General

  • Target

    0cc92ed976f20bbf302be1a39d209cfb.bat

  • Size

    215B

  • Sample

    200809-6zprs1z6sj

  • MD5

    5a017babe92c5caf427346c46b48b015

  • SHA1

    2958eaeeb470d273b70d1528c0e78b33de585b8c

  • SHA256

    02a0406ce3e4a1076e67011128e0f0ea53e4c1ab7826a25e0215c8418960563e

  • SHA512

    8406dd4b30b5f549321ee69c640c3ddb93cdf3213075ddd8f283698129b39a1ae09e08cceea0a508aaa2a600b96f7e491331edd63e8f2309563bebc386ef6ece

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/0cc92ed976f20bbf302be1a39d209cfb

Extracted

Path

C:\qumn6-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension qumn6. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/FD8962F599EA2046 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/FD8962F599EA2046 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: xHJUo+qAJpQVJdmUMdWhJkZ0ayBDRhQEm/mf0FaNz8hbNloRyo1nGMfXhTikIl8D QAxOKoazUd4j5fpo9VBS48mJwHqc2xbV6j/MVpPIfuUi9ddiVri+4NPMPIH9IVKF Iwl0PI4j7Ny3wkVzDJfRTquMKUCwQogjXKWnp9xqYLfeaijPAu4h2Yap8I+4K7A1 zz5ckJf+15HHVQdrvqbX+ziETsxJPPToIK1ZMN6g5l5N7lKF7W9Kr96QvHQbwYm4 myS/X3kPnB3SjrVvJaKChiHWl4xZLE8ojTx8LaywCK7kCAbUjl3WVVO+ZkIYIHhq ABE/yfwvb1q2H3ay3dEkrmRkkjKxWf+vuU5iKxufJT2CNc0y8AZScXva/i+/4mvC IRp2RgX/cO6XxNBgm22ruxSqUF1rEJuOXsxPI/t4iBhlIO9QhViaXR2FUmGMaOsC oBv4Kb0I0e3ejTxsrOO3/jZ/RJ5zwS72Ln2F7nn4vpAlyKS0jilHkxAWHFDxOD3J y57f4b3J/b7258fBhpKI7mCNdtP7XYVepOUwbYQOmv0uFmRLHH0VXhWzl1Vj/WiR oAW4zW9ZLYk7rk0rxAukWkv+cGg1zxsp3SGReAB1yaCKEO30NmuarZ12tT4q0vbD quDQymxPGYffkoA4Js1RtHbN23vofHnPUsCDJO25c+84fZejwzflkYNYkHzp8hmx f4+/yLEoXytZB0u4DPyTL0MuUkKLytOhkB1UpoYMyKCPqjXbxhevzQit9z+eW/1F ouCr76A2Q2d1KX4p6Mg4JdQCNkwnBrJZFgEMFuk3Fc7wxT/FHLJWiW3x9VeS4Ex6 ywshbc7QXRO9/rlstCm118YOJOIhIKFiE7Y0mfRVLLeRBHb/oKFx6OH6IEoAAHt5 0EwYgfwu4f/p1RTNosiNg11fuiRl55sycmZf3GX4f4mGOLhK7fsG1giX8kzNmc/B jac2SNow+cCYR2qN45dk5/JUp3qcEbpk7QKV4k5H6AZYhzQw2Nq3IrzNNPf2Z4y9 8/IPoohapZnHOyeliLn7DXyEOE/eBhSHUCMIGieSH/6Lrw+qUHCK3R043TKGNXNW fvbzJBl8vkNMV5Z1cGaEwthHlLpGzJsaeUgUVEE9jMmnkybTOKEnwT6wwuXXoVBi 2XM6VZYlA8VCFGt1lEFrgaLwNaWHUKZqa6qs9xju+ZKbKosAIFzLyLXITBdgIhOX Zz8zVE51JS7twC4nLlcoq4FJs8FE4RvYATfp3yzEqaPFr88xeTcAm7smcxYmQUcr 41r1vOqG8rVZVN057wwG00+4GQ23MACo6yZ4Ffyo ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/FD8962F599EA2046

http://decryptor.cc/FD8962F599EA2046

Extracted

Path

C:\jl77p-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension jl77p. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/183B54E3404D5CCD 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/183B54E3404D5CCD Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: JhJoI3roKoHIfFF+wyAJYx387ayivjqvOh6fcMBRJabN3ei7GUNGPvgYCp1MsgeJ VxCEQ451czP3fiSrI4qijn3yP0AMIjWgWyi4ImTwWjUQUirFE8+3sPPg0aPDa8JV UR0hfbMyQ6/7NMS8kSP5rxfhIEYXtiLuR+pu5f76Y3OjWQvLTVz3l/9QXYw1Pfxq mP0NlLs7Ogr2xilybSVKmDalhGukp9mlGkB1HlwArJYqyNwM039N1ma/THEvsip/ 6WHdW6Zc1E2j0Nh37zU/K+KWFjcLNXKgnSzQYjnlB3u7bkS4hWIjMlwNx+/zqxeo XaYnYLyKLLSD60+axywRzTSOHV/zcT1qZWDK2kKygnE/gH3RVLjM7Ug7c5vADX8N FjPJa3e8VC5ImxhlIeCqfuXFylq/6OUtzzY3LyAYul5rjBM2jf46csLK+HCoA4Jc amxWOkm7PKM3yT/o/bfCabod1VPxit5/qM9eljPsVsLvC3Ti3g/tkXnzcuCVVZML HHVhSwuiRGbjXYUYFcP2Xx7X4obvJ6Z1NZMr/RhWLm7io/0/1qyg47jmy4syYJj3 9PMTToJadViccVYO6Zv7UQxtlx0HPNFUKeEAqJH2BsVkFKodJhUwr4FTNohoL3kl X2ujSE93Ggxi6uI8coC3Ke1W/dsKz6Qdvq6SVWonqKsxcsXGL0LLrKZeG/ysqATm rqVfU4RIbrqG7Ur/IHaJm2bmjDa6yhYhWP/iu03yTorgFOEOzjTJKOlRAwtqM6WC UaPQIo2Hz24XU8bRVfGWObCmm7YtqgL1n3pvWxW5gU1r+8uHzMEX20IfXg/RF4Ae cYQDkiR9FPZz09I1mEABIYl3vLPuovzzZbekuFWSzEDWTVYK8eWQ5RkpEsdipizI Rp+crbRsAnx6smXYwH0G70jmWLgrAHImbK3ilqly4IbyOKB6pwXEZxZR8viJq0cI TIhH5rhDkS758kVF0latE/OUsMnVpuMWJZspttgIVDMTSGpStKNgnT3gmMGm5Lex N7+lTyqBcL/ZZLfQtbzm/RJSxYPDsQCYZ4xAdM2qwT9aRhNsTyUKUYZEOWl/hTJL UWBsI56UtfI2RTW0Top9zzmfFY3g3UCEN0Z848QY5/CKPeH9lwmh1bZ+70lTMI5V J4xMc9Z+AECO5VDrRQzxuIDg7fEX0VtEhB0VtGS5l3zy7+OdlriLQALV+xE+AA7o ihU6X2eXITgI+clFLDsZ5s3ecQbfjUEDDIfLg34DO+HHHsJ23hpKo2stdOZ+aPkg SWY3+cAy7fZGrMjkzsU= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/183B54E3404D5CCD

http://decryptor.cc/183B54E3404D5CCD

Targets

    • Target

      0cc92ed976f20bbf302be1a39d209cfb.bat

    • Size

      215B

    • MD5

      5a017babe92c5caf427346c46b48b015

    • SHA1

      2958eaeeb470d273b70d1528c0e78b33de585b8c

    • SHA256

      02a0406ce3e4a1076e67011128e0f0ea53e4c1ab7826a25e0215c8418960563e

    • SHA512

      8406dd4b30b5f549321ee69c640c3ddb93cdf3213075ddd8f283698129b39a1ae09e08cceea0a508aaa2a600b96f7e491331edd63e8f2309563bebc386ef6ece

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks