General

  • Target

    4626b3b73d1f129fc3e84a480d61b9c0.bat

  • Size

    215B

  • Sample

    200809-4kzqapqkmj

  • MD5

    88f60ecdde5708db8e386e5ec0e8ab5d

  • SHA1

    b335c8ebd89c3841b9c94dce59d869129e6a6a05

  • SHA256

    44e348d60642000f9a2174c80ad87d7c89623bd4ee88c1953fe800508d49ed72

  • SHA512

    f4cd16976ae7aab93f031d29326dce33756b86ca25b7cb898ab05de69d679566dea3cec3f535e4f88198b6472df998d82839b6b48d73b4ba58fe2a255d623525

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/4626b3b73d1f129fc3e84a480d61b9c0

Extracted

Path

C:\efc80-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension efc80. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D2DFBB256CFF65E6 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/D2DFBB256CFF65E6 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: /u0xGWLyWTikVwEfTz6Ocx6B56Vl34bb1kEMaagMwqLc7j+qlOxjqXJhcYJCxpIU hZSPYT20W4zF8jWJgVz87xmglF9yOadhIPe6k38GlUKAXmVd5KSxZ+BykeQ5KHv0 SRpBLmniUTRIHQsdyRwCQ4vbxTUij2rDWorLcQ1qQv3bpvorWp5KjWK3fIlLfMfi WFdrp4dRLuO0nBI1nOLPXtFQUzKe/o0h/cD+tdvFsD7Lye8Dr6cf+t5LFxvEN+78 8JXeXJeY93Mu84Gd63MxctUE6ipViwDONFPiKhTWTwsNqZ3r/ZxZ+yY2IuJ1wqv/ drvH57enHku6eSwZTb9GddppiSQz3Qnbl19Dy8c1XaKs74/509KsEjrS9l1tGu3a hS7mkdkMVMfKOxQwpGfNnJNfAFf3muH9h+fRRqd56HwEGP6c9XqfAEhTtn/wuORS 9TDSZu5J3zdAQKpsrdCxnEb+oQwPeaYEnKOtL8Ni3fdthq9xD7NiphyvmG8up8wj k4vH9eV4dCwoSISmZ9ooqKJHv429m6v+gCSmJDVDcOmSkoNIUUe/ftOnvx1lReew g2gEV0sZBJmNR4gWYq9bb3DKlpfTONCBl0CevsGO3yCKfjZW9AERBw7HNWOGVouG 2mpmYFCJyEOMdJ0KxY7IIO9j1sdIoLfYYR1MThIhzNIwRg5i/CoQ3RONrkJAgWs8 KyVcR/LVP9fueNeXPbXB1Vedt3IIH1+80kSqeShhLcQ44uU+pNqmX4mEbUrySjk+ AazIKaYwQs4V+alIHkLFs2Je5Iv723xs9loXWO1SYrM5oM7wsY0FnNqqFeRNKxLL a98jaGDWDZ0NssiWbIGak9+5QV5Z6oxJWwXI886HPon4aLQb5wSKNmT1PjGBCp+o eTS4TNTXXuImQG4fnFDxNTgvI48kOi95gtRMen6Rn0hhc1A3e/T7AJZfHs9nHxTE 2Zmtui6dQDUL41VA82EEsOwEU9bBpN9qd6yJN/kgJbPiFOSb1NB3J0baer7jyefK wYH/91ivF7f7Mzr/H2IAJl12cz0YLG7xcnohOG6N2Fga7Z2naA9gFw7zTzGyc3wP EKHLlgsK7s5nJqEtvmqLvPiaVHbUmgcxMnSD7DIhHfFGPyg3xrkh7LYMVyyz3rGb oRUfevMiMAraLQO5u6pZs7qAh3t3l/BJIVtXsILdvuZOA0av8M7b31DIXhnt02aW kANeB8DpZ/UDeoZW9a9N5v021jDVLaH+MqOrwBh7f20JHC41kLsN3kThsr9uPNpz 4WvEBKtnYdSzca7JPfMaoISU47PekT605KdpZYBg ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D2DFBB256CFF65E6

http://decryptor.cc/D2DFBB256CFF65E6

Extracted

Path

C:\h7tm03t82g-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension h7tm03t82g. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5E9901D8AE11A76E 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/5E9901D8AE11A76E Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: oMuUbXEnKJW028QJGoImn+f5AS+qY+seEz36H0OBBg/C38saCwtWFUyOya5l52VF KhZusZHf2zPJtfJsK0Ll8YlXGg1gT6/bYNQ+uK2Ve0mJ8+NPi7nGW50oKrGhh1v8 sHdqMh7um+hVXbXQgyJ9hiI4D6VHe1W57gjIxLdDG1bYQ38zxpVE4obLu4fMpOpJ gA7DCTp+iOz8Z/7r41nzoz4PoCodWbCjC/ErjkDapRgieO0NMWhHFQ7oD/2e31ri NBbuJiNSlo7IkbztRVWUWmSqekCHx6R2uaUCcu6waUurk3Rs0OLb4Utliq7f5R8W OXsa+tAJv9ccHbyVeEe95V5113+67TzGxCNhBJtoKcc3ybr0nxCTPEDZs6PAO0vs aXusUaCW45826eBPZd/tPPZTW3RDLDf4M7AIeQ1TGz9t/9dprobTm7YbtGvPg4G5 pngu3YZDHvn37on0MBxDevDzNfiSyMMwkmuBg7LKPdadoyoTxq7HbgGpAWJJ9eCP Xbm1I6MczNV8b+Xdyvs5jY2vg1YpP7BaZXOEGjM8kFav5tH9DbolQqoERJakpoAl zdSdJRKOaWPZQqMgehPBGsoF7a2McMo198I0H0hiDtsEu4+GpB/PQevwxFKyKyL5 tn8IiIJEGhl/GvX84oyYZW1vy01+srrhfIjx4DPkKGVHS7UMsB3Rf1plE3/MdK/N k2MFGb9hA7kjNUoqFRjbn1IIIs5YOHImd+BdWx6WX1+4Jlog3oXAyljYt6sjqJZj +xRWe9qBAmL8SRLNSf5Lek8tnxtMTR//LJkIj7Zu80pbaGbGDNcpWJHpIYCztYJr FJEoKKM7sgHOE06qx5DGgcT/M1AYUY2uaaXC6Yre0n71p5uXLXjjqXLhA/mmxRpr Uyhd+9BZEMOGCivllbwJ35rM+TkSn9uKIEukQsu0A/VF3ToydzOgiQRyoJChcJas XoSGqvuktg7OsWoaZNyjIxviA0+pGlF9JSJLwN/orEZGrRYgH4DpJON1VFV3RZE7 azmj6ZO1p6P/C/EvVpoE6JUkxXutkg4oDAc6mCRcO/SZ9XR6AY4hHAZvN5DVplVZ hYxcWzfFZmMT/Q65P9otv34KyaB+7aIJBo88sSwOj6XkCkSwRTLT1qJb7LxJtDfX CNJUIFC7rRyGEIKxu4BqlMoNY9oDbTQBkogZpWZ4DLILlHSuyD5j6e7/5CZwFMvd im+RnOAe2vj1+cKSEbfRi9Y9BUeRMg68A4dF3bzoTlBVpdlENeU/5XXMTo4JM+om 2v2BRw7qHFauGqA541LClcoq3lSpeMtN ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5E9901D8AE11A76E

http://decryptor.cc/5E9901D8AE11A76E

Targets

    • Target

      4626b3b73d1f129fc3e84a480d61b9c0.bat

    • Size

      215B

    • MD5

      88f60ecdde5708db8e386e5ec0e8ab5d

    • SHA1

      b335c8ebd89c3841b9c94dce59d869129e6a6a05

    • SHA256

      44e348d60642000f9a2174c80ad87d7c89623bd4ee88c1953fe800508d49ed72

    • SHA512

      f4cd16976ae7aab93f031d29326dce33756b86ca25b7cb898ab05de69d679566dea3cec3f535e4f88198b6472df998d82839b6b48d73b4ba58fe2a255d623525

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks