General

  • Target

    6b344dbcf15e9fffe23ce5307af78070.bat

  • Size

    215B

  • Sample

    200819-zjblk4fyrx

  • MD5

    edcaf035412a5f6b004822eeba9ec0bc

  • SHA1

    5b65ca011d951eaa8266950415eb13dc55766d40

  • SHA256

    a7804db792288327cecffcd3cf6d6addf7ab9d7c56fac80b588aa76e96e0c383

  • SHA512

    10e58b8f554cca5133ebb0c33800a2de7e063712a791832eaa505379a7897375737f20bad7c7ce0e6ecd1e79e2ab2d5728529fa6a3750f050d56509503474c02

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/6b344dbcf15e9fffe23ce5307af78070

Extracted

Path

C:\7h6tcv2-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 7h6tcv2. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/1481311B8AFEB78D 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/1481311B8AFEB78D Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: IfNpelCDrXAIbk+J4LbbDrOaBiIMgZ46OU8Y3Pi6JFhn8V/04yRX7pfrQXnBzGTl MddNw++CbmULlTxyokjpqD81HzO0nwosboGqAv2WOx1CL/bQO75kMrr9tHJ1MORe JemAwdmacw+wS/+N2oG70TTUX9yhisf9zz2JvhF+pLfNg/WyrAvSugLfDf9vgA6Q ShnBkryv7jxQ/p0cVrXWfyV5SMcG+FS/FIJR7z81RjD4a7G53wd97aQPDODPrp0W wEFuDPTvP0P/L+W0vX1taoy/iqPnRRAclbQQbOsVMKybP9Mo+eXJihSpQM9QyMYe eZQsKxBISYAg15LUK/6Djm7xTelUrBfxPDlQ7HODVQzXNH+jN9ydLNtp6L0sStaV wrStb2IYjGYl7cpbG86xPMkHcUH2zhF5I6oKH+Yr6t1klt5nFeZYXEmGZRGOZEGV UGyDxrQzdhYBW+xoyANE0Fky2/ATCcqtsw5W68nWbbhERPzXejvUeobSqpdrFvfG EbGguLhpSosLcCmypJdyWp8RBEH6nYYCwK517k7dAHe1c1eXpX+3RFltqalqPma+ IqbD7PKORySqFqi8Iuj9XYxJHDyrnWypzXtmY/V/mvN5d94SmqReNSn5/mEA96yb 7d3QQNlBcIL1/ScD7P3VEwZhuiDTB0O5TR/FfoshpJWcGIebgTWFfCH4QgELYBSl ISDMmJnrvVsZ/NOs8LWa1QHEkh2VKFHYRkgIrQ+4ahIdu6DneQgMGTTYHM7/AnDw SetwdgwopV4a7J5hUWEBFZLtV2mu8obholbjvaJUm7A95G0tE35/IBcljmfl8RI2 5uAbCtr2G8w6lxqhhI77h6hVs/bGuJp43GdyOCuXeQ9MRu/S2vp3hKapsUQwrRGT EAFTlt+mkuKBqD/zk5+/58q/berXCp6GgjoaY+ThzbrZKcb9y/hT+PxttAjv8Rw3 7e5jqLtWyWnQefm4xfDiAaDijvz6BJa9rsbiY6FTfaDeozb1ftt22UPyvfKa/uI1 Gx1caiKrrjhwCUY9qCPXV7bBA73cHxYheb8Yd6tLPVXKvwhOpl625SoR9xt359j9 H/lv9n1Y8LS6xUEpXEbPATwXVmIegVvqVPesM3PM5GiaaevtNBqZ+tDG0KLUFwgy jbziUzWzHWcywedd2JB07HdcuAZjGh76p8E2hslYr+zJ/c6NlAfbiXfZwZaLPQOX 8YN/kb4olhe0LbWso99Y3w6ykn83eHD4x2Es0GksSitR09O8kp6jPHEePjQQVCso +eCJbwMZmq61nkVXKnMuhJPd0MR1CZVIh0gpZrKUVVc3VQ== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/1481311B8AFEB78D

http://decryptor.cc/1481311B8AFEB78D

Extracted

Path

C:\42dh2096-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 42dh2096. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/09D8D1069D6958FB 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/09D8D1069D6958FB Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: fJYEpG7UhT6IijwuiPAwSmkATGhw0FnAlN5UpnY3Gb326w/e2JutNs3A22gnymAs i4FINaHLyY3se7lQVdjwSBH+BC9aQbhp77W/GJ2uTDqV3e7BhkLqqjTyl9HJ/79+ dR7oyUWCd9pLcgaukiUKRmBl18DaMsuGsWKjQbYepb2zPaZI5s+RWq4/DFiOwVlc cqsiQAVqMloQXnoIh+FNYnhaBwQXrFD8z4rVOkBqX8QxfqirA87VoToHYOOtb7Se X2YJaYqg4UVebCVPKv65nJANy8PahGdVzDL2d3g5gFEC+ECDDEqfjxecA7SgmcPT RwAo6U6503Kn5NDrR8Ght1/U2RfYCIO5sgkn+r/fd2CKIjS3vJM3e+PkFoDae0JU mN/awWskR7YfMuWRGCHKhm71SW20A4BHsPHzVhYR+QRr0l9ID0EQqmphsQXucGK3 nhm9mWm395qZOi9SMC6Lj4MZx5XywWR0zTvVSHihRidbVBptZFkyygE55+xV22Pm T/gr1MLZmvFtVSLuVNhEO3hvSwSO7/6k/vBzDO7Aqt0Dh/W24kYk/WJhJlspLUsz 3OQuV036EunNbHd4FImyE7XzghFh9LV79/F/ScgQLb+KibwWF6kp9vIPA4FjGBvN hTH77LkXCEsvjC9qkYOl+dQIyc7VZS/ftngQxLQWt6c3EoO46gKkfpTb+KyYv8Ks 0q1MX3yG8oXyFG9DjO/+WCdNAy+j+WzBS9PYAvR1bsipT1NneZukRaKqMs0WTnHx ZBDgA5Q67tsBIb7r3SGkACtenVDSVnXuZeA0b6v3h7/TZ4TECVyf+w0bbOzMc0Gj 5BhT4gC4a+dD/+BPL5Hm8B0MNvUmeAk/mQ9DfvfsO6DkEnHFoi5ZM38KtNjW9dNp uHW6Xmoaf9ho3wuDyriETKW9s+SWApLfk7s37yPV3DBzOoMBKra6Xkp1/s+fYrdW DjCozIKMC+vr/IgWc6U/35WXH4tccrMAG/4VQ0lcvyTy9KV+NBbm6LHRw1aCqh4O ax3mGGRgMvvsLhT4CWceLUfWeH+9J8Hb7d+rWbBId8jcytLHtZH17fqbCOewx0gc 1zgQJCaix31U2AYSm/ynpzFCzaatS1h11BOsEN0XAZDm9mgKNPRmSRQXBN7DAPyJ xfu8D/QPcDVg0ikl35q0MS9QY7Z/ouE+6rZc8Ho3ZsLsCtRVEwMpnd+ppNNdjtzt QVQQFDS4Q9zykrmeb1DDQh+rJjVfCbec2+mbtsHTUIpasqCL8OF+hRYIUuvrevpV o/gn0ufGtdxdMwZO4XyQ6CxSTxo= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/09D8D1069D6958FB

http://decryptor.cc/09D8D1069D6958FB

Targets

    • Target

      6b344dbcf15e9fffe23ce5307af78070.bat

    • Size

      215B

    • MD5

      edcaf035412a5f6b004822eeba9ec0bc

    • SHA1

      5b65ca011d951eaa8266950415eb13dc55766d40

    • SHA256

      a7804db792288327cecffcd3cf6d6addf7ab9d7c56fac80b588aa76e96e0c383

    • SHA512

      10e58b8f554cca5133ebb0c33800a2de7e063712a791832eaa505379a7897375737f20bad7c7ce0e6ecd1e79e2ab2d5728529fa6a3750f050d56509503474c02

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks