General

  • Target

    f273d69e572f51a031e40b8c83f3e58b.bat

  • Size

    222B

  • Sample

    200813-ezseeea1pn

  • MD5

    8609a1469584fe2c96aa61c898fd08e2

  • SHA1

    184957747a301ae172a76046daf5480c525a55db

  • SHA256

    add2d6d1bb4a21cb6e1b3266aea269d4e66dbd7999ef070b81760cc64d547bac

  • SHA512

    2192354833c5c0c07ad79980769ef1090d7232717f9c73c13f16b4558593a9eb3028818dbc564433a41bfc3f092ea1a39cffccf0440a81dbc09ab8f5114162ec

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/f273d69e572f51a031e40b8c83f3e58b

Extracted

Path

C:\3333t-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 3333t. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). We have copied financial files and other important information about personal data, it will be published on the Internet or will be used against you if you do not pay us, so if you do not want such consequences as customer churn, media coverage, fines like GDRP and other damages, we recommend you to contact us and pay the ransom. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/75209EA47D1D4065 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/75209EA47D1D4065 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: ddP/eoL4Uxiu392fEnG55s4iQU9tmTeYMMSKrKQcy5XlhFH+xyOYpN3CXIBXUFWi xFvDNnFXKHb1tq/SzAe4VlWUpFh31eGaU8/w5iktwUVsHkf5j5E3DeC9Aw7opqLb aW0gWzxFLQmZ6idEjz3ggQSy6D0ETK5ceX0EcLtBZtl6sl7VYgvw+oaROj2NuMl+ 1555KfCPL0J0jyJ4r55j0sYIq7HaTMhODCiBL9DHdYhgn93FiS4yCCYey20lWKeI /GJ2Fsu6kSyDa8t1CA8PFsvRQXrvL4Y9CNks0H5SMePn9iIJCC9f9BT0XUTuILZP Sre6RW9t+1XuKn4dxx8aqO81VvZJnBP8fmD66vrdd2hBnC4pLgKA1ciTlu8RZRZ0 cWsEcgSkWaLXXGu95EXEREd773LjexMrjfRGO3Rygftzzq/NYatZLpf1qT8hyi3o tcTU/Lu5STYpPNaTF74lpEevEiAClNILdgXRUauPmD+bZk2oXhVK/dbtHUHpH+rM M982RZD/qBL5xb18DyPlRcRKc2dC6I+EvEM/sfEDMRmqwrX1TiTD6ukAbaCVvqwm fnz1pznynIcrOi26DG8NzVzIGu2jgFiRDxFWDpzA/wykJXl9wZc1qG5ZjcUHFgyp iLDkubUScTTf6Cnm6Pbln1tyFU+n7CcqcFQzFo6zLr8zaBxjOOW2BgOfwc96isII wU8jqi1WoCxn/vg9EzwcQFqr6/cW6hX+Cgy/s+TcalnFTRTakVM0DxtrpTxOUnH5 InlHY4nrn8NiuqeecmJJSiHxVoqrRS5n0WWska4X0b1L2xLhkRB/CqxOovUuFRaG zhmp2vJ2oN2+Dfu5tPxHd0tnwr9wzjjh+rXHQBJlMpGbTaR0B6ukJXPcdEy5EQCW gKJFSCSdgoJ03Wy5OUwvb8yC6vDnYXmzmukQfcseMKTsVk9hMYt/l38lBBSVtN1v Eca7HhogbJCrr9ZHcFLLAnZXFPsz7aeGD+VDiWqSuguea6w08ax1S1tvBLtKiTQ+ OjwcDDfnbEGZMcyy2lrXgGoUsOyv3u7uDgvTDE2UYMCRaEBZ02aHcf21kOHNrwgF N66RPmNEughe9cpXL5zMRiUSjvh9P3ns6UdoGuqc+XLG71YlhfGJnMXh7qgnojkX HP5rbuIlSasEsaqfC+Je5/DdC67RXyTvnyX+jZm2tlW8ybZlKrt3/LI8VZhR5V5o XMa5IvTZlbAL6IdVZx/IPUpV7TPz3eefIHtSmKVj9CSfakGXJIjACXpvKFmpXPp4 LaT6HU5ak651KbjcCU6YmfLlapNZorrQjJR38FXa ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/75209EA47D1D4065

http://decryptor.cc/75209EA47D1D4065

Extracted

Path

C:\1r32tvi-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 1r32tvi. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). We have copied financial files and other important information about personal data, it will be published on the Internet or will be used against you if you do not pay us, so if you do not want such consequences as customer churn, media coverage, fines like GDRP and other damages, we recommend you to contact us and pay the ransom. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C9DA0EA57E115466 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/C9DA0EA57E115466 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: O4dh9yn3Fs6hQUGCisv9lvmgvnLn/wvaPJ9c1zBOZelI6TrlmzXje42KNd1asZHN zgHWnW3gU2iGMEp7dEfW04Z6RNpuSCvlW40aah7uPVhnm80H0nBCO/t2BVAYxj+G bZTvQNZWlrXtWeugjenYIA5qg3JItd6ajraFEBdchgGIk05/J7Gxl7lWow8m7fKI QzNVvcZQNRn93r8471KzI3xplsvL30tLPwPbMFnLzKHyBO95eUkQ93PgF1Upv+Vr wQgAldnqf0AzxvjBSMSt7S73ayxr8Mphx6tUHgU9LipdkJULBZut/kncmKi8FiD1 kKw65tn/BUSKULYJNVMjytiVuH+cd+WFqdiJvKBaJGmb599hEVwk/9Uqgvd1yqeH k21jo/zsievxu/AMDxpybKuCWXxb5e9PNTNLKgTShPw3cn9EAY7m6J3hEaQD2R4g pfTgfoSuAOGu9eprylNrx4l4ynVtCen0KPQBg1scIyeDjrpCozqZ/LBjlwJmD349 jqjjawnTc2PqjoI4NGTgyzS4QMMFLq1DCVTWGpwp/rN61s/sVHs5wIE3HQ+2yZ6n pgSuvZ7jdOPEUDpbw0pUFmt/8NLfHDSIrXWqzmL71qnRzQaPctWV2mYob0ZfATbx 67UCGQpSRLPSoZZCpJtNlbsI55S1WcganydBheFjmgdA2BmJ47syHuj63BgXzPej AWka3szsAmKIk+orPax4v7jQzrd2vMLgPjGhF7PmJmoYBJuH7kqjO6cKi+P9bDL4 dXmeaobPzArmf1J21MNA3MR6QEM8cV2VSSp484mQPIRukeEnXgeJ1FsKklxX6QzL RyP9/lv97AggbS67BwTGveM40pKZWdXekDf4PBuiGdOg8upDQ6bYOWeRSv4rNQVL KCF/s4zaXrBysb6dleorMVJR5AJEeiViU5VWvR7O/FRDA+koVG7j8TmrVGVjTbDQ L1PvQJgym4oVkBeZN5ewBIX43YPG3dQms1tSmJmlkTrQbGeVSJUdE3opVuAd/fuo 71KGg9YmycTmA1+GA0wXon8jsdQdUdWZRewY4MPl2QvTOechckNJjVhYL+1DKp1C W5UqRBYlo67JorlB3m68zwCd0I7lA7nYQG+guc2Nq+n5cwWxncgr8tkCxyQBV9q+ Fe98Qd79NTYti1wv0VvGjNYSDD2W8vPMpaIBYKT0jnnls/sxDINXB6I8FAsN5Dx8 nK7Q1HSRz5ukRhr86p9HFz7067sn1vuJqfdxHfrzNxn3Wnfu/hk1qIt/oRujYHdd m9RAlduaWJ1Kbbc8jpyg0L3q ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C9DA0EA57E115466

http://decryptor.cc/C9DA0EA57E115466

Targets

    • Target

      f273d69e572f51a031e40b8c83f3e58b.bat

    • Size

      222B

    • MD5

      8609a1469584fe2c96aa61c898fd08e2

    • SHA1

      184957747a301ae172a76046daf5480c525a55db

    • SHA256

      add2d6d1bb4a21cb6e1b3266aea269d4e66dbd7999ef070b81760cc64d547bac

    • SHA512

      2192354833c5c0c07ad79980769ef1090d7232717f9c73c13f16b4558593a9eb3028818dbc564433a41bfc3f092ea1a39cffccf0440a81dbc09ab8f5114162ec

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks