General

  • Target

    257963fd8d55fc6eb395408d6cd8eb10.bat

  • Size

    216B

  • Sample

    200818-em1wtx9h5s

  • MD5

    db422fe5e7b4c0a610a166c2521c5b0b

  • SHA1

    4df900c107ef17b5d139be2fb8792908a137c1e2

  • SHA256

    2b9bf7f85b20bc24437ed489cc2b0c2d4ccf0b13baa34e27568ae61d1f67a31f

  • SHA512

    c19beefe11cd9b28d379f33f04061f1a75f52b017cc835997470344c27bb0274a1f555d4f89180183a5168113cd984a682e5db5e1afb5d6fd0eab3e511388f5b

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/257963fd8d55fc6eb395408d6cd8eb10

Extracted

Path

C:\w0vf95w-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension w0vf95w. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3738B80C8CFAFDD2 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/3738B80C8CFAFDD2 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: NFR/dZUt5LLRaE2dot2o6dvfY07bK/v+3d/XC4HYLcC2LadEA0QU4EPHmeWX2YDQ Crk6sRMBvz28+0YObdHR+K2jauS/aNa/ZI07n5Y/uPdYdwwMXuiz33doAzcdoTYN d4CCQI7LPc2TyB57z2LOp5Di/b2Fc7e20O0lgegX+cP3xIvyQOZ2motLpN0Nh5K7 7XDELiC87PbjDZSWN+7UVbZUKjNGDEDHTIXDpfFmIoZ00XVNoqCw4NyEx5CjeX+a mmQSHp2L3c5N2bsib+RQtFy01ReSEuipjM+KsLKI2CAKTs6RMPGgix2OFP8JIMej lUWDwi4hDUYLEwXVLxhWdeeW0M9q4HEy6bmlyG14ZeaP5arWfg9iv5W5xEouAnJI BMrI0F/GrHt+KiDCxj6C3udc4bkxXdUoPqy0M8OKCTaOdQlCD9E8lunrAbka6OS+ 3e/ZPM+LZpKPRB5gI/aCQGo9noflejhefOYH9GO5fBXmDmKWXXpEb3i/kudAB2YQ NBDkwTViTJnTr380aFOzB0rlq23Nqcy6QruQsSquXdP6Irh2sZr9AbCscBAF1t0s FuMSzlbIh1u2WJawDgQFrjrHtlUpcaMuu7ggP2y/ii9U68JHlaIf3bv1A1ZXXG8y DJEZGLDx399wrvrzVuYmKDYnA4gNEmnxL08X2w8t7auWhjSLeEbh51HJ2xd4RNEh Va9lmd92QU1tLkjJU29/uAS/n4/anFXXwMAYpap0kKiRj2i1RfnHmK4paGGW+zwZ CMWnC80SaEIET5KK+/q1Oru5T94A47IOb19AV2t8S000PaTZ6pF0DMlEdeFHOfEx SAXI7Me8fUkD/yFmzNsuGO7AKG28RTzW2tSrh9z/5rG+ZZE7mNjlVEDcg+rbUqj2 9cGazben9Gfndk0JGEvo43grzUkmqbvC3UueOSur0QOyPPRa9Njp6koFAptQ0YZJ iFhbo+RPjwwhF7pOdDdPMN2DqsnhWv94vE/W1olXqf3Rp2jH4vwj9Fv6N5wwGjGu 5SDuQaEulmFhlXXu5isMjEomrzTNtEYM7xdS8qMd1IPpTBA2f3n0ec10NEi549TF H7htR92DYOc7ALHEIBok9oXkBiac5am+h1Wq7c7PY6+hS/zDxAIyWFuezD9fq6by yWDKvUn+mGGmIIYWXU/ApYP6legJBjOXmDaOOP7nN4AT/E6P0VpXBHEtC/mLBTrL vNWq0nYFZsR8Wp4f0kkGOwh4azzqUx9pxk3RzHGRWV5Olu0xBo0aJg/b5chnGOuB a9afcB21+gTNiqWlhHBKt2DGexER7l7cGUVEEZ3jilrvXg== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3738B80C8CFAFDD2

http://decryptor.cc/3738B80C8CFAFDD2

Extracted

Path

C:\16t307lqae-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 16t307lqae. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/FD18DF36649D5926 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/FD18DF36649D5926 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: DB6EE12rFbJpwSsVVEc+8xyuV9zzIjZyQOpa+FoJ/fU//jb1av67E5KYJSIKgjoS R1YisJh1xfJOkfoeel7o01OE9Q6IC0i7ouui8D1xIcbaKLEJqxKs65ugSY1q4TZS Ew7aFGaABw6lAe+BWl8wOMgEx1e86fm76e8WRPviDZ+8rwlvhqkgoS57TRgUGvZT nRTjxO0UiwBcx3F0hP2mN9uzyvsG3W+xnc+TSJN3rSuiz5reKJ3aOcr56zc1Feq9 csyKglQkRx76LJmtZkfoC/G1nn+ZcznGRQw1LACu8gozEFQT1wcXDs5DASJrdUr0 L2SG4GpO7nd3ZaZ0ALDdBsD0OFnvi3ZJxUHC/ZxVDsZcfMFsTMpLImmxRT44LNHj cHWESh2mqzmJlmC3dtWNhZQ8O1Ll9ylVBntCZ0wo50pLaDVRndQm+BEpqIWV8tBu 0JABIub+T8oYInnPAsTaVhTtAwC++DdmMsMztn8mZegF+U4GRXkYtrxKagvX0qan EtpA9OKDS+Fr7SVkIiRFsR3phBTLDROG3Wq6mAqGpM2X/ti8Zogdv8hrGgxcSKDD t4nZy+XXUG3FyWdb5F9r7d5fVMU/TLhPYmuDzhF+OrephLdae9mZMd3Gc0HAhWCQ uQom889i8Ii9MLm98c7UpGr/KR5kwA2zHBT+4O5/bcjNKS5AcgakWmjccvEwUv3g IadkxoL6/TpWnf8bMF+rp2fc3vbzEDaSW4TKIBX/tZHs26U4QIveHp63kkZj2i3l XZuKrpk2aQqYa1hRZi339/z6NTItDN8HIgJTWH2EGEWQWK5257ix2o516Lj2E12B ovxAMqOYnaI8bqzicuUR6LPbW9hFW+VNdS+fHIy4ycA1tlc81yCiR0ZQDcmAU27v WFvevrqrQoetG8a3LK07qjceEhGI2ZE5Ydi+upr2Z0H0xX1bFrK/L9E7RkE65NDG vGYw3YUuJWPeH9Wm8b6NuTqOriBDQxqXOjER86yo7YnhCUXM/w/SYg4mWCU9KXuy kpfRq3PrxM1UZIHrQNVGvHeGwHh6pYNw64XjE/85TORKTlWAdY8aI0bmkoNk7+hp Pzu8eekl/wZioEfr2Znqg5vf0Szg2JfXozPmc4S5cwYR3Uv3I1IVYd7+z2tkKeeI yGdy0UOXfQJGGLoCnDMGAQcePOLsBAJ6Zt11dTLdkPzKtXzL7udEdviAxxrIptyH q9CQQWaP/bTuWG8KvKhMzKs3JXl0BSIqgQhYp7QYJvVPZIC8xWxfI8SuxCvG7Ac0 KEcbNWwiFxTvo+SSyOgro0sHby+JVq1F ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/FD18DF36649D5926

http://decryptor.cc/FD18DF36649D5926

Targets

    • Target

      257963fd8d55fc6eb395408d6cd8eb10.bat

    • Size

      216B

    • MD5

      db422fe5e7b4c0a610a166c2521c5b0b

    • SHA1

      4df900c107ef17b5d139be2fb8792908a137c1e2

    • SHA256

      2b9bf7f85b20bc24437ed489cc2b0c2d4ccf0b13baa34e27568ae61d1f67a31f

    • SHA512

      c19beefe11cd9b28d379f33f04061f1a75f52b017cc835997470344c27bb0274a1f555d4f89180183a5168113cd984a682e5db5e1afb5d6fd0eab3e511388f5b

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks