General

  • Target

    671ad8514649a9e90db4be04050939fc.bat

  • Size

    222B

  • Sample

    200815-4w9d5s8h6j

  • MD5

    ae3b86ee141489a333cd5b79879ce5fb

  • SHA1

    59fcd2d5b1dc48ea3a135a908d2342f41801c748

  • SHA256

    9f5a1dc3b6de60187465045347cd822a1442279e6d75aa5b8e08bfe8811619c4

  • SHA512

    08e7101feb1b8fcc3e48a3b6586279038d039490a198bbfa3c71acfb6c020b917a5941517376d1f7518f8e28b810f871c0401ad2aa0dc5ff86c522a18973d6c7

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/671ad8514649a9e90db4be04050939fc

Extracted

Path

C:\t59qq1s-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension t59qq1s. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/FA804DD0DEFEFFDE 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/FA804DD0DEFEFFDE Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: zCMKZCfeb4mPiK0c34h6H+ZhDmzfen1TwUWgE4byUM3gu/UewrWGjEeLY6YErB37 PolT2llj6XcM/hX666aT0PSLau2gL2XfHA38r6+Umlh8rYY7QxxZBtU1I5bdpYyF Zq5/73cb5uRsNJxlb9N59CIPawnPKJlCPMFjGlNzgQg0Ia1rvyr8BwiaYCl6wb2S Ml3VM0PgZnINuwP4OprEqf0fVSJ2gLMV0Ls2P4t7zyXLocObZqKXxLpcnXZsBi92 2RAsbaxiT+NRq5ezkNKsKo5AOGy7nv+3PCnJIbC6FXHWqfXd3ImI7/TVGS+k+/bt BhLD8SRZJ2jgJkji8b9oum6LQpuxOnmvZNZzuELQ1GDXFRa9igGZ8MEStUNRqTOq 5K1ghigVlLeDXI8niDhdwtuP6Odnqw8uE8JRQldpGRrcObV7hK1ZEmUrm/91KQa2 QkCUJB//dMAatsD5yt5UHhuwWeZJI/2sIVdFJ+5yjGFMuXWy8NgiG0S1HwVXqhf/ nldJzMQqN1ShaK8JcbOUCr1OLLpCoOGJS8jtrKfPNY6x7pHc2/rVR1a0sXFvp5Gs KiYwMTOu1SOq9fwxr8P2zKNcg8z1W9ywLt0QdjD4ZHMpdyzIsvZ2A/Fk96v4WZvj kvqKBfwh/FfVUSg6Fw05Q3YknaA9imnVrHcpq560CIYZzLAVdxma1MKXe8HVSXO2 CT5yC2jqNZK1lE1VjUqohBvzGsITXSMSJlQ/twc6dr/BKyLq3KUsJTE/c4EMekxB JOBIiakN2KbHB+h2WLqPHVSgnyfbJMBkBqIgath9ZNY1DSs1+3TwlOSGQqhJAyuR blyeyMAS9SepR5+7WP1HpU95wQldWaDNgIu+bZEvnZwKX0IIRJxeXosbWzEMdkC5 6O7YcBvoXCBDxA1DBfVlJ7reBF0NL45mDCPLLGKh8TDxPx3wO6+WBSjg/8nRgsvN 5VqyHjDbd8Owe5QSKKamVYYNaIyihaZOQZFJT7P1xGIKKWTzufWPsAG8g/8q9bok WY3ZMGwUBbZVf4Hmk5t/t1hUZr1B4XBYu363CIigPm+IPsSJUw24hYqQlYE+kWbm Gt/Fajs9+nVL3wLCCynNZw0IAGNiQWCn9B0hFn1z+HGYmNxjQ+by06fEVmfNYbZ/ RxMmz4IfDTJtVcfKkC+wPx+UU2xmOcSlppo4nq1DhEZ/69RpYTuOyXkU6LaZdI5w ztZJ1vWeV/BCwZfyZHuZF5hWxv+jG8hPr8AqXiXX9mSli+MNwoDKrp2GPaeO/sMG twcsHHhCmAUEvOch7n4gcC1zazOgP5oHokM/XklFijwLig== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/FA804DD0DEFEFFDE

http://decryptor.cc/FA804DD0DEFEFFDE

Extracted

Path

C:\606xjwojaa-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 606xjwojaa. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/6AD7DD90AE53F818 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/6AD7DD90AE53F818 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: h4SqNk49uVRBWAsn94RVBGk48n/7fvny0amd6DjLgFpJISFY8F89pYemuuFX+JnK cYCzdpAZZLTRX+WZLM8meAiyBKS/WSeFyx9+wTlgZMIyDdmODy+ot0m8G2IMB7YH C4G7hBzbkSanBBZVw+qUkUwOtcwGpztMcjg9TGYAauz/4ButaPk8O7+DNvqSGoiN nKrPhI3BFmX3BI2v+EBrEKhClgFoMd+fwMQdv582FtFITBVTRjQNY163YXDhHcpv 0ZO5wSxlqwKXZ6sZt/AVrRr/XL+xO91Mlyvy42NruRtraLr8yaDbh+gUYT2JL/4x wETrMN/AN06ZBgujyDGkwichip8yWCMHsI6OHl36D6SScK9AoX5jmvmsQU9G4i8H GzXeaad2/yrVZY57D43LejxfCIN0YDqHiyRlYzXqIUW3x0f15/6IP65wElgLS3gP 5QVq0kqQ9JlHqKYvvfXJlU5BnFDR5NxrtXy7LlDJfjeIsTdXGCsILIylZBUVE3+j 1UR3iX/rVT/95XcgTxsIyo9VE5teJvFvNpN0Om6QBfpRmU2KmqQVS68W6wxR0Qe+ NnZKafXoV2x9jbtVKarzb3OVltILNyBaQdwTL71xTe8JoU1IgWB+P4BdeHgRD4i6 LVtFY/UWvDDmQNpZgvPcUOeZnuUFCqX2AIxaspd88IFNwAeSVeCrZHOm5FOYgnDi s21a1aD2vKHE8yWB8CJvxzjE9rILzU2hMRCuFOl+jTsjHT3T63s3PvS0JyAn9L2B nezR5amxjDGy6rDmi2MVNFg+mOWTF9k6W3K4f49m481z3Oo5n8dFj0uQDPqlqcZt FKjc8ZhaOHZxdRnciQsJAmzDG7iUxghxdCRDCpJsrePs/6duo2zbxI06Yxz3tfIA mjTGDr7G5NgmW95wqqroDx9lhOu8JtUpUXcYq1r4uyjqGo5+Eu79tnC9bJhlOOTE 7Cvyr51zZpvaK2fuFdQz5l0dL24+t2ICqTPbM0lGso5i1bUtmmPEBJF2bokck1gY Ni53uQcITOYWtDrMYxpRhRHhhEZFX1XWKTwfqKJP50fRtnsQC1KmvP8N/hKrsEr1 W9bCSB+YTFvCtuWCLpeaEKHgGRG6hvk5eP1WM7mDRNrTZP37fw8f41jRvjAvR5+L XvHenhpFAbtt0FSgjvnjMPe/YgtCefU4jSlgq13k1QPgymfG8Qp5acHIxbRDsBCk m+ALOuhV4JjAwdaoXg/aSLKoTrAu+3enZogMXyDDNZW9wUQ5wAjh0vG80S0P8Lf6 N432LDlsdVDp127nOCNcPnrVlwemjpdA ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/6AD7DD90AE53F818

http://decryptor.cc/6AD7DD90AE53F818

Targets

    • Target

      671ad8514649a9e90db4be04050939fc.bat

    • Size

      222B

    • MD5

      ae3b86ee141489a333cd5b79879ce5fb

    • SHA1

      59fcd2d5b1dc48ea3a135a908d2342f41801c748

    • SHA256

      9f5a1dc3b6de60187465045347cd822a1442279e6d75aa5b8e08bfe8811619c4

    • SHA512

      08e7101feb1b8fcc3e48a3b6586279038d039490a198bbfa3c71acfb6c020b917a5941517376d1f7518f8e28b810f871c0401ad2aa0dc5ff86c522a18973d6c7

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks