General

  • Target

    f273d69e572f51a031e40b8c83f3e58b.bat

  • Size

    222B

  • Sample

    200812-rmpjfcwlbn

  • MD5

    8609a1469584fe2c96aa61c898fd08e2

  • SHA1

    184957747a301ae172a76046daf5480c525a55db

  • SHA256

    add2d6d1bb4a21cb6e1b3266aea269d4e66dbd7999ef070b81760cc64d547bac

  • SHA512

    2192354833c5c0c07ad79980769ef1090d7232717f9c73c13f16b4558593a9eb3028818dbc564433a41bfc3f092ea1a39cffccf0440a81dbc09ab8f5114162ec

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/f273d69e572f51a031e40b8c83f3e58b

Extracted

Path

C:\x4hv9t-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension x4hv9t. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). We have copied financial files and other important information about personal data, it will be published on the Internet or will be used against you if you do not pay us, so if you do not want such consequences as customer churn, media coverage, fines like GDRP and other damages, we recommend you to contact us and pay the ransom. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/634D9899C2608FB1 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/634D9899C2608FB1 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: GGe9jt48UdwSEaJ3NIWZNZwiQgRVDbuqCQyAcE51Xjyasay3qvLYfQHl1QrADAP9 scSLPuRkcPThgu1AKGlnHubg6sMOS53tGhKp4crqQlqAt2OVarLVkmh+rl0Jm4h7 hQR5wiB/G5NyQxmhVc4jzTl/x9glwu6GkkzhQinrX0Y1HQHOWWra4+QJTCKGsQOq PrJzpMWob73Wm0yGjvTzugRevJwYkYTRl3TwNJnDiiKk0kkieiUpvv1tt3CF94US 3FuXX3H1pYAzqj81cxdGjKEEShZiafaMm4W3b/x08qT5MMj0yqNxYITM17LMOIHw Zhvx9CnWe2ymPFxatATGDrbM380+tXL5sPPcJsbEmcEiHg2IOcT3HvzmkjgCPuWm l6pK2bFwjV4R9JAxd+O4Fo1vQBF1UWA5u3gUgNhTDBcBC22Q6szhtI5Kh7sw4taE C7WpHzzDWePWxohGhpCGsdOmb26/j2j+e/jmaozyeMn7j77OUYVfHAgiVUPs2hlf cP4jvfRE0AUrm74sYXkTTgyrRgGjASvsjwm5pR5RZyFEtaKgjVOnk0TMvLvW5Q8F CRkeSoQJN69IdEH0nQo4EvUr3B0mujT1owirjFrxFpZGfu/97bSTTa1cMNJ+UYo0 xG1bkXbbcJuK62NiAcYDPc7/YVFT0ufU0mlAAf2q4RGINqk9M6CASdrnlgGbsWQT n0Jg7U51XFgphqbTGiUqlggaYrC0aHQEJEyLjA/7oKu4O5d/830SrPvPDxbi4pSS JuX7dDTXsw+6000aIoOX8uFTSIXfN33KY+L1YjDERkHOpfIM8yGlm1QPRmoND0fU ZyAai6Si/FF2D1e9VpYYSQVyGus/uzLhyCcb5fK2q/MBY3fIOnMYvdkqRbqi1wrq 5ceqjKn585CnitQs4vJ0vrK2of9QB5zlcBT0G0EEWJyUkq7lPjba8NDva5YsZ4nQ WLBs0ha9mtGySRxddth9FJRdoDC/g17+NwfoMIxD7j/A1IOotAc2NmC3kyV2T70x QX+PnMnljAAjsLHqBTsEErn7dc8FXhRcYpkgTzQkXFfdQy9CkUylEPvlNn3nDbqa hHkwB4IZO1kGOTfJSigeQvMc6uPhVckpe0cmUnyXzq1Q+7KhDQG8brvAuwB3nfIT XBCEUZ+pf4Ok7SNFYkXkMZ4yPnLT2uoPOWliwlSqR2GE+ms6FXcgNsgsVNk12eJv SRtodEwv9/2LqZjuKzhlagxid3ZTZRLjPzuX4C446bBeUtjXnyPZgvuYk6PHa52G KQQNJpEtbKgiVJJcL5kip5/y7rFMCKuiVHVTrmIR4eE= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/634D9899C2608FB1

http://decryptor.cc/634D9899C2608FB1

Extracted

Path

C:\xfkawd-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension xfkawd. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). We have copied financial files and other important information about personal data, it will be published on the Internet or will be used against you if you do not pay us, so if you do not want such consequences as customer churn, media coverage, fines like GDRP and other damages, we recommend you to contact us and pay the ransom. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BCBA683F8E6DCD73 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/BCBA683F8E6DCD73 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: FMERg0DyEnGEG8tLVPzzGLyTSxoEhOUkcyHvvICYA6FJ6/NIwKkUBBl81mrOzYZ9 PzO4aEHgfkrrGcUQV5ht0OHDal/sUnp7TM+Pt0Ay5Fq0THfB4Bsa0FjWSdcT1d2A M3ivsWp7+C6H6QZExNakO7CitR8S7l2mgdgytWBJmd9E9mbjYs4/7Ey/7Dys/i40 Pc9/M4Xn9zxEHpPl2NGhZEeqybiYN3DX4/cL4t0kvOITktGh+NMLKAw151YQdqmr 02VYUi4v85dWMlxQH7fjx86vMUV3vMtu+Kj6gx/Ld/mzbf55seFtxqQiwLbxon8I nXQkZDDbozCkhixj9WWnAZFZkeGcLI6Oll/xgu+EwNJQ2tJCe3yTg9Yx+kREWh6w 2WZW5ucgyGASuDtOF+V3FZcTAdyTj2LgnFUfPQIdrVkR8+1H9g3X0l5S1tdfR0G5 EdZIskZvkniDJJjsZixtMHYyLWKsjW1k3qaqltKSwDfTSDOnhj8S87jwVfpmB8mv VIGtyfPNHjH8oBTLCCNFnTg1AVIkyxhG1OSbOo+oDduZXrbjAK9vTS3o3XI134Kk gvDaQ7PptzyBpjOFRm67oRtsMPjFvNtUlG+iifqNbGFwnotcCSnCe+FnMNEKyP1h o5wcqwBEOQpy3ZPz50c74lX6GsMEDeXmuTxHPMGa+o1c+E6JPk6gEjRqUiGVTjl+ J6WPx2x9u9bGUMpdCsVewiuDGQ3lj0e4bTFlXf01oIeptZXoWOIso6D0hi/+EjkI FMjB9pFd34I9S31foSgUbVrFEb4euR6lDkQTMqtvyGZktUNZgZVp29p/T/phksa5 MNiiUWfDI+dd2h7k5DallFr0eQ93XOOccA5GZl76fYOIFYaUURnb+JxIYV8wHYKn mW+popEVceCXyBArhcTkQAjT+n3hPw0wTSt1VkqCFogzT8iI9IzWNwiA8y/1yn7b VKFkG1HImuRwnPZ94CM4/iGVZP+2tr5DvzjchGKa/p4m/TTbLjGwUDn4oRvow4qE byeD0CbkEd5LmWX+9v3CVXe8l8q8+dgUE+3WFGgFzTybrl+v8gqE6GtnepUL43f+ 3MWsS5Df6E/6ODN9q9R5IC78igCMqzaYMUG990KvCFXp6+UUrG2ZlU99t1r7++Mz xEfb03pAE+/jHm2oKBIYUk8liXEa4UdzG76LxOGKjU0YmTio1lE5Z3IxoyJ1N16S A/J30DpXL8SLy0hqlwB9GhoiMPMDLCwSCCu2/kSRyXeNPk1M0YBZNB69Ry7eGHRc YU+vHPlKvJricKCjuEV1mg== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BCBA683F8E6DCD73

http://decryptor.cc/BCBA683F8E6DCD73

Targets

    • Target

      f273d69e572f51a031e40b8c83f3e58b.bat

    • Size

      222B

    • MD5

      8609a1469584fe2c96aa61c898fd08e2

    • SHA1

      184957747a301ae172a76046daf5480c525a55db

    • SHA256

      add2d6d1bb4a21cb6e1b3266aea269d4e66dbd7999ef070b81760cc64d547bac

    • SHA512

      2192354833c5c0c07ad79980769ef1090d7232717f9c73c13f16b4558593a9eb3028818dbc564433a41bfc3f092ea1a39cffccf0440a81dbc09ab8f5114162ec

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks