General

  • Target

    058f5b8d291ac79c2bb7a3f231e3b5d8.bat

  • Size

    217B

  • Sample

    200819-h1y7lxlkjx

  • MD5

    ac5dca786af1760da0a1d3554009dc33

  • SHA1

    983a1634a67dbebf5f835d167ba968f2daf3efb9

  • SHA256

    fc1242a015ede6e41e186c71d0d5d545e49007e5a804d178aa7114fad7ecd189

  • SHA512

    5eae6e71fa72edefd9a1373baa4add4e9dd9fc6ad2e7410f83fb56b1ec10633b5bf2d296016857c9667564ee1043a9207f7dc8ff0dab8b363598902eb1f8c611

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/058f5b8d291ac79c2bb7a3f231e3b5d8

Extracted

Path

C:\nhq84-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension nhq84. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A69ACD13773F7655 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/A69ACD13773F7655 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: eVTk6v9D6SfqvzYRNhc4Y5XFBmkRGv58BJ2TjNWADrgnKDRA7bD6FurBhC7fRWuQ GhklWGQTzv20g4E248vM9XM8i3b4fyIOQhHfIw897m48dEi/V9Z46PoZ6LSMV3yv /J8wCTGn07WbepMMYJrpbtIjFBu6USLjvFf76bUPN4XNXCntgN3AlncEIx2gfnBV 9AQW57Uj0/Jg9//nihGr+eNNRJ1w3JNBgMRNSxCOGrwK0IAIuv1kjUgavQTIO9kt A5Vdani+/3JwqT6JvcrhphZtX1uNVvvaUup4d/BLsqocxanAtaom2NoqcOfLKquo e7dxCL4cN5dpFtcLlUBSZvoxMGVGqwFCY3gIIKUXHrpz4PEYhNeDBw/cQlJYYNoT gZQNQZ7CAFKgYACg721H2FvGNiAxGhBGOcV+iHfPnZxGGqK/GEqVycjNSoRrKec3 qpqUKCVF3MgaNqQU0YRBOrYct2FqBEdKTUpsBMYSRfNXHfwlCBdSbQL9DD8k3w3c 2N6/Lb0QIgbenunfkFdYPZOR/eLQlPFV3YoXMNDRyEP3wRapyPhQUVTWl2FcZSPa 0SMK49f4QqXaxFTo8NuN5aUkUPOa3+PC5HEA/cR8FDHKESh/SWOeNIHdOmy9ARV+ jaog7bhp/XV1HvpX0/u2gGO30XglyDyEr+q/sgOx2J8VomfLtuKjTkd1hGT+GFvX XvDhXb8gKMbfjrQJKCNA+qwisg5QOypWTPCq1rDALUfznqNFN+O60qVMd8XbGmBM rNyEhCiW/pXKD+9SehJypIq+TTP733c34FS4rjgwwOHpEV08jOR/UXDJGKE5PeJh 91pnZzn2oScfZxrJRMWoX4HkIBHag/CUuLDVG//ovj/+PMZy8HqPc0sQGvEmC4m1 fa4q9HS/MPlDvSmQPTurOPVlvTna5Fo+xbU+qAUW7d7Wc65zPbqcVd10UOUuvpCw V4lyKwIEqlsEB/OTOqp1aquRYB9RayXYn8PdlRzLAwZobTaIdC+GHpk+t757WdAX foHModpN1i6948RWDyJAZ8n53Yf/iUDAFH+ov7D+e5rm/m6xy+8tGugtVP3xA/Lj 8fVfjpqf5jrE8Y0a1JN/klKYvrNAscs3GrM8Eq0Ll1R7Bdv5ZTCWc4dyLxbiplxc r7Qtu+xSPS4DXFBc/lRV25McHnb7iiJcFEg+pJaIYD9P9Dc/YCzELPuPrQAufCiz +SH547BNnRM/T/vZKf+9fmRXEPxecQgxycQRHnTt0w0pVTkz4h2Qr+VmyeQKMq04 kLJ+mSweYpxmCQYB4qqskt/Hmn6J7y3X0YdXFm09 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A69ACD13773F7655

http://decryptor.cc/A69ACD13773F7655

Extracted

Path

C:\s9m06ipi-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension s9m06ipi. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E699305EEEC93634 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/E699305EEEC93634 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: /Kzdzo+j9wxoKJXLphYYdYyGW05XSEmmm4UdmOEhM5dLSHucX7llWQtekRTGxVmU G4m9r4G16zUi6C6VPbMV7kn+URZxyAc+xBUj2c0UBxi5shb52HH4Lf4ek5Y7EK+r kwPS/KfZiI7EY4m1i0pwzEoK9OrFPfpybwH5/za/y9g172Xp+7SHiSPZR6OSVtqR DhdqAWepDkacAbmi3Qcq5C6BAzupdC/FJB3IsfmNqD2DxPXZ0SztWx+lxu5A1hlg UGSmf/2sYrETkn/PwCj5ohHwsDCMU1IaXm19oFaok7a1eiv1kWrxx7He44QRb6s8 7Ciei5s5cGVoz7BMHWJECSzFoj78UAiQIWS9nJdPUL4Srt7bn7PEY8bjijeqE0it IHyiVQJOCyzTlEsRXJOeyUQV0EtyBotJrE+VHpiiCNURjG6whHPrBYD4h2Stoe28 37po/uDya3o64fc6kMRNRBC1lD1GYsaJLWPJbDlgeduW6Zgr4nQc8N6TysUXRY7f rZXz2mHlGmKMqqOQiFh1N+nMpXVwazf2kx5AawD7iT2I9UvPMPW6gOSEJ8l/9mvc ddXSKrfd9s6RTxobgUlbvc8JX9vjXGrshJP8Xb7vT2qbyJ6DdvmsdmlLr6pVkG4Z WCdke/ZzoGVO00HhjIZFljMZEPR5RBiX48nVqu3jXZlfxyBuglusONiKblm4cFhy DgIctB5HiQ5iYfWnEZrVjxlm0Qclsz+Y6OnZ2TO74aqc0g4KBkA9UQhpeCLuOtoq Uqf/8sPszD9Wn76elP8L2cVIiOq28h7o84B6qDsdv6lXx+hHyEv0Giw/sOs3w0ym nlAuY5W5vdNcGUUkX2jDat/lR1NZE7HbAhaDB/s7j8pXxp3nkYIiOMljznQ/gAvD Y2iETsJunPOMthSJYozy06gmD1q/29z4P/eINyTwomAep6QfTEtEBfM92tNEykUT bxbiID1xNR8w/95D1GIvEgUs1WxjvAEvUJbnn1blNVNdCukdQM9dxmFSgB5wD+sM dFPYl6aEyJfCnKdjLF5Kv7NKX55cTYBDY0nWPjwSh4eUD0OLL42SrNZw7fh/db4o VwUJ1sfjHbnYxCPRwYP/NJtPGx8UsvpyshJBMyHdboBMue8oVPaj97IJSeR0A0IE fmcy16TXvAzy1C3+CUtq6joAOXpo7JvZft79luMF9kjOrRSr9umYKsMDSeN1kq8D JZHrnzqpCoGcPzgleR6JmVjy+nOkFBpo/MIlW0vLoZQMIGu7zeMp4Oz1bghZs/EX Bbom2E+AAUQG6dLxTC8zpGq5llw= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E699305EEEC93634

http://decryptor.cc/E699305EEEC93634

Targets

    • Target

      058f5b8d291ac79c2bb7a3f231e3b5d8.bat

    • Size

      217B

    • MD5

      ac5dca786af1760da0a1d3554009dc33

    • SHA1

      983a1634a67dbebf5f835d167ba968f2daf3efb9

    • SHA256

      fc1242a015ede6e41e186c71d0d5d545e49007e5a804d178aa7114fad7ecd189

    • SHA512

      5eae6e71fa72edefd9a1373baa4add4e9dd9fc6ad2e7410f83fb56b1ec10633b5bf2d296016857c9667564ee1043a9207f7dc8ff0dab8b363598902eb1f8c611

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks