General

  • Target

    82d5933a7fe8497bb64008a8ad2bdaa6.bat

  • Size

    220B

  • Sample

    200819-pj1y771rdx

  • MD5

    613e281b75ac4b2fdf68a543bf8e3910

  • SHA1

    04cba786c3f966f0b61a930155de7ccfb85e5edb

  • SHA256

    697fd96092e104056ff21a7acab7b07da036f4e8d6cb9f672814b51be95591ed

  • SHA512

    389ba3e5b8d2188f3d1b6acb152607b567c815869ef0435e55e9eaa3ee93e31a692cc647369e21786c56bdd178bc6413f881abfcc2c8b5b38493891a86907dcb

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/82d5933a7fe8497bb64008a8ad2bdaa6

Extracted

Path

C:\ml005-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension ml005. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] WE ARE READY TO PUBLISH UR DATA TO PUBLIC ACCESS IF YOU NOT CONTACT US (USE TOR BROWSER TO VIEW) http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/posts/140?s=61908812b95c5ff1176e968733afaf55 [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/2A37A62126565D9D 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/2A37A62126565D9D Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: JifyahV+KukkXEJrshYHWAUsiKnZsoSD8MxEY4C4BsiBp5Kw0FxvxV7wSmPPIRc7 KEXmLea+x4xzXnZGv2UsKdhZsVexxpb5QXhi5ND3EKOrk2dcal4cy9s3m9G2/zbu QhguWLvyE4ZJ9rB8kE4O9D6QsQvgF65/fHkq/URqBq4xhlsgcMj2jbXI+Nuw3NII bqTm5BvuB7S7gK7IDyQUxfhesgsjARX8oXAWHCwI3qYC0Qyinb3EKPALoZv4JofG b+rYAX/rDqwz+1bKlZlbeIsb7Sfr8uVRF8H3mOeSfJt01mtan5eZlmHcncScE4De CDNovMvhskar8Drtv+j/wg7ZbhC8jqzDSbZvw/wu/7bCAFcdu7/UngBBFrAUf+q6 GDYJH3+YNTkKzTd8ngCiUZ6SA7gZXYyIbJQdYHen8KV0Bbn1qgVX27hP8mTXm4Oy Cf1ylM/lWl2SQ4P2T7V0JzDu8UXmNzn2XiM6yZ8LlPULIzaeOS1O9gJEZTBYOheD XkNrKiFMJqTdoEx4keUMtv7BRV8v1Lh09Z69wWUoe3DHihGTM4+ZNUxNojY64dw3 aZGGsNRfsgMAKEo/EnRR7ozQTNQLRw5tu6FYuY2y2V/mxP+RASEeqsY2N+UFFjug n3SBRsPqjloK7KYUN0KF+suRoEnqWznrX/g+9ilCooT+milTkOpJ/ioaGi+MEkby 0wQKbqW/LEHX48hPEQ6I2OvKkcmRRwDY/mbxcx5tZdtwQTiPS66HdFHdQp3rV5iQ 8wm2F2n/QXQB3K3Ywel/ke2ohK48Cpc0UTReWlIESqaT97F3/aQwiId//m/0Tc3g C7nV9yIfQXxj6zHh5Nf1PM9SKPfcH+hDdveQVJ33mNHSh8mS1LXPDtgV3Gh+R7Qw DRevIRxL9sTCArA/BJEtuK3lJ0WXJzFDUzcjFlLL+CXVrD+yEdALm6Ln8K7kMreM KnNk1k2WPVPCJq3NaxxCCLXWpYe1aHetsH6gRo05Mrddj9V4JwlCQras5XX9Nihb mNf0RYE24TeCCpbqzYFoOkwvt3pQjjjo4Gmthbe6nt7XUglfxLTCNYbxk2onu0qa UfmAN0wy7VZzaTVHrtJv4C02Z7BxxXGECJYCLPbbwTCVNGvs3rYhaD1/BcOt0nyE pmEAQj+ViqMplMucGHUuF5jJoo3iEryBaoYs6QiKmbBA13PV/mwutfACPl1ENre4 h8Iqn07mXDbWaiqfKgjREFFieSq3ZeEf3Dv7ZdEJlB/86OZNjT8+HFu6WQV+JOTy batV1ciEKfmkJUnVgXG2OcI2P0d6ysZtgGSHIvyk ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/2A37A62126565D9D

http://decryptor.cc/2A37A62126565D9D

Extracted

Path

C:\ja1kdhk2-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension ja1kdhk2. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] WE ARE READY TO PUBLISH UR DATA TO PUBLIC ACCESS IF YOU NOT CONTACT US (USE TOR BROWSER TO VIEW) http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/posts/140?s=61908812b95c5ff1176e968733afaf55 [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/60709E04D1E2CABE 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/60709E04D1E2CABE Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: kOQebir2nRyc2v4uhp4bVn1/E1aLrQR6/r89UHdvaX+DoihFytxS+8oEEKnGn8S+ ZrA+DOShYSmok8MIAegyCdmEhC4+0lX/NQdrpzJ8D5Ua5O66mFbtgTMTq9bf3jdr tYjSNjxUAndprxufGVUeA4uacn8c0rFgnCFR2cbWfFrnSXtyEM1bube3jCv76/6A xGBkSo3/n+kGDqByZzKvwzlhvgN0RC/BQtx7II5R5+gbj2oMTarVvUvDauU8eZxA 3N+AyHEXc4jzM8pS56PNDwzWUDNhdF1suwMl8C6p4b/GgluZOXd2EXKxliFyjrj3 yU3BotYDFARtAxF0KN6VMduBq3X9ik4z+N9PAndzRueeG91arFZy1247TVrPj+EM CXOBdTjroTJk3Yk72xfRl10GHPTztz0lQUUUl+5YP5pEYIPcoD2mou5lKixaQeCu m4lIiMyriJYxAy+GYGhBGsh8hO6sb7ay8cguJLbNB5NticgxPZRWMu/PNrELJhcK +EXxQwpMD/0E9ufxx+YDVDxeKEsVPtCUOqwPeWfIgsCTGy7/cmjbSAeNwcHOwJOn U/JlhW/9V3C1ov0nDV95n1FaursPbIf9NidKIFKaQlQwTlGSXXbHuwh+8vqZT6Uh xmjXQhxjZJ8IzRSA59Q23Ce0bC7yWUZW4V3Se1rIzl/XtzFD/lf213Al9gOQihf9 05aqKufFhZH6XlXhl89ulyOGRQynZ4cpvFPZ9g9KYkoyIF2TAedScoQoWRMBMvip gSfCdk9woq5DysoVsZxTpXuYHEH/nrtx8tB3IlNCnd3nS1BlVYOnLsf0uD1zpcfQ SdzZGqz+ghwvDAJBp3YTYex75z9c2yP6ecJPQHKDoIwlsqTwBBoaUVwKbTdkj9vM nLrkQrD9D6NxuxHooJ0CN7aaMb5GjyffexjQ4bZRHcfKWhx25WfQdAiRTnk1r6Od U5dNR2jG6QM9TTJIneoHBXwyLgGcc2n5gV9LbrRI3lQh3MOv6t251H8/YaDjcFb3 fA83rpNVP9X91/6hphjMEWtcI3YlwJywaJx6NyCcGj/fVL8cpMgeiVPqegDNH0pw bIyxaYRPm0bsGfRsgt8iN61XkphUYMGieQmR5/f7bqsGg4xowDiT9Lvzv4uwO+lY 3t/4ZM2ervtDbkwBJ8Np1KNPetZScarD27Xuv1tvvP56vryl/av6V5dl/C9KgHCt Vwv7DbNFyQcDizCY1hZhGrJBxTqtxw5LpVSFSwiq+b/+yEtW8BUUfeLvJ0ichcVq 0v9sCCgAtZHUHyDBB9Tap5CfD94= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/60709E04D1E2CABE

http://decryptor.cc/60709E04D1E2CABE

Targets

    • Target

      82d5933a7fe8497bb64008a8ad2bdaa6.bat

    • Size

      220B

    • MD5

      613e281b75ac4b2fdf68a543bf8e3910

    • SHA1

      04cba786c3f966f0b61a930155de7ccfb85e5edb

    • SHA256

      697fd96092e104056ff21a7acab7b07da036f4e8d6cb9f672814b51be95591ed

    • SHA512

      389ba3e5b8d2188f3d1b6acb152607b567c815869ef0435e55e9eaa3ee93e31a692cc647369e21786c56bdd178bc6413f881abfcc2c8b5b38493891a86907dcb

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks