General

  • Target

    16158bc1db4ba8fb8e9a13c34c8a51e1.bat

  • Size

    216B

  • Sample

    200812-ttlgt56tae

  • MD5

    bf75953509fd375616976c6eb6f30aff

  • SHA1

    3bf54cce4abd3c3434b7073e4ebe0f480295923c

  • SHA256

    5edd7915fd9b57f2643fe8abf646344fccd2efc98d4dcbeab47659b14f59feb4

  • SHA512

    8362b4f7c808e754bb468b31140b3ec023527e468ec8a9171111f77e39c55a8b04cc3442bc4c334a3cce25e90b9ce5cd14842d7cbd66fef8d6051d02f8e953f9

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/16158bc1db4ba8fb8e9a13c34c8a51e1

Extracted

Path

C:\atug0vw6-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension atug0vw6. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). We have copied financial files and other important information about personal data, it will be published on the Internet or will be used against you if you do not pay us, so if you do not want such consequences as customer churn, media coverage, fines like GDRP and other damages, we recommend you to contact us and pay the ransom. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F3E42D37D77A1BEC 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/F3E42D37D77A1BEC Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: Ay44zmn3Lp8oRsb1GeHshjLhLBCgv7RglcwrkGkHe/S1MLhiP2ohFt9FDdjg2PAW oYC8mKdMW6ukpkWYWZVQmz9NteHwYdyD40K/sYJLEvqj4f4uO5dPWEmOimZUebkS DfUrmjMAQTnU1FDYngN5hQTDYq2Z6fV1KtDhbowa3j+7OXkQHdEyZIi2PZxcHUhV ItGCdWYmt6J97ui3vvhOE+3vWFVpAcEjHuQHq2HoDGnpxkHt+KrHAPfTxRAUga8G MmLLylgEyM0OIHw54MSzSNmom7WMLx1EtC7KorghYSyC1uiSxQ+ug9gX9GgkUVdu hpfRurc7+DtZhfS/QfM/0Q311utoLB491YU0FXw0xhu7lra+I132euJJ+ogsUN+8 ghJhs2d2pWJm4tK7NV28b8ZESD2q5KxlkOEaoeTzSS5ojJsQAyAc/GMI78SQSH7F St3a0oR/r5F1K/vm3ESvfFGsRYQDzepd0Y93J9I/Tys/Gfzbz8ex4WVEUm060YcZ fQI9AEmtKxx1NWSc2kFd9ietBNMRFfE245IbBpYJwgdmIByGDzwjS4FENH4BLieB dmQRiLBiT1A5mTjyfC4Ld6jiEdgv9JzxW58YBylF44Wa6MDwq21swkobUihQbBVC aORE1M7HAsupO+0I7R4xs71g1BcEjvwnp07VbFry/JEkvYJ92YRhSgHSZJywmmhw s8Tss2cHiv1aZPByBH6ukaVCJ1D4MXxhSLvRVo1zEAaqNwFsG9HxoRefGqwKDOq0 x7g89N2HSPpb46QObeP3bKiK2bfSM5psxnyVhN1NAFcbLGV9mCL2tiLrcBR+v0uQ GswoLZPnaDntpbkDoHuwaY9xsUYDOUq7crwnpAMEklPIJQaka5PGIljAZqxpDfLq YhsJ3Yp7Vf1uw/YrndR/8bK3GidBwAq4fH4quNfnlgVNdNWnE8vUenCEqBS6fBqW tnYdu5afdmI2enTcW2e1LtJP1mCWcTueWsw648HvUx1+1YQ9+cEE/a7jNVNCh9q5 nCgtgVtyUawzwljWCKQ0IMgpzSdc9aawdxNgzbrJjtZMkyJdSuqm0opCH2qw0dWZ UxZCCIlyXJ6vwBuCaSTu3AUpGK76EoCOKvmjA/Xonsb+SxcFoELvndy5b5BRQubt MQ3C541TQirVWGDt00iBKskw2SyPMItphfI0rpdYFnM0fU6R4G+t2s9ZWmKaWoWV fcwsVWPC+FwGQTq/MQGQzdrb+VRyGIL+D6MPf6/fHXlwDzEutowlU8GPp9ffcPEH HYjlxA/TJmUHtoiyXO19R5k/pKAYLoP5TFpeXlx8eGQJQNrS ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F3E42D37D77A1BEC

http://decryptor.cc/F3E42D37D77A1BEC

Extracted

Path

C:\4v057e0-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 4v057e0. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). We have copied financial files and other important information about personal data, it will be published on the Internet or will be used against you if you do not pay us, so if you do not want such consequences as customer churn, media coverage, fines like GDRP and other damages, we recommend you to contact us and pay the ransom. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/71D027CBC5483D95 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/71D027CBC5483D95 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: POX/a2yF2zomIaPN+UxRYa14bR/xN+ss7WSwlS0b3pVut5Ms1rzZ4XhFjRu5pbep Lf7b4kaGX7s14moz4SeNLMCV9DYm6sOhtzxOPT9RRDdhreDM5G70jIPQ2MTKZbS4 DlwPYIcZhxDs5K5FKxLEX4FORiWPEHQG+Hv/zntSZI1x+HYzx24QT6Li4YWlnmpS MtAZw1LaXy1f6HJZ36Z+SrpPbI4bcVI947RIGowk/er7FmBwFavhCRd+VtDdeaH7 6lsC/9iMiFoWgqIDD9tDrwS0DX1lAgFcgFmNHd9bvKh71M5OhFsjGNZUDah2fRcO PtC7ZjSKo5mwnY6qxNA/7xZRGRZrw7Fz+6sNgnvxwrEWQJTZtVrBj9RGKfqiBK3r dMwZ2WCPTlNWugBIJN5FhnRpSGbmisivnuzaxPcwrt7LlOf4b1MJjv0RdLnhMFDp mgGd8TXUQPd+LGUbxXTFukYrM1bFcdrnaRGlJxnC3cBoLFWWY2VuuCWvhLc0mj/o rP/WctgAnDdqBC2kmOagmamdPso8FMfXPmCYV1dWXw6VV0bAxTenqx8YihJYP+XQ 5aQdFogykqyJCBWcCr9l99iVtbb9vlbGSZybAw1zTciqnA6WLYAVdXr9VXC4FX12 fFA6fIx3P07xslbW1gSkViqRK/MHN1Kb0T+YKzN8E42Aqmoc0OBKzcwr4HOBsw33 cMSZtRNLIFQhse2lm9JRX0y5hlcfu6HzI1Nv6wOCz1kWhotC4w2chiB0thOdfPsp wGn0EJb4fvMG3ZUxGZEODWiWi5iQRRLlk6HtUOS73/ylmurgRsK+8dn5WWAbCTot PWS3000lgLRpJgN16F6G38l36nsE0R4dKs6jjfmng+Os0LMPRXOa+OSrVKU+B9BQ 8BzykKgKzRIrZR8FlYcXR/IMjxg9mlr0sPExbxZTT+BBvAK9r5PJzc7gwj0VreZS Whw8HftTx3vdxC0ukNByJ6GsaBux7WUYKgJ3KjyZ12FLkR4BUxVI0Lm6VT4p+0jL ETYpcQopoyeMu2uZkMwBCNPhTSry6wlcpTZW4h1/SrQLjOdlN02fjA6hPZk/MRNK XKDh7R2S2BDZcQ12lse4VYVs+bQMvJQyPFa+NsQD0D43D6KkdhQl8FbvmEA8CaU4 eprgslvupbyjDlaZCEn9kqZGN0pgK/g0C3kirtSq2BO5A4qYcD7K5mOHze/uHoWu Q4gxhaudRoWweAKXW9NZQGG0Ys0t4i2wDj84HavEcmThhhciDh0pPMb9VhsbYfmh unsY8OhJ0zkpjQ6TiddKs8CK ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/71D027CBC5483D95

http://decryptor.cc/71D027CBC5483D95

Targets

    • Target

      16158bc1db4ba8fb8e9a13c34c8a51e1.bat

    • Size

      216B

    • MD5

      bf75953509fd375616976c6eb6f30aff

    • SHA1

      3bf54cce4abd3c3434b7073e4ebe0f480295923c

    • SHA256

      5edd7915fd9b57f2643fe8abf646344fccd2efc98d4dcbeab47659b14f59feb4

    • SHA512

      8362b4f7c808e754bb468b31140b3ec023527e468ec8a9171111f77e39c55a8b04cc3442bc4c334a3cce25e90b9ce5cd14842d7cbd66fef8d6051d02f8e953f9

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks