General

  • Target

    bd67c60ce76f0f3b40b1b84b16b2ab8d.bat

  • Size

    215B

  • Sample

    200809-rbjwygwxla

  • MD5

    978c1461e8ec6775c873642c5b834b74

  • SHA1

    1b1497826b127c246f8dabf76e1b70282de5dd4d

  • SHA256

    735dd69f2f238ab5aadf794e088d67c71cff9321f753fc47c1c8de4f914567ed

  • SHA512

    882e9baf4c3404dc69e1a866f9f707cd259be9fff097f69f7aa513a9e0d5e6c9b910f96eebb96d0c8b52607e02cca9f8df3768a85c3b85debdefcbe57cefcd96

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/bd67c60ce76f0f3b40b1b84b16b2ab8d

Extracted

Path

C:\0dd1e-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 0dd1e. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/97E1C50A97C3FCBF 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/97E1C50A97C3FCBF Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: IgHblPo81KeXfp+JMOy3ZubbW5Y8OMSoYitwNWq1c7fLnTAAdPBTF9NpNiSV1vgC N5mWXHZuR392phzxJ49ollooUsKeCUm/Mk4y7Qd6m+VV3fHBEguij6v3nPPJ98RR 8q3mlnpecidVxF97DsaSGGjxPaXRU9RyF1mo6OBl0gdcyd1C0e0pLY2IeTJAazOT 5Mv0+4AswDWq0Qp0KMmEJAIOV7QCB9z10oStx5X4XWUWTdxGaWhYMH8R9CwYykVj PIiiZbt2NiBgD9z8JJVEujC0E76ZRiMVaGPDmArrOaoQLMbdEhmns6aFg3NitfoE +jqC43AO4DVt+tqtKH2LAfuvXhuKlfdeERKCt+NYMgdA6LpI0yazxj6BDbHzMPA2 G4h1o4t8/LDhe1SHC1X/92XdZagwGU72sUucwewmI5nF41JiEB/NtXlWnvmz58PA cx+P/JdMfFl5sVoYjPQYXCV57Ysg5uQl6eqMqX+T9H4/bnG+A5kiCuqC5MOk9fnB hyNnNxsoSzD1pddwWtHzDmkiskzFLUsSL9XHeUZXJJI9ODAyDQZV1GUC/LqqjDNx gUyeo5E2Y8GLCUmZvPOQlJ7ypru36nvLspjAngGd+lXTQ8+QBY3DcRvUlSOlPJY+ q572sCj93OO6kr6mYg18V87Q+f4TTZC4d/pRCMyyK4gsbVSA+VFaHL3RsTsvHHSy V1KV5jR6gacH6E6bGweWAenh2pPWLPIeWTAOWTk7i73/eg9kvHw+rLkHqYwfJFbh I1WutIBZ62IRxfBVDn8qOmcP7/t/UxJRHutnhhTERbDUXekAAvQeETCT7ZC7UpI5 +8o0NwRoE/cD5pv9KZNdlBgbYdVjNNct3twPsvYMOIjrvq3xMA5M7pp7+f/EtcUI drA5IqenPbZwr0WJ8TkHe8047zoUu2TgCr5IqBOoVYz4AZmDAympzYWRZndCoRiw 2Q2jqkE/n8+a3mRlkS6VpxWyuU8weBNmU3qEB3vQ1+BF8GkSwB3Pryqzkg1ijnuS EJctsISaS7IoPjtHjBdKWLlm5nsFz7ECcc55XY2uvcIzpIs7xLbripb1sj6thStv /UHbGxPa+WbyDg0T8d96sLdqk/mEweXueUfPMcGCoSH6Go/HeObR+0eyZHS1uhw6 Ta3vhc33pAlqbSbnKu7eCPIA8UO0Ox/A6sbDJZymyjfL3uSPOWaIdzfCku0S+GNA FvDjKBFQHCNOP6Lbq54ZVUAgO2thRP3KZcDuFCvZ1mrAewDi+5a/dn7tGSpKMWrJ J8GJAKwLxW8+QFzKdBhCb5EfoiouqsRrTf20I4MV ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/97E1C50A97C3FCBF

http://decryptor.cc/97E1C50A97C3FCBF

Extracted

Path

C:\t72rz83vf-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension t72rz83vf. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5B6E9B7957F638FA 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/5B6E9B7957F638FA Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 9we4qSmwWUHTMLsjiUn1v8MbOGCGlft7af57o9ojJjb6pH8J6sluFlCwZR+oWgeU LsMZ/h15eWzCMZmPq6uaP/3Y29nfs8fO5+BCGdo3Z+PrTm8g0iW/2gP6IFg0Q2T2 gyUeQ9/jukxsLEAzwYqWe6w9vNKUKT9viwo8ruPZOqR7MTybLOSbh5pWjaoGGJ+X WuyxjlZRnjuty/gM5dM+DjFiJ68TzPqZLge4WTpMBefsFSbKrbH/KdcCDJtu99uZ xsFWdjRETEdlmAtlvKMrjfqdp7iZDaojXNyDSYQBS5g+dHRCAFwU91som13TVd56 NPz2fFNRzmHzkWQiKdMqWyORKb8kXV466enjXFRzta5PYCO8E5VMIEO9I6EBzQo8 4rifXPofGIklatg5HH4hm4A5gae4x+NI7K9WEk4gi6TXeudY33umn4cw5/rUbPNZ gJtUIMVVK/ngdE2pAAXlzdOHd6lvKIqvpbmAF+qL/qu4oOoKq+PSDxEVwo28y9n4 JVUb9JcxSeedmf+vAxUp9acQH63w4EIfDdtyh7LVOC1BFjU7JyqTsozSsHP3Xt8u ScNrkxYW4sh/GtDiN/tRHgmiJDvKSB3qpaGboLW9GETIsOJEBqn/I0ohVoSwulQY +atkVe7Ng7TFp8Hll9Ii28R3p6AWoaE7A9ehRbePcrMvMO6fXCiBEF8DR6yvOgaK p/RB5ILIrbwpXHXWjHc1fkzhf0tfs/b7ApDt4qyCXcSubgWhb0tVyDtOCpcWpGiZ TXhTXcJy5/VEwi5r4mqP1xBzMAYI8i/S5+sTA3sFKDJ0TsFUSnVmVryUHxavBFTY nEzcxPRmp2LDLjZpfuU2rDCgweNrESDP6zyHonTxIA057BTNqV+MTuQETLztfzCQ 8VoOioqB0ugIg8j+bVfZRYds58DthVX1J2TANq/hrDgzaAwf9dPul7ik7TJBy6KJ BiluFWY+LTPDkTyDBqimhnzDEEfD2QgrZuWR7sTGWA43Eugm/SXPUfqdiW/NierD RFvXkHvNXTrHY2bIaYCNnB3BIBq/5afkqSgCk6VhzX583T5Fe7QDNwbvmDxuqSDx tsxgD/n2WlZtCGC6aaTT+A8KqFkS/IjBFKE5q5fzzVNZHgTCicc2l1BN0efzC04N U205qqtSOiT9VfpcJ3Nd0qGy7eMB4bZ7+52AhJb397prH65ZWFHxxj3d6DdJ/NDx MGhJKobEcTWndQEEFMB9V727KxUx3DTekdIL2oMM/qwO7C1vqwHAkW2NSTGsQ4+I VhLVy/CNDdLdkU750RN75eBcZzII5w== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5B6E9B7957F638FA

http://decryptor.cc/5B6E9B7957F638FA

Targets

    • Target

      bd67c60ce76f0f3b40b1b84b16b2ab8d.bat

    • Size

      215B

    • MD5

      978c1461e8ec6775c873642c5b834b74

    • SHA1

      1b1497826b127c246f8dabf76e1b70282de5dd4d

    • SHA256

      735dd69f2f238ab5aadf794e088d67c71cff9321f753fc47c1c8de4f914567ed

    • SHA512

      882e9baf4c3404dc69e1a866f9f707cd259be9fff097f69f7aa513a9e0d5e6c9b910f96eebb96d0c8b52607e02cca9f8df3768a85c3b85debdefcbe57cefcd96

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks