General

  • Target

    235620e528e879523640f19c8cb5ee8e.bat

  • Size

    219B

  • Sample

    200815-n179sk7r62

  • MD5

    3141305118100484c56608118b0125cd

  • SHA1

    6130755f363b7419592d3f30e74854847acbde07

  • SHA256

    14e3d246bf04730f371e94114788e30bb4a609324dd115e56411f6a5066b8ea1

  • SHA512

    f81b732613a643ff65706bc9d3c06fdbd2bdd804661e7899c43f11298145a20a1bfd58c48067e0e218eb789c667ae2c62c278094c89599cd74687a01f758295f

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/235620e528e879523640f19c8cb5ee8e

Extracted

Path

C:\6s33g-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 6s33g. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/574697AA7F64A4F2 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/574697AA7F64A4F2 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: S2r4UJ0ON8ltcdpMm0ua0SBu4A5bdwmQUEgoNmtOBkQoXf5lTyLBpjvwCsk8Ca4w x2CGw03ztCnWYR8c7/7KfBdnY8mq5mwSG7tgmFIBCFjVIdDxGQyWTXpvndnw8Wpv xyue3btKz0xmFlaJVa3lDqIEEMvBExu2X5h2D+cYxApc6QbMzesv9IN0/srTFcvF obEd0hvE/+VPKvdC4w99vbs/4Xrua2s2LDEIqI6ncG3lM4yemjgNzqNiBMfooyUk XYsSGnc3oDCo2wPNy+zLCs1/DizCv8WIUQHvx7ozuG+HaXiJgUY97THjKI0L5CQL uBaS3M4G5Ye2i+WM+0zEpKVOfTnaq+TRdUoK8BmDQiDD6NW1KTf/l6CKvNC7G5rO /L81xUyMjA+H7uJJv1cogoB7i/KJT5S4AnmQvCDXzZShak8tB3vyvhh7CeKcrzoc ap8a2BzPX+RAHGjLQsADAhvcRGw8oMnHIaDpuQsgd4zQt103eJm2pNOnLCCowfw6 Az4J5aTwjaYxVDm4tL8ZiqD2jrRDD/Q+HH9+1zx+fX243+6TPZdzOigAqmlsHvSX /6d7arHhr3Yh6g5H9HnZGn99ERf1bGCwlknNNEGATsTc9C4pq3DoapU6qN2Sy5+Q 5KUmwhTQzQJ4W9cS1UoFhQ2KmmvXl71plz3eKbnz9muGNsssRXu+1NtHpEBRbYDZ d3utUchiYqjT3lTyAv/CjLgkC7UcmkZEQijGHKrJ3HsfWnPRGtS2J8DZTJoPd2bW 0td4ll0tHNLjzWgDtkZpmIK1qLmjwsgmVS49i2QNuacHK515s7Z/dI+Pzl+S028I pmBcYhCZma1h7azG6mVyBF1Rit+m29/FfkV4+ig9xDrs4Ipn5IyiI5sNK6RYzbnT UNQir5kaSIWrtQOZv2LZT+bd4IEmWkYiT6H/0f7Fcc0PzWcEV6VfMOEzQ18yvjGq jYsQUbYGCAco/AaWE96Yyc2QWWYpM4SxC5GTV9DZxg8JqhQbMXOiNzUW9McBIvfJ vXRVbBAKFyuqlE3uw7GbDlYxRLUKDS/RcKZ2R1BJX55dqwRFgs1xEaaAFAOAWSto QTiTYH8J77uoR9VhM4gQHokWW2vWj1F8QwNJHseuG0Bna8NTGgLzJ6c8/insVmt4 to95ypGur8+F3pRn9u24iojw0r7tiioUVCS/nD+EcLtkkgM6TzFy5mvmEp+IJiqm sgnfcLioFUaX8oNs2QdCqBIUusQWOkYUkM/aRwgZETfmWBq3v0Ovhm4KIxqlsJZ7 +nfmvliAKLcHeAw/1m7gXCZ2xsz7XFEmBkFk2Djz ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/574697AA7F64A4F2

http://decryptor.cc/574697AA7F64A4F2

Extracted

Path

C:\huj40pji59-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension huj40pji59. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E4C4D3882405CF52 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/E4C4D3882405CF52 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: QmLy8rxHwIRWW4jk5wOaLE7DkNe3zrz9ruMvbOVeb7f78Gqub92BzVro5i6xOZNo uIjnC5dp7XHl2q/5YFJNlve/5RS1beVbHMheShgXN0RljsJgHVCQUIfGRahTAH/s RnQizJjqugAwEfMgugm8g7EeULxiaQJopnr55ICALvB/HZQy/EjMzj7kEU2mlYAf KECuEGcehF6u4MuZ7RfbZS31DsVf+A4r0qBt8QAooj3rEPGykVAfRL5+38QEf3JK cUtRf2GIZnslgbW+jo5g0HLpIWNd9rz3+uI8Vgll8zF4KX2juXxok63kCOvxhhIL dvnUcSK9iovbAkOyPBc6cbcxLRJlIDql9nTVN3QabULtEsDNtfO0MIayOvfhnyCr h3xLdUV2lOUClJAlhVVNnVgt719INLaR5g1Fo85/EvhMrATN0Ry8/0mmPw9nESXt pyLz3IMmIb5FMX0Cr/G12O/953OgfLTZ/XSkqESkF5nEdEo6YLPNr06/+LeEIv/u QadgOxT9gJ0Ibwtru4HxWX2UgZI2pm5rY717MYe1KkMrKk0SGwhGZBxTxnpH85Zn 6kKYXXQYHHZHxGkuds3wYsZpbU0OKmOsweMPFPQbRjj2SXA+qYeFHTuQsmQn7gDj zH4NwAJwhn09uoOLmJjpfxWIuFjaxMd7ptCMa45NXpTYkaqd+sWZE90cjEif797T I5QSVe3vVKVoumSYYJtEHo9OoSeajoppK7h214cwD5xRqgPggfOks8O9WBrWQpjH dQ1oKyTrHPMJReWH+7aEEYUW/K9VrDjxyj2RqYT77lyS9xCLAwle7LQqIkzKAJZx HkaldttzYgNXmsyiqCu5ZbX1TrQJpnpUrqfwBRsbd7AMdZTANzG1QFUquieks/MV XOnud1q0wVx5MhXCJhSovD/RQ7S8/ycUqfDIAcnvqPychJd85G7Oy2JO83Okc28+ KncmR3b6ESS/peEhssOnBlw4KJ/9poF3EZPzAtzMgd2C3Wru26gTOFnUMzDvSuQC 7PbrsSKglIEhAqZX923X+XQsPGbb+Cs7TYkLDj2+V29eIFdKqFjRFrKXGQ6gsiye MJftyXiBcUjtcZ58veHV6efI1zqUUVkzzvgsmUhtGWTGukE/MMNSU8pDH67kbd9/ 5z4B6C+zPPehrLcJUg2I10TnnbY7RhfFAFfJE0dEh1hHB+VkiPFs7cUKVLIRq1Vo 2Z77zz4fbaY+n6KJecajc0fd1/w4Tpdvf9yW98k/qYYqQEtIEjjcaNcSdOjv6Qko FqkpIh3B0bWhNzQKwuMSEx7qI33HNQMO ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E4C4D3882405CF52

http://decryptor.cc/E4C4D3882405CF52

Targets

    • Target

      235620e528e879523640f19c8cb5ee8e.bat

    • Size

      219B

    • MD5

      3141305118100484c56608118b0125cd

    • SHA1

      6130755f363b7419592d3f30e74854847acbde07

    • SHA256

      14e3d246bf04730f371e94114788e30bb4a609324dd115e56411f6a5066b8ea1

    • SHA512

      f81b732613a643ff65706bc9d3c06fdbd2bdd804661e7899c43f11298145a20a1bfd58c48067e0e218eb789c667ae2c62c278094c89599cd74687a01f758295f

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks