General

  • Target

    9842da71e658da87f135c517a3f7aba2.bat

  • Size

    219B

  • Sample

    200815-hj2glw6lrs

  • MD5

    5acf7c3e584d3bebc79930940e9cbb00

  • SHA1

    37f0819fd07164c0b419c2947e43fd06a07fc83a

  • SHA256

    62059583f678cc07ba6d42a856ff79d0747e13f0d1b2b6e2c75ec316bf47d686

  • SHA512

    c6cdf567391326815253277475a921f2f454c434324592a63c91a9e08818806e223dcbc41e345debf124611a9df1474829bdbd11057e6120038292774ee5b5b8

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/9842da71e658da87f135c517a3f7aba2

Extracted

Path

C:\h29785m8-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension h29785m8. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/322534A63754DCD9 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/322534A63754DCD9 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: ewYFmSIji5XkILjp9PH1xyiyqhSv7zMP5hgDAT0ov+wnC/D9WAUbHrPNAHcnYIDH 7LpDNC6iaqoK5Bdd7tlj8L6T0H6vIIM1UPSsKasANcPFyglAPVdHjjKG4xYH7TvR eiP6mqW1w/rVu+aDS9QiUxF5FTz+NholDuBtaocDV6eVqYNJGG6v0fZA1sd2i+OO 7CetBYxX4gbMn2wsVAgGjwoE8ak8Ls28Rby9ZrrbIn892R3oyPZ06V9GnM6ABLnE w2DAZ7eL4PHTp9rRVRpvbUo9MW+GjvNnPBPepAJkGXav46quywrza+vW7CQ3Ygid lysDx/E1yaMiGn66yW5VNzJNaN+ITbM31feDRPzY9ATO6pRDbmIXHDb85zgJoNhJ 9h25MXTbN6+HMA8qCE+UkdDmmeuG7N5Re8Qj3EWXgZXI6xYTPjhT55FcIkifu23m I9vV6GmcuNcDdKI3mVzk3K85wMd7sWuAGkB+GmLb2LKz6t7b7EB5V/t4cHPLsaRL LbKXj9PEZpOuZoGw2CmRXSEKgwIiE2izZfXIqxmxc+jM76G26YBldh1GMs5DncQX orbiWLGrTngPqwrKLaDiPrC/SNZ/7l9SEszwEa0FwklMwB6hiTRqb9tKCGbJ8W2z A2QRAW9nR/W/+U/ZhSoGBdodjUt3pDGx9bjToezwafxbLy75U15RQmMETFqxTL+Z x8Kg+bZ7vW5Tq8+wejvqTvwrPyNw/LPu7Js4nunu29N5YF18MemC0uvhpAPueqR+ jZg5XVY9LG+U+sWBun2OqPpGkZ+2tXvEr5atOB8tFux8JxZwgY49Qtng6mZnbYD4 2NeUhgM+bQF9KE32xmyt+Votgt0TB2SnVwzV5cSgPk9MS+WymCMjHHkQjwJR82dz Z4S2/R7xSc0yc4W1iXR8EyLsnArncR1XLpuPKWQuLj0TbTXsSk6ydZ65eGCSL9by 61veRFHsqqS9dpVzHZZCQslPEdt/PhfRkZzolTD5YM9yQotlVwafnruDaSMYKoZn mfaKENTWzvG+N2eqLDBL3dXDTroyy6IiWiH4YqEV18sarW7zsvvQ3roI0sXy8EG9 ZXTNj2MTNrPjm0TKHWawXxSZkp67E6UC/VGhYg6SaUaI7ZHmmKaf7qA2p1C0pWLa qeRNr6wGqe64XFfqoSI/t04j8j9t1kyQKDPT65IOM3X9em1ph74wI8GWRVT2P0Yb CySAGVK76yB4Pd0245oDM0pQSBrlRAP4TQXGo4FBx1AXMDio6AINUyHLjcsYBMN0 IuDc1H38yQqh27yohD2MOOHXWRDos2lygtiUuUo+k6S7h9Ba ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/322534A63754DCD9

http://decryptor.cc/322534A63754DCD9

Extracted

Path

C:\3b23c7o7-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 3b23c7o7. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/34FE0D736BE2A4D7 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/34FE0D736BE2A4D7 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 8/zDM04akqKnAS+bNF4ByCts/TC0bR56JDhjWYdBH899tRJRvB1pLtpNO9FvNiPd Qwd6nH3pB6sQ9NKGUzG9iiXy5uR3RqsMA+9g4HlrjZ7cIfbzpKfeBguHIfRxEmzP li8b/P8Ie8XYZi+UCn33s3/j65Zq10zmC4mEgch2VCrxJEh8VHpML1MBqFSdV5jt 90GddYrztVTieh3VeiNB65+YIf/EVRxxfs1tY/sC+b8xpYac2/vPOnbMOMWeivlh 2hcHxmQ572k6JSArf0xK51Zfp562asRhGFNzE+ArVquqiKNqv/B3veRelnnKHk1q V8PfWONClXbUZQmOSJcn/6vb6yqSPYRKgQU2/LPRDmWSdN2ZpUp/ar5KdqDfQp5H Z1B6UF/Pp1HZx7HyB7CeZhdd5EOsgq3Yt7T9l4ojp7iqVMUId06jij9q0goovzDs wCrc11jGY+czFKRiuK/KHlr9C/QnGLRXKNBTqta7FD/SkiSnVQe2ZU7gsVXzv5R5 B/cPCCs8QfUT8apPCviS5otC6bfu1mr3yid+EGvFYvh4TeIRf56kQHbaIoK4S0u4 zUheHxz1Bwp2glp3gjoxjkDprsQ6aXZtV74hnvXb4gMWcxNs90Aii5PnADLIzjrh O6Qar2c4+TYZQjSu2xX3JhTwzW1Bp9eG2jblS+pbv47eK0nzyWHzpG1GEYdYxcrT pRChdV1qxgV2BkyXtQuUq10K9S+ZS70CrLeY5kvURgD8/caE078ttCiOXPWlw2cP R49krrZ5qV+cytkMHTBETB/Lv+a21SBb8f9Dvq+YWRZdM+S28nlrl8GiLG1w2XCQ MkyoCc2Scz/f1Kv0lx4QDYZIW6wZghtxJkvx7nESI7NJEaDVLsE/xaz6mgjyFaSR PKJ6MSzdTkG756PtQO7PPjvNoIclr8qqboIGnAdA0M9E3jayWckg8XX4mTGc7vQT bbVF3n3BSgnU7ncnfmPmRe9qCSVuWzE4vKqgdRr2uVaHwveqBm/PbKT/9STfir6j 9BbbdbYYxCujW/DaeM8OmgMJ37OtkVwwyaLPjnVq9iZYTpOqKb6OWvhASY9MD5vG A9yeETEn+IDjztyqeEyVnCjtUvzg139tGbsiNel00jzE++4/Km9rjpiZdN5fju+r Z+e84PcQT+dZQuxwFI4RdrdDlM+fXgtB1qqEO6cy1Qep1eGITrjrrPRH0xPHdkDw kAKSYdza2k00n152rIPYnejigU9CnFlwApoosBwlrkbGrQTVbgz4T40EvluicIpK soFFSIvc9HLznJe8WgdxUAELGK8= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/34FE0D736BE2A4D7

http://decryptor.cc/34FE0D736BE2A4D7

Targets

    • Target

      9842da71e658da87f135c517a3f7aba2.bat

    • Size

      219B

    • MD5

      5acf7c3e584d3bebc79930940e9cbb00

    • SHA1

      37f0819fd07164c0b419c2947e43fd06a07fc83a

    • SHA256

      62059583f678cc07ba6d42a856ff79d0747e13f0d1b2b6e2c75ec316bf47d686

    • SHA512

      c6cdf567391326815253277475a921f2f454c434324592a63c91a9e08818806e223dcbc41e345debf124611a9df1474829bdbd11057e6120038292774ee5b5b8

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks