General

  • Target

    7cd0bfdb268bef7da1671e95b6f5aa33.bat

  • Size

    216B

  • Sample

    200815-va8x64syjs

  • MD5

    a5ff6055fd55ba2b81de2d9b7100ec8a

  • SHA1

    b8df51a999fc532ba49b2f5769ed7b850ca94f75

  • SHA256

    60f07d4e5bfcf8fc08bf003d47aa6915f9c2dd834aa0b75985106206216a460c

  • SHA512

    9596d6d408462e5eea678ffa474b6fca135fe71ad024ce6e080ef350ec370c7820585e805e58f44e11cd1fb362badc39878794e505343892c6eb4cbbccbca20d

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/7cd0bfdb268bef7da1671e95b6f5aa33

Extracted

Path

C:\lzv1c-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension lzv1c. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/525AF2391A87112C 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/525AF2391A87112C Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: lQ+Uy3x3uWe/is8NwcMCXJLXLlHnBMJiztnOmCj8eOL/4Ey/TCAWvGPNitqhH6iL sxxSxNyu5Z6QXzmQF4mvvgGoiqPyAKGl2l5mwcb3bC2mXuw4pnqW4ur4hh1aUSXq YjIp1b1KXxCYj2JWV5mEv86DGvHDtQVHswrGI7qH8TUGsfMmrJu2kQXcyKYHqMse NRzViuSDcJRPT8YvLPjYfgCFD1mKLO6rGG2Yvk3sTLw1fR9iuMyCLY2z7MGopdpZ RncDcLgJgYhtyfx/UL3CRglqrg3paNqbFZdskQKcBFBXL10GtHvIoJIjPv7w0qwa bThyzX1deA+/477X3JyIqBwAo2mwFXM15kk2W5B7ZcUt9hD6y+bGmMvOJc5tY9xQ Z862kq21WbuysIUQk3o3I0BmNc6mP479QTxuPfVG9UV/BGIbqDNfc8TdCnycuBTG hmPCw7UFmWtCZt2oZjLnLEz714mMxplHZNAoJeY68C1FUzwDZLV9HRL+5HklF8vu SJT8p3OXTBEnOPoNFPEId9hZIe3gPyfgK2dii5v6u1aPKX7KSF8xPlXITSBDb6Wu flHTGOtjFFgGaviFzVHY32RG3DR+JWlo1iWCqN9t3KQHQArTSV/F/wOYEnqZa6xO ifG9br1A4q9E0JwDuJbdNYJmLP43YPpRVa73RgjD/QjqGq0703f1vfyYKKR9kBXo dc9d0B7E3LpMJGLERjqhiO2Dcc+9/pt69UxJHbj50Y69DBaZ0Fy2JNP995Y0kM04 UtRQKOBrqYOmk0FW4N4NzLrMIbHSz1ZX88TslVWYeaOaP6A3JLkGZ4FnfMmLewbx gzvQoSgp0gWxVIvhA53KwfLjqYL12QJSl3LE0Sbt/wvkPTgF7lPMpVYFsVTB1V4G F2n83ps0Ij8SWRzP+/Z3PLLjHUFlTze5wQuMLiSQ8Q6o6xN/oZgp+pB73iSHG193 si30cXXmSf2sRy6TSVbXXhdt48X3BDLUt2PTUrvbjRTgky0hOuqNxVJxjqwmksqG vQ92tu7sQvPh0JIfZeSp+XOMfRSMKM4vxH28dKk/YgOEhJdqMvDXH0Rzhi6OU62a 7MsMGO6mRZvA489n1mxGQQusaS0P0naGD6TCvtuTgc00Y8kirnz+powHlNFLPrB6 HQlcrHps5r1dKjidQ55nGjFYxlfufHAINUA1AWhW74mG1QG5iIqy49GbHNkmj8Tg nzhc4A7e8QVsfB18CsatjiqJ1yTJNqhCPALjtxAxRMeLlUlhVr0IyACg8nE+p0+3 Zt21py4V4APHeg+aZTmHpDPhtworVbOAvgYGqerM ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/525AF2391A87112C

http://decryptor.cc/525AF2391A87112C

Extracted

Path

C:\860d66w-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 860d66w. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3FB5F5D0526F17E3 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/3FB5F5D0526F17E3 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: HwGblpMtMGZjV5TVt/lt/+KxJ1GQTEBd7zI/TmttiMQbzwOtNlrt4Q6vfsmxXcMO r3vpYgqxgLHw8pKufuAP92ZxEVhpTWxlCVsGX/Xl7PG4EWaYKw/esEKN//Wnb2ZL JZW/JcMkSUDBMi5LqkovhjFf5Fjt88ePnlEKtX0SVEX9ahwyxn0SpjIAZVTlI1fO llC7rtbP7AL/swUGVnaU1cTTc+guorcgcIhIywlbRVTrZr+JujeJA/vxsNDHHd0W ajWHHjtF4KX7Fq1SEadCE3bwbAvuUi72l6fJMXVVf/4v/WoFSeZZtRcFE5vQHUdM P36TwXLQaXItBls/U+i6krXjtlN0Kuyw719MZm2r0VvhEmfB7cxMSdTN0kvmMFpX 75XWvJ0OlHWRQTLlCiGW+rICyO80F+jO0lALBWhGM+nC9oCdXmqYIlfgjMdcpVd+ /fJ+dCSXhUiEaSNyMzJKaPdJSpzTRRpyNKInQbbPfnbAa9gBsByCFUAGoOsODM8/ GNSJotBri8oIydNRyioV8VaswXGJnCQ6VaMpHin6OYWdqARKo86dgVUV4dSBXopz EWGKbTv3hKWoT9N7+0zFJlGdkhQNBBUMm7rt+3LJ8QUwj+3osH1e8xAtg+2vCXLw gYY1sFCGxaBVRdqnSaw1hQysxCNZF63UYl7/J7RPkgn/oNBFNHYN7mAdZly+9xag 2gq3szPCGczJeqNV3h5q+CQ77qAyvImWtCvSDiCX534HD6QDSj+bTzyNZ1sO6Koy +W3mzi75m4nfuGOaDYvGNqD/tRk6BumZSJpb1GN9OLR0Nwv4kfd+zK55I989J9V6 Q+2b8pXTOOZ9WgUl+bksKqKGUJ4Tkaaqp+8c3QI6N1f3ussvL/uTv8+SgZHSOG0k cbH5iKYfYXq91P1mutMDJAzgHbQZSBDouKnydVfnrz4USnAd17EbTmwjiPcVUhvp 02ooofZycjzNxGc8WXCdIqeghjl6tfgi5nA3/dx1d+GzM2lCVUOXHYgXMJBvjrPs vnibxIBqKsVS40+LkJLm1j0YG7sbOScng2DR3UAcGGnrP5nNma6DaMClYRkIJCeH fFS4V7WF8Ww0KATctruBk6ezAneBs/Qb1+TmqVkYIVkWiRwE57DgbAXElWh7Il1u CgugKW9P+PbEoFCPg+rjMBVVDCpKlM3OJ01CfEKySvaqWUOfGk1575jKN/3Ql/g9 fd9NcAdeLK9qtFxDCtVrdJ3tvH1KA+NOaHbVrvD5Y5z96IbL/EHobDWgEvXWSsaO NZcqB2+AGC+GBbjZIhhRaBvM ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3FB5F5D0526F17E3

http://decryptor.cc/3FB5F5D0526F17E3

Targets

    • Target

      7cd0bfdb268bef7da1671e95b6f5aa33.bat

    • Size

      216B

    • MD5

      a5ff6055fd55ba2b81de2d9b7100ec8a

    • SHA1

      b8df51a999fc532ba49b2f5769ed7b850ca94f75

    • SHA256

      60f07d4e5bfcf8fc08bf003d47aa6915f9c2dd834aa0b75985106206216a460c

    • SHA512

      9596d6d408462e5eea678ffa474b6fca135fe71ad024ce6e080ef350ec370c7820585e805e58f44e11cd1fb362badc39878794e505343892c6eb4cbbccbca20d

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks