General

  • Target

    59757318723e5bcf0dc7acb1e50a016f.bat

  • Size

    220B

  • Sample

    200821-1t68pdd5e2

  • MD5

    3ce440975e6a9f2c1b282370f89d2c24

  • SHA1

    78649de7adceedaf9701fee3ae23b048df1ae0fb

  • SHA256

    32fd1da6b6ea751505cb7a81d90fc2f0925a62a78c917262e96fee968b627474

  • SHA512

    179853fc7cb0339b71778d815c0c2834027bc942a70a832149ce62ce0bd05f99222032affe9c07e01542071dc2ca11343d45ee29945bc6d19cee9d4679953188

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/59757318723e5bcf0dc7acb1e50a016f

Extracted

Path

C:\4u3501oc6-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 4u3501oc6. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] WE ARE READY TO PUBLISH UR DATA TO PUBLIC ACCESS IF YOU NOT CONTACT US (USE TOR BROWSER TO VIEW) http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/posts/140?s=61908812b95c5ff1176e968733afaf55 [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5775F44007633814 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/5775F44007633814 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: dCbEFD7EUu31d6OmBxSICaGtwphSLAk8GOSpmbtHRoJjZbQW4RPws+kYihWjjo1I TZMTcJBGgC2Eive7TXDphpt+KzmPiJzHg20M9ftvYqUg/SHfSvdgZ10h8mVpzz8l 5wWoW57uts1RbybuU5nWrfwLRMQdVkPEEcntU1L1utxjHpSDvu5+olUuBpugN+PU HSPRFcYkYurlmEA1xT8tZp1Aq9YZ7on/WFCYuFHcXpiFHmczgYRDnMcTPBqEXGw+ qlVFvPHcr0XRz9uODmDkHbOQ3JHjvkzR1xVIHQqqz35Az/8EapplQ+gOsG36GOsI jN8m2HWKBevjk9m9bifmAgQJZIgVn8gTGuVyGUI8ZAYZIKduICTVl7pCDuzwg5q3 9ZBTmhzo/au5xwDlQGh49QJy27U9TXIAvLgwFM7Q3f8SJYvLdSvMjG3dcAkw+Xwq h9tz+xiyTxnzW8+2k0Ui3+UkYn9J12lZCQkU62A1a/mjLfpYq4I08PQba8ZBNZSm uK/lc48xgKQ4xYc1yWMPUAZqCLzCLOX+KpLeTBIMMJ6iiaFQM5qNfUIFQAYDVzVq HJaW6zHg3x0aW6GGhBSvKqs5YTI9Qaeb55XIpD57IEUgKPosHneKRTto5onXValI lRTiQScL8GgAU1ZDkz+m+615lSyGP3k5225MBbGRSbKnK6O20y76yun/rzi8ltb4 sPpZRSUhMcBop7tnKEgnT8tJTPShjGoVibi9ratAjQqN6TVS5wVTSsd2YxpVKamV cUaTZ6TkJ6S04tKVNAgFvriKMjlf36/B2v6uVMX1f6005Gro64Xz+BwaQXVNssHQ TgSHuqJ/BiNB2zCMsRxBAodLt9weHL1dYtLjVTuQYbf8hEJ7LklPRUTDD3h2E8b0 oAb6SnfflPGZ5hlDi+AnpbALmXUHlNAqUWKGc95XpOjzNqvWzg4AWaPUOglPWLyq xzLGNn2kQbwvgd75cnGQMyfuil+B0MSRIbUGsZopCsAkHHb/tS+j7B+Pswpw6s51 /LxemZY1FWMEq+jRC//TnPjTzf0mcBHKKIvr3iwdYXZtPgMEiRHqG8L/iDHfzCoJ CfZZY/oOtvgGmOfX9hW9yWHqzoYJHCk3JIk+qegJwJhBkSEw9mAQ+s0bRETqwhU6 JlWeMIh5W/SJrXIbBj47k5ug4rD+46jGsszXkQYb+2kJ+4e1ydwDoLK7LaQ3uYfk /NLB5v8Xm4Tf52Ss/XZOs0iscB46iN/nJL76r7VndSVQfe9WxrwbunVioFJGoQhX V2geyNBLkZImotL2RXtvc7cPMO/yyJE5cU7wRnGhvcOwNjcNblI= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5775F44007633814

http://decryptor.cc/5775F44007633814

Extracted

Path

C:\atmf00-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension atmf00. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] WE ARE READY TO PUBLISH UR DATA TO PUBLIC ACCESS IF YOU NOT CONTACT US (USE TOR BROWSER TO VIEW) http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/posts/140?s=61908812b95c5ff1176e968733afaf55 [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/2C1895CC9C2E527E 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/2C1895CC9C2E527E Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: gARlp9Bfo69DDyoQsjiYkuOEYcR2w34ZEW0p2ax6DvfxM8/OuLySo0rJfpdJbrDL 5wtkt4Jbr4ijlmZT6XjQcDQwAjBLmWCRd/g32t1fx+EVAgsznQHc5lZAhLHnG6Fk 4GL03ZNEzeJURqxgX9meDAtinlSLGcQ6KnP0IqTNDV9xZBkVyOKwT85G4/qZ0IsK URHgrCHNmVsNft6+33ZJ7tyF+UnjjiKyXIHnyuDpuh/8eyHp5Zb/vc8R6s/x4TJX Yk+ba8W7TU81oemqq/2XQiG+MW3szV9MPURDdmHI6F8Gsb3mhm//ucuMAA2kV1Yo RvBK+Ks57rRbtTJkAfIgDyt0YYEnX4oO/yGbu23KF+BQA/gc6MBHfTEVZUmqGbSI aXPvztcfysxooyfuv7hfcLQqKAw/exZBeX4v66RIVAPCgRny++s7149USD/1jgQQ 64PBRu4RitYjtQa5gOM6SHlzouN+K8d+Hf9bDR3ip76oX9RiATEAYcg6BqDYCi0X NPERP4jTEZQpQj8jvSUkpZbTRqEjpKlCh00DNaZd8GLE5U+GYOU9aSx2zSOoBEQS gtMQELWx4hml0dKhaFlBRB7SvAFKsc1+bkh84YTB2wgh8Dt9Kr43nFNz4D/+woIw ME+rwDRCqJoAzhqK4fkD+7bCQcqmNBS4BwsLf85TlDg+KY39+DPTF/5wYPKD+xF6 0J9AbgDyJxnoxLVYY5xbeTvH2L6nEvihChfkmr0obkgqQp1HlXRxwxxp6y0Rwqmp tZy/T8peA2PGdJlXte6zHDQ5YqNrqZxq5WIGuSU2KwonBMJKfiTcPii+hafVi6Qs jRBUoeNheATyQWtdXH3NfuIbl7if1+nWAzWkKTIlG1DSj9ZI2VqbpIbg3nZxS5B6 uhbnWrCxbG5eAP+HpjARIVHKNIxWhd2Ef+wL96k4a3k9Qj4OjIkeVLBqoiciZ2Y2 wlbwpjbENwpPnKOgGTshI0woJxzK3qMRFt8O0ZsoSF19kDTciX3trS+QEWXO/KN/ p+bh9PJGP88xPMvUbybuICItSR/NU/Slz8JWaZUvxlXkGt8aGnsBL1N1hU/RyNPc 3gmFKw35RM496WYaYta2c+6jTkU3/Kxau9eD0MLvZKmp4it9w62wmWIjWJmmpRdE /pl7lCSWqlG8JPeAPA0QN9hu+cBaqyzB3gQh8Bt7ZFNCOWmbnacE1biqh6BN6hzp 5MeYBumfLuhGsEv9hctV3VZNdPhf1vy3tyNuog5G+6KybO+kEQAUb3zPWx9ezFUI D/Nws74y42pO0s6GIGhfQw== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/2C1895CC9C2E527E

http://decryptor.cc/2C1895CC9C2E527E

Targets

    • Target

      59757318723e5bcf0dc7acb1e50a016f.bat

    • Size

      220B

    • MD5

      3ce440975e6a9f2c1b282370f89d2c24

    • SHA1

      78649de7adceedaf9701fee3ae23b048df1ae0fb

    • SHA256

      32fd1da6b6ea751505cb7a81d90fc2f0925a62a78c917262e96fee968b627474

    • SHA512

      179853fc7cb0339b71778d815c0c2834027bc942a70a832149ce62ce0bd05f99222032affe9c07e01542071dc2ca11343d45ee29945bc6d19cee9d4679953188

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks