General

  • Target

    6bfe2bf5d32adbdaa5ef03bf7c3652cf.bat

  • Size

    215B

  • Sample

    200818-d9jpehclts

  • MD5

    4ff9830e5ccfee8915f14f83fe8f1918

  • SHA1

    0efe2413519a6ce400cc4042ee029c2b84b73b25

  • SHA256

    6e19ccbb3e491327f4ddebd05fd7ce6c87d9a94acd5851b856569ecb1a17a347

  • SHA512

    222eeadcd7acf048a6e5cd50d5df143c63f1200f9bc571333aff360ba7e88453152e071383d1f6d68fc889556beb01b931f08305d5daaa4ed1e697be60920108

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/6bfe2bf5d32adbdaa5ef03bf7c3652cf

Extracted

Path

C:\21bh2n-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 21bh2n. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/176BEE8C9B811708 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/176BEE8C9B811708 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: gaKUvCGmLsAUQwqdJcX9xcwlKrMvjlsS/raB2V2K3Xc00et6uREZh8ri41Jues0z cOF0kyJsmAhRVGB4mB6SffD5yBciIF6YGuXRuZjT6DfIMIc4z0iC4w8u+/3bkubp IUkXVMVM0qVZ5ceaSX3lB8HtBNxGX3l6CWb+cKnDhmxqzx7PowT2jgNz7rqr3lIB nNvQ4beyBH24FN8dZbmlkjASCqsAVyateSXb0nIUAL475AtJyRzYonsvtV+oa9Tw x7NH3DuikE9XgxQSvI4iUYj6D2Ep/+vzw0kPns+RUVOO1MY8FI8N2ZyY+FnGa3Mj T1P7crv7Y1CeEYT9qIbdgwFyaEoVyvGZPR13kgNkPVyOVs98G8py494rYJyUqdvS 6KCwQ/lBrnzbPlekt6v+4wk6/aWu+pA+XhB2DDY3oLxCdN4TlP8JfuwD7JJJBSH2 79GJgzyuKWRorRoeE7Rl2cCjOCaPW1T6WB5+MlFPPTO2wGwa6wXdQ6hWCeAyKsrg mlq7jwh5aoGLVVKQlCiNJwLR5NX4ShP7qKPs7QkTqebZlDe7rouivDG+LDzfvTDF rlD+4zjRF+WovqUO7cI8cYhK5CPxP9tNKwmBUB8jhT6HJ+gef98MAevxbZGm3O2h bKflEVHUCeS2YhrcqNdiau9dlB54084ZzR6LNrYhlqt5lGFmBm0ehuRRrNd/17jc 8Ydswr5Rxfxjf8jGFoyZyq5np5dfOI243g0oN4PUmmhcJ+Fk82MId83kGz432/Z3 94rAMGRBqVm4/aS1/Jc8d8ftqlSryet8f/yr++SjqeJSUI2XzEMWYbES9rUdr2BW WGHYhIbTpG0U+Ab89rP+2E8yQMuiTaIrBou/du4yyf53pO8+0rnYXAstLh8qb7Im gX1FuCAN2NGRSAoMtLqc14dct12wcceA31ZbU0VH1wjC3nd2/bH3kUOKXPKPTsaa TrC5EtdclwIGNrJmgq3EafxGMaD98+hfYsrAbK8oharquscdkyMnWK7xPx85oOJ3 FDTKzLZTIMfSZTCMkb3iCGT139zDyWesKPKaZhsFIOvKcSRTFJYwmh7GmGyCIhFt 9bws57RTyWv5sHYMTlSq4JdE27EbgeJRolRSnkCjY65re+AoybdNsHic65rMEuqk i/Zo8DXZYoB0GDQ4e2W/ETf5TtlmXzm3rPcuo4recduRCeuMTxgwdeK4GHidFwu/ Ry7F31TfO4Qx449hSIt2VAXadF67P3HEGwhGalkCuknSfDkTKvmDpdfOmbMJ7fAi fFVtehw35t6EjVILIlnJgsjkj9YNuhZ1HXmS+dhBNFo= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/176BEE8C9B811708

http://decryptor.cc/176BEE8C9B811708

Extracted

Path

C:\zs2qv453-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension zs2qv453. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B5E4685867457647 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/B5E4685867457647 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: G1SkMstPT5vGWQVLNAM/sBwVyKN17rED5Utl/ufqK2J/VAmKfBrvaO7tZBEGgbIA N0/dIK0zxyDoGetsuD85PJS+QqBXLUhhvWXq5+pG/lgFmmzrkV48LTvoGcKi8PRQ 4jKJABIv4vFdiawwDab4/3Gik+8a8/T9T3Bf+buEtGTZKoBf8rfoWp693XyT99zD 4rWunaBpdy0eacrmH3ktoXM3AB7IFrBvM8q3TOZzYVNwnNvFBi/5axDKgJ32JqOD 21GpHgRnTBNJMi0HbOf4SNB5tCfYqvfEjMIznjHofWM7Q8/mLJNi+jRBgmYhMKE3 zJ2N+XWhMm1L964QFM9p2f63mve6P9fWI8MojsgwH9ef1ubY+g++1jW9uJRtqNxI 2eiyC9UuBFcMLQpN8ljDck1rikw3bJg9yYyNCBGQ5l+q0FQ47mq1tvnwr8Z1fTll 3G/16TqwxAjP2tpgyG648HU5BD5ni37/PiUSm3QtnOEJAbLNZGtwC4a6Z6UFygQX TiJx7beGAUnWfmoBU92NY/x8dOcSnd1IgZqlJ6oAWdv2tZdvk3yhENy7yyo7vWD2 gzsQeAqyqY49UQey6dWgMZSc3EQMQTk856V3Q7gIDfQBXDU2UlcnB1BI/OIkDiIN CxmzDu9rGB/pWdelHbW/d8zzTlqxmmhINzb/IIEgJ2dmhhKCxiwKgLn0FvYjaTdr UaRIj7nShy5V/+hN6r8PWcD8uLVyDm+8rImVWaDVqFcYQFZrkgbAQrogficqX0y7 imMwRghH8XjcSDjx0gp2STZkJ0JgJnADgLSA0lyb8MM4OKCWunC9FKOOf0bg1mYP mzUEQj7Yam6RUndxffUGygdSwPsA240FCPDoi2MUMFw5MKj/mkfOfjWjf5TfHaiS OBEu6Pok8tmyG9O073ZgQXAjA0M1gzcRyOcXxOuk5POihx/tNwkFFWlnQjwncSQ0 KgEgilxn7/mzWUBgvQcPiKp0/TLL4gIyzxQhAHrU0mLEyp05XuLkTnTsXTCVkyLT JjR3NWnc926b45Q2uGvRcSMSnPw0J8dcnqLYS2ELUbRzk+jfaOpVgV3C5Fb4KrlY tDx4sWGbHZNMUur084bsTQ580hs+Z0v62gSl5fJ2buajN6RDRDX7E4htgZxeyy3i mXZoSWdIIMynSYNlqIJ3CNVTcL6JtxBlZp3Yf2WlZMkzTthIft/bdn5sihoqFoZi wNslUqXFHJnikMuCM5aiOM4rCp7UytdbVaGPzuJ2/duZTa0cQdILMm+m91/tczFm Hw/td+xqC2jrq0uWL51pMhj1kL4= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B5E4685867457647

http://decryptor.cc/B5E4685867457647

Targets

    • Target

      6bfe2bf5d32adbdaa5ef03bf7c3652cf.bat

    • Size

      215B

    • MD5

      4ff9830e5ccfee8915f14f83fe8f1918

    • SHA1

      0efe2413519a6ce400cc4042ee029c2b84b73b25

    • SHA256

      6e19ccbb3e491327f4ddebd05fd7ce6c87d9a94acd5851b856569ecb1a17a347

    • SHA512

      222eeadcd7acf048a6e5cd50d5df143c63f1200f9bc571333aff360ba7e88453152e071383d1f6d68fc889556beb01b931f08305d5daaa4ed1e697be60920108

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks