General

  • Target

    148191c5edb43b691f1df387dc563507.bat

  • Size

    216B

  • Sample

    200822-jhk73jncc2

  • MD5

    136cfde5a2f54a7d8742d25570058e5c

  • SHA1

    4c5f2992b01fa216311c261996c0ac751485f533

  • SHA256

    9988e330f6441a383a3c4b89544670f2ea60dbb9c587cb938fe71dee77003391

  • SHA512

    5328bc43411d7761f39c13c213cb10f6da9b81be55e8031ab77ca34fd1aeeac7d0290cd86ba0951d5f232e43fd3a738a54c601dd0c1518481750758e2611eca3

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/148191c5edb43b691f1df387dc563507

Extracted

Path

C:\059f116e4g-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 059f116e4g. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+]WE HAVE STEALED YOUR DATA FROM SERVERS AND ARE READY TO PUBLISH THEM IN PUBLIC ACCESS (USE TOR BROWSER TO VIEW)[+] http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/posts/146?s=af64e6481d5f3e44b6b5bfc04cfef40c [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3CE3B07FC7BDE577 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/3CE3B07FC7BDE577 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: Jyhp2aIoW9UCuQ81l3Cou20zE5bC66hy+CoClcSshghtbKXCstIojqa0BDx2tdan CVtA9U0JQLQuh/QJB6W4mSmm7NQ639XHp39s9exTSR4ZkdHi1cpWmvJZRBJxnspg 4QyDr5FcwalyA7MPTlko7NKC5ELZhTBhxSvFD/lkJ+Qq7vdtDsTKlsflAXgemCu6 41F82AQ96Iq+qP8WjUDCwbBPUdZ2poS5MhNL94xCtdeGF+5VqbXXlYQ0dxh589kr ZHv/2Ob/HlLWZAj5IWGQoXKHwMtxSxDdQa4Rn9yJ+dYuWTCDDGTFFJWKSpQ/Yam9 fSU+8LY6eQO6diDUEjmFETz4YoTjthEfNdB6LKa/MGNSMniHBr1Z+Wc2/20uJ9RS pAQbEw2Il8GJtMaokxsDNbhzrzgnD2C421r34ooGv9ZP5WNma+WiVsr3r+elBjvT UA8EEK6/KwzCkP8mTq0lkKyzEP8VAAPLYAsczV04dQkMZeBaLkj+wBWEqRBA1p9r pPYyC9ETT9aK7iYIRUSKYfhPtgKd/8nWefhzc+MyvPIuQx1i1ev9O3OwIxbD9gZ1 ZIPBezKRerIE02buB4V0fKPJrfUd18h+3U+nKETU1XvHru8ihlP8hDzfB5L5nBKA /ngUTB4uPuWFKdCOJByJU+ubEc3oBqAY7l4g95Y9xmGh4kScMKLEtW6g8F267yN0 mOZsN7qXxSg69r9YBtvUUS9NUOUnOQ+k5B3JmD/iGHggrHOjPMEMvntkzl5f7O19 EzIqlJ4p48grnhzo1/fY1zm/kRlFrazkMsiXXE8FMvTB0yu4eNQ6CkyryG3vVdlS NwfHnK008N1VEP4wUHPjzBGh652BfJGjpmoFYBTQ0922UFg6dtkZRhSiVmTTfICd EQThtravIVps2D2vkTGanvRoN4vOmMIdzpdmdEybOLTezy5cXQKJa3uwpKIj6AQg l2/kWDfwGmf9PUTdK+w8Kqu+OuJVnRWDthsasTSu/7wA0GctF/Q4MOIebwLZ5Qmv /rGDUCcOwW998m46LSKqWJnnLCNw7K296vjh1uUUWXAUkOBEODJLOLdB/K2HHZ9b AKWNgpc3P8ruv554nozBS8Zsx1a5cMYi3mJcZbytimDJ850MODsNWADV7E7i7TJZ 552uJgolcran5FZTawmR0YTljH4Lg3aYUxJlW325DGrop6gUNM0yV5YJnP4OWyi9 dDI/p1Y4B57V34YFojRAF9vsLGFffq0q+ycYiZ1Vprc2kkcM+pGwsT9vyzaUCyAO pY0zMLqtVqAYgcpNcIBsVIYBUCqMlejXPrnqHBg0fZAFSXk29P2xhw== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3CE3B07FC7BDE577

http://decryptor.cc/3CE3B07FC7BDE577

Extracted

Path

C:\30972ehjnb-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 30972ehjnb. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+]WE HAVE STEALED YOUR DATA FROM SERVERS AND ARE READY TO PUBLISH THEM IN PUBLIC ACCESS (USE TOR BROWSER TO VIEW)[+] http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/posts/146?s=af64e6481d5f3e44b6b5bfc04cfef40c [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/847FCBD1B7E34899 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/847FCBD1B7E34899 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: ZNz74AqZ5T+qqzgTFov80LbIZW4oeoDVp+2EWCLX8ZNcpckKyFuSX1tdA60yRbje aY84qi15FU7cYXCmTQki8bM3OH0QVr26Heb+Qv0CMmj3wGwko4gUm+J7Kb62ne/6 ClppyWQL3rcfpryMx1grnrrPkVqDIKuueVXFClBd6318q2bYMcVomfBklqVi9dGT MwZShUsC/iq8Jyqzk0In0CyTNHSuenbHZeRyw6FQlW0MG4BiyBjJEvGC4mJJrIIo SGI36qNnUoHXJMeO005bF4/rsQ0Cp+GtSIxNOLvGJYj0FLUbQZUWCsTtM0KQRa71 VulP6jqKzPgrn+/wrekMQYBpUDOMWyNwxUZ3GB2aRVADuRw5HpXWh5cmeEWDK1rG Z7gaTHyJ22qn1SPzc+kXvEX51O7A7muPfVyJfefEjI4zN8uuQsdxfG+fTiSMOykP umTXX77xF1ZB5IvXsIXdILNm6/Vu/HY87NqY0bFLCGu+fOfPwVFcNAaNC7LRCy3P evdB0Xs/PMoQGKATxbGly9TlqUrfa5Da7/LgI1/g2V0trm/hEkEAlduYdGrRgdV8 W9Ywr0YIIFmyqFvUK6sDRfb9fkHIoZzrtOXslsIzgvsfWxvaJvzOfzmii+k3Gibg H9Zyp/Zy6z+1k+ZluM5VAb7L/7KaPTbcEEYRVt2mdLAOwE/6MydQbLiqH0jpRbAH iXG3I5t0jC5Yt/4/RmAX/QVugwdYhNmVcFNjyJvPDdRYjUsiT38wvs0GVAZ8b09r GWZhS1yh6OBXeZp+Y85AWOMQjXOKVn54R7X48T54ceIcMSvSBjGhXTivqn2oQ9wx o7ixMR0oNu5xsGNNyfDaOM+qrj7NAlutUcaYaArQsb3ucs6/Jtw5vLXQG5u5P/Oy EBVQrlRvdbFNgZ44cPnkBj2oYJEh3Bw0hUyi89wzDLt1sCt/NyfCdeIMcgRbgSsd 9cSsMkSCnIg+07yFA2E8EOMzgByPRgjYmGN9ZwKOA8/b6xNu6O1PTvZeouJ28gNt LsRMxUcrd/DMn1at52XDkXrVf/40nB0BVMTguP1XYPiJQqp2rDiUTAUqRvU9L2Gm d+jvGeETtdZPahePKkYQJhEOIvm+mjsH5MomExIyx/5ooUsy71C0PABV5kaY6cKK OixkXG9m8JiIJq+ICAfdty/QGgLO4M98WsIyjjqQ+dIrJpuKwtMyTtLwEr/N+EwC FdiDoxGp+LwBM1R2WwltdvKK7lSVnfF1AXAieo4wuyVyHw+KgUN5hzZY7rSA1VJ+ yqwSFXmbTsKnfUebCUIsCPlOv8KoSTHt ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/847FCBD1B7E34899

http://decryptor.cc/847FCBD1B7E34899

Targets

    • Target

      148191c5edb43b691f1df387dc563507.bat

    • Size

      216B

    • MD5

      136cfde5a2f54a7d8742d25570058e5c

    • SHA1

      4c5f2992b01fa216311c261996c0ac751485f533

    • SHA256

      9988e330f6441a383a3c4b89544670f2ea60dbb9c587cb938fe71dee77003391

    • SHA512

      5328bc43411d7761f39c13c213cb10f6da9b81be55e8031ab77ca34fd1aeeac7d0290cd86ba0951d5f232e43fd3a738a54c601dd0c1518481750758e2611eca3

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks