General

  • Target

    25cf7ba78d389fb326f0e98895989410.bat

  • Size

    216B

  • Sample

    200809-nec48wzbgj

  • MD5

    ca96a50f1dbb7a4a0bbd3889984eae09

  • SHA1

    fae38c86303f6ac8771260e09be944dc5b07c90e

  • SHA256

    45d08574bc59eed48570614a1f267ba73ba94011c6fd8dfe3591c01580533b70

  • SHA512

    dfcce14a5f3e8d81a55f38862c78395146a64201184a2a1bed5db0128559ade834e3343c4526808894bbac71954884e18ba00c7d2b0c2bc49f96a68208227550

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/25cf7ba78d389fb326f0e98895989410

Extracted

Path

C:\optofz3-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension optofz3. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3A1D3A401EC07D7A 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/3A1D3A401EC07D7A Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 4Tcm4gPn/XIm+Jw/Cq+ao64AO3MbZ08JdWffOIYs7t5SiWMT5Rv4McZpkZFHB+fw NKSA8SCnLMo9EzOj3WWl4oo8RwVszjWA80siwYnUUZKedTQ6fmX4pJsrJvuQGcO9 zFBrL+atcmBPwWyaADduYkGMvVLhf0/mVG3A3AyEvswG8xz9+S9GCQnvgIPejJ6x VCzd3bTrUdQiv5M8gSfEg9zt8ESO7x8VDkJe4ob5IQSKHiwA/inpSJ+UL9EBLEGx nv8tYyx3Z8wi+0kvmZzvlTu38aCRc8nzw5sCROw7MqXSuOtqOF/7+4vMh9djgwYc nxYiA5w5u/uBkAWWcfBpZM4m1W6LArb/sFvTBdR0TkixZBZRzNlqggdBgP01b/TQ dZ6GCdr/hEUqILYf4qJvRE5UtioO6dctdnPIiiDX7LlR7bhh30F/s5iNONIWvXJ+ jXBRCGj5jhBqdJxtkMS7U/ZZy9Dicgw2hIxEFR3B8jdfAjKz6zrfZFHGyu4X52jq B6GsJwiNBXUygd6Pf2yUY9OFxloq+5yamB9zWXgaXMQPviAANZQO+6yvMGBPoOqn wHvwyw9U8qZG1WAgw7l28vByCm2+g6CYN0hsa/4uX+8jp7gLx94OcoB+5eC53yzH Wb1xPP+P8XTByLb0nhbXxTSbN/JrLUCOLI+1IviuamzTND5beHOBSoVR+DeEt9RQ bM9ghlQQHLeKCGRS/gVUciUGzSfAU+ii6r+kHjtInT+lMKCIrGocMJWqjNyEbWNt HUNviu7IdAY6T2y7A3fgB0iHDmgJST/AkSqxOEIVau1SDlgiAa72vskL6bBPqxvK sDFIV49JtMjiDkHfmwb4zu1s7pEb8TSvC4U4OOvhuIZkl/XMe3wTo7vluUjg1byw oAyGZHoQ4JfkUcoh89yTPFjLtNHweXa0jNr61V3T2ekWdDNctK607o9OFSu7il4Z SiDCdOZvQPNWdkn0euUYw15260UCLhOGn8Lj0rn9CaXJBMsbevH5vedG95EOADwD KqZurpaIvpoR2S7kz5BSnpXfZUuJOnaE7HUNiMrEC+n3UxUzAt7tZ6hHPTrUQ7Ap 9kxoEHWLlvsLMnLw+tjo4LF98jatiPrGaOx2CsQavtRzkvuYBX3v1HmWio/ngAF/ 4t++jFAr8mB/UdwdfI8Fd2GC8EjgfOVzLZbBAuZ+0+8ZQWsPhgE9rkIrss3f3Ez2 bh1761L2Y8T8PWrpPimSGJJDRJ26Wl7ndVA2JZH0zocFLErfxHSs9Rhhz87hDBN7 30sADYmQU7xnPuP4DSN+anU3J6t8DCiNmPPDA/t2iS2DSg== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3A1D3A401EC07D7A

http://decryptor.cc/3A1D3A401EC07D7A

Extracted

Path

C:\176e8u2-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 176e8u2. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A5D78B1958D2D4CD 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/A5D78B1958D2D4CD Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: bO0650RTJlF6VLsiX/ZAyJzsAexF73em+iRj2tuKCNaJZcrPxHnYm1ml2pn/nFt/ iBPdHfKmTCxtO4gvgbeU3ac0EBGKDEOxG6tPDnfoQ4zU6ALmsDWdQHSlTnJsZv62 1B0G0QyEmVgd/E/+2sQf8XyBcwrGoJsV4q7vWi8WxjUyjbW2eWEPyDgCKUhgqcE2 nUvGpRoRhZ8wONtORegak5VctOYjIK8inv5gPeA5da0pT8KTQsGduqh0SvvL/3Pm oqHr1+PFdF34IHvd1zH/mfLPBmK4NpEYZW2U+0vNENJRdQ8dzfLbduBqqxKWsgKQ F5Oc/zbU+qkwh6Yt+Am0xutf15HlfoIB3n3JX3GhD+M16+qSlctLDsrAGsj4SZjA rMlvPgQq1ms4JjGHXlQkhdYFPsfk9ZKVOpHtBdYZyC8zQTYdxxw+lqdv7yX6KbhG I3STWJGqEfBtLrW5WG1T1QJ6QyJot0iGH560AzmRfW0dWs85vRCmqaApf7sNmG/u 9NNbzuDSmDG8ZjVwEFE2xnD8pP3xzLUuSFqntxC+g0rp95byZdqKUqVpJhOLtl6b lQTToOj6uER+MWPcHdEjPgATAS/3cLETQfXjFbZX2OcBERV9O0yNcQC8dLXHL45Y 5xqodJ4pZoVr37dFUeIAj6JT5m6+nnPeosIHyM1JJmBmkgROpR846WvpfG+61icJ liyPaUTXRuTYWEIT0uMYoXM/rrxJIPyUD+826Bsmqo6OO25ou+iwNe04h3aCPK6n 3RUQgxUt7KlOpDLYTNPZPUjDI1GLTRa8oOONuInIhnfEBlMiQ2Z0oE2w1EDo03dU yHFFR6a5px6Kzaz9olrR/4aRRpMLtyJ6YDmo2ZkrSxAycYFD9MtmXJ4oAHhjNA9N S9YXlogHrLuNEf2d3siCJfA/AtWWx2YAM1dyFZdidnsiI0ZBh9L5UtSpyt1MNRmj O2PLI4+nu74OKeann+QibqC1ux8s4fZSEVqwZEfKrSaozA2FLwjdWRLOQFw6dPBC a8VB6nEuXlLwPyJRIJnwbV8RTq45ArScQ9P3dwPB43DLQ3syOjhinxDEk2tA8n7j Nzdjvb6RqHcJPyu4eRak7f+DMr2Mazl3n/v1oiavfOgA04nSTmLH0zq1D+Ry2GqX ADvjm6UityVZI7+rLZGx+kwLQLY65mBBQ0xcV45lmie0YOPYkposRfi//vWohT+U QhGqdXYVOBndYy++x1YlTfCl7kvTUW+XNiO/nWqp7GpG24eQqKhY5zNSPlLHOAFk i9vpL+Zba+WKxT9qHXGV/9O2 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A5D78B1958D2D4CD

http://decryptor.cc/A5D78B1958D2D4CD

Targets

    • Target

      25cf7ba78d389fb326f0e98895989410.bat

    • Size

      216B

    • MD5

      ca96a50f1dbb7a4a0bbd3889984eae09

    • SHA1

      fae38c86303f6ac8771260e09be944dc5b07c90e

    • SHA256

      45d08574bc59eed48570614a1f267ba73ba94011c6fd8dfe3591c01580533b70

    • SHA512

      dfcce14a5f3e8d81a55f38862c78395146a64201184a2a1bed5db0128559ade834e3343c4526808894bbac71954884e18ba00c7d2b0c2bc49f96a68208227550

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks