General

  • Target

    398e244bda5a94afa8c2c988f37b2cd6.bat

  • Size

    215B

  • Sample

    200819-7t6hpgnmsn

  • MD5

    3e3fadb01dd3a604d3d369bc51bb3a6f

  • SHA1

    6afb2f7dbd13b3f1aa3b86fda6dd1e44b513f195

  • SHA256

    dfb5ad14ea6a191cabe5996c4433e3a6b707fb4e5f571a7e6bbc53d6593ee1a7

  • SHA512

    100b892215e1896a9b372d21fa4769da6cc7698703cc779f2674dc585d3b03633e7f30aae9fdb4011816db41a775b33fe0853d766c308f3af863c1aa82a1c464

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/398e244bda5a94afa8c2c988f37b2cd6

Extracted

Path

C:\x04r1y-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension x04r1y. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8519576D4C181A85 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/8519576D4C181A85 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: jwtfO9GAt53J5rNvUdI2lc0BUErn0sP+Ylp5hvRcdzBYaFZKdB5bMzr4pdqurZOv 3Uab+Pv8lWlXnszRI2ftgfFeuiYh1vjPM+j5rU9TC5DvoefkA32OiiD5nMeQPaEf MSYVidIpsB8y/C2zHvCdFeP59dVYCPHSyGpD7zJVr96EqLRr7bz2MNO2M1Gm+fsH pO7HJX595gcvzQ7xdeySaF0Em848BSIyGTRDUZEcxvf1blpyewah1TAg6qXL+uN9 ZR3A4Gbt1dkHgIno1TRrQx1oqOnHCJOnA3eVyxi9qj0lohB2sy4LMngvEl7WaIhK gity4pfGjmAx8SKZr3CxaU4AoA9CBiSl2CgP7bFXhMVLTNRbDZhVD5EoyFXY9/1L KGKnHMe6ckf/881kQa97M1mlU+6h19T4uI7prFWkdQ4JCRZkwXgqJKB9dp3bv0uA lsUVk3T9ONatKQ7Tk5vq9revXh3mYNVDl5Lvxf7oz3SO5ZukcvO6IN7aAiJq1Gtz dTXm9ZXOQxNap9ZrUW39iHu2O/F9VFaYrzG5CMsHh/UNFXbRsLXSvx+OzcI8nhRK gkIgGbFDrgIABEm4nIx1TwrGDy50E+/IV8dwLm0N0V1drwqMNlaUYiUrx1qGg9Ug SD5vujhnIYRsxz/DYehRNR63E/Nb+GgIvuFs1RC2Cdxv6dxmUwb9uAa4/aqO9B3h ellzDsPZBLAeijbp/sN6F/u3mCUxIyoE+keYt0tcTOWHmHHjDKLtfJzeKVXqz45G iSzR7hVSsYVgN6cQfxaGy0HulzM5olfbKDDo8XOlA7305s+umuHUdPskUuiUGEU6 Fdp9sEGmk0hEI9MS4rsf0YtzuyhRxBPJKcICYki8/ElDpSVuBVjeThBsTWyvWEQJ rahfZgtwnBF8bI05cP8O8ehYa9X2F5H/vVrBnKqtFxvHXkrNY3oBAM+Ue0v+DBns NI3Xn0CUbm8vsgFNB0Y7MB5MtpI29b8+Be+6T6t+7txjDHzKNOIs5bxi+KbrLiZ8 MqMkejAY1NSimsETjMFe87efPlRTzYlLkebzoItPWgnoUoIfQv/tHvv9OKQEcZ3X VZ2Jdn8OAtDEIKWCjc3gxSNNIQsGwhzzUstMoTMMjS9zVZ3DRPwWm8T2QTL2YXxb NAsVXHEASkqwNXiWpbPjSrg8KDAm8M2Fc6KXMU3Eo5Kk9tRvklCZ0ommejyooth4 Y4CoNPrXQ2Ga+gLRs4cHLnl/Rk2s7bwW5f4VfzhDBWqnnoH4JJZBX2T4F7j+FaO5 npwRhrpJLPI0NCBiEQm+TFDXrsc+30i0su/Js6OtDiY= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8519576D4C181A85

http://decryptor.cc/8519576D4C181A85

Extracted

Path

C:\5suarkx96-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 5suarkx96. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C3AB008315086144 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/C3AB008315086144 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: KFubf2yiJr+IsX6jdvQ93zSe6uVPO6JeksxJFzhZFN/Y2otfZABMDkpUusBsg8Mt o8KGNWNwQg1+OwpHFV5SeOKMtpzjbZwbpq4jnyc+M8v911yonQAQtFdjSZSvGKD8 nujZh7jlE56OWt/O3GIenN/I68ZPSb2cxgngJIuuPY3eoPkuTRSJnvi1pa1qIEYK qgujRen8F/jQRPIJdMVgeBHN7kpSKvoRSkQxw9P41xJtZ+i2HA4GB/i9CC7j8KfQ Lj18+ti5IGyoQ73XYmtX1WX5hs2p1a7nFiQRSV/4i60qoUnsyLOWcnSufCzQx8qy pihUc10nI3h8iKfy1KQ4yl1KjY7U+rJ61/zRWKlU/Lgh5WASjYD3XnjXIVK2BW81 FhwtZA/4G9z0KmSt3rfbwToPiO+d/e/F1+VpAIczoClN/lHiYpmOHAfZAct0bSXV jEXxN1yxlEizv1E3sTaxsPQXj1cdMgFvQOSWjYL3SQvqKZmyQvgJYw4mnQCl2usq 66Mb/Ufy8t/uMaoePA2ebgQ0MjXvNFFgkCnWMHUO848Bon0/92SPS2Bq084yjQCQ u+KCKWwRtT9uhxQsyxELbtn1SRyTd4wf63LfXBKbRRm9iy6bKxzRX+KzNDcaJq5f Dv6zvhky0hTZd/1fIeZOBEkbeqFpWJUM/ub5svI5FHOq+rAF6j3c//weijSVENmJ 9a3/zoFwsTVbX+RYC6PxqfEm+QmW30z2HOt9LQDZgXJJBJtQc01zKxXrJwLR3RUg Tdwx+BUuHvTAzluYmPGgOPO8mauRzchaySZYTOvdLphMi4ErVDQK9t4zZYBP+vQr lLEEV/HosBnO86YM9TIpjXocW942EScSqxXdzJzgfURJY7FWJEQH4jdiNLGys4Dw BWzg9ziyJO8UGGCdbxrFapqROwz6TFSMGHlD3p2cAP23ewdr1ZX58NGxXpFXIwzy EbCsZ7Au/KaermcfPRDkFuYvL7Uc4gsLo9g6x4SzZtr2Dx8n0zRLTT6rxgjQXjF4 2kBY0eiK/7BWfl6CSZAbzSyq6VeKnogX7HyLfjYKZFeOUgQZg3YO/F/+2BEvIk2Z F4z0ic6WzezXsMK4McCqUurYQEPE9wjmI1tuE7wKBHvza0H+toh59q/D0GwLZGYj 87CL4VM/RGSTM2xbg4yi52vpWZ2cVuE6KzKsiKeS/xclYpqaMS1V/gZWuPNZYZbt XBWq/FvnMoH/qmjx4vv0RZScSuTT4Hx54O7sP/W4zXoga0CXH6Gv/1qwt9yZ82QM OA3x4RIr8PEZ077Q3PoyDzSHrudRkA== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C3AB008315086144

http://decryptor.cc/C3AB008315086144

Targets

    • Target

      398e244bda5a94afa8c2c988f37b2cd6.bat

    • Size

      215B

    • MD5

      3e3fadb01dd3a604d3d369bc51bb3a6f

    • SHA1

      6afb2f7dbd13b3f1aa3b86fda6dd1e44b513f195

    • SHA256

      dfb5ad14ea6a191cabe5996c4433e3a6b707fb4e5f571a7e6bbc53d6593ee1a7

    • SHA512

      100b892215e1896a9b372d21fa4769da6cc7698703cc779f2674dc585d3b03633e7f30aae9fdb4011816db41a775b33fe0853d766c308f3af863c1aa82a1c464

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks