYkzbwRk0YYDsKGwL1KgXRSBE8 4BUdr3xEfdwXLuH73ngUKlyArXZhRWmBDLsR3GyqmYihdQ== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

Extracted

Path

C:\7x2hu-read-me.txt

Family

sodinokibi

Ransom Note
---=== Welcome Pillow Perfect,Inc ===--- [+] Whats Happen? [+] Your network has been penetrated. Your files are encrypted with strong military algorithm, and currently unavailable. You can check it: all files on your system has extension 7x2hu. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). Also, all your business info copyed to our servers. Personal data and business contacts extracted. If you do not take action to contact us, the data will be published for free access to everyone. As soon as we receive the payment, all data will be deleted from our servers. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/AFE3CBCB310C2AD8 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/AFE3CBCB310C2AD8 Contact with us in chat on website. You have 3 days. If you need more time to make a decision and collect money for payment - inform the support chat about this. [+] How will the decryption process proceed after payment? [+] After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: qszVxl6wbDQA7jSaAAwdA+4TE2s2yA3KglplUmpefbrYtYW/Iu6Z1aFqfkDsrh1U nA3LGjZXPMAm4x007KMAeaouOH7STY1scwn/oODqOOmh+rLEtBN3OnrKxoIt60U1 XYjXKCPxVxq+p22seoxX1Y1uDPm0bDsebdeZjRsZnqzoqJoXiQiN8RN5vG0McuUR TUSSHIjwzZ10l1zvCkGYUIbg2DNRbtU5nkYS+ue9oqWzw8/yYt1CJ6HK5DGmBZkZ jiBcJuB8uKtK+usJ0X3ceqq50/82r0pwiq8vqJe/RFiFkqoBqGlRoFB5cuIIDf+j 2/saGt1rki2Bc0u5lNjUP8/023o3OLIgpdlHqbrBo6k61ObH8Ce4QdfOMoC3sXRm OHroKfXe2WQFtqS9ILD3EeIEOKDOdokTBNbb6YYIdtGu+3WwqrdO5/kJlbmvlpxp ETvwSpLU3HgQtKVr+DSohiwYkGzaIpJlX568BYgSkb2gajuQxzFJTWp27jt0fp3r ROSwz0eo+TWtDEDS/LTSCyaofwfNpANtsgiWZrcmA60Kwa40HJF2+Inf/RjbB0MY tVGFhK3Nxr3tubUe1DsJuadEB5VBtJ87S7NRf/KdPqrpEJkqSi0DVXkj2SQOYyZJ 7HExo8rtMHHSfUquaPs1BDp3I71147ORBnwES3InLPvOQwCn+g/C/lrnp2csXqBX kNNfXuu9w6WEDr7EKoKb/1iF1bX/0fOL+CvVRcWDONvD/r4nPumibzcffwKFUn9h GNZESdTfi0VWzGPUHlR7UiC8qzCKqs6wLwgmRLgOHPiN2lYOv/mIPVD8RJcbH0WB Rvvus3RCmNLvCyU3VC6l0wFYSfa3yO3yO7sb4NA10MBDj/zS3QFyD3GOLbU3BRSt bGoyPZ19avNqZC8TEFMXfe4c8PHep03rPkWaR8w9GuW0tSBEXM6vY00nPC7Kc+pF V6qIVLl56TwVdL6gUg5kRfE0QMaHeqPvBvhKYmtehVNvbHquWXxkV0lhPvdh12l8 jKTmWXWh3nL1S4QSbB6f18O6qKpPfYXvHcypdLBDXg2w4kJIR3a3yJWaFZlTrnPh 1mFPYz/1tLXtVtLTrGImW0dg7AOvuaqMKWnCT7R1Xem4R5DftPQhgt/Kl9LC5gYc 8MkXqzEy9t2fQg83fyOw3x+7aZNtWKRM8+3lXKH5CGRyyvDXuuuhd3gApJv1hZGG Nq2O1m8u4MtOHR4I+TanMXOSsv6DBmveHElAZKjmTq5yR17DaRVSzN1dQvo1Tkd4 V8r6QpyO2uOE+ROhQuc= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

Targets

    • Target

      d03ede1599b616645b141e5d90789e84.bat

    • Size

      222B

    • MD5

      180a15a1b7d22dcce9a9aa936e0ccafc

    • SHA1

      07e595572456ae39c6d84f62e8486d2279ff8303

    • SHA256

      1e9091ba6649709dd03185a10f4ce888312d9f98edf3f5e4fdf802030d9451be

    • SHA512

      32c1731267ed489c6eac54ae0299d5a171f9f62f5aa174937bf79e993c58b24d613ca51b8ecf81785639fc6b9484c364b43151b4788bf39db92ac7cf6433b3da

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks