General

  • Target

    d011698f0a0292375484c2ce503fd5f4.bat

  • Size

    221B

  • Sample

    200822-yk69m46y1s

  • MD5

    2620ae9cab8fc22007e8184ba8972c49

  • SHA1

    fa1095550cb3150a7cadd676bb594e5c60060a2c

  • SHA256

    6031919615418117acd8af53074b43ca886e452074663ea10765ae56ff83b813

  • SHA512

    8a2b0c4537d60159956ce3edf73f136ee9bd2c7194b0a0dbed17c234df0a8bb5a0effb21752bd9d6d5c7b87e43ae50f7e6fb58e613a9e61533b0b7274dfe8ebe

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/d011698f0a0292375484c2ce503fd5f4

Extracted

Path

C:\ae5ba-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension ae5ba. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). We have copied financial files and other important information about personal data, it will be published on the Internet or will be used against you if you do not pay us, so if you do not want such consequences as customer churn, media coverage, fines like GDRP and other damages, we recommend you to contact us and pay the ransom. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3A11937213753CE2 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/3A11937213753CE2 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 5w9nnsHg6CMB5NUNdzRjrO+8aa+9YWGfiLqCg9KlvfEDsMRzl5pb+wA/1hM8oo4B DUwstCR2O05OPsQ0rfE7PfDK03XAc+/o5mkss3dii76hrBxzPpOKTNcVFSba5Xew l+vI5QXq4iVrzGtjdhqlWlmXF8ePZ0jrj/9JrY+9DTVplWQAcfN0t3Y1KsPFgd2J NZWIj0tZc+x0ZVw/k5YY2lcm/O3CqWWAhakwDrYHsAIdETFaGzDjTkirdcQIcyzO IFDLIgg7/knfsf/m3r9gkOyqStJhQdWEYnJs+XyH0JLZ6/j/wyHFSC4EPxqvEuEw D6K47gndQD0F87PTE8A3AIZiHeLcMpXpDi/e4c3pr+5xsXyir1+OaArqukLcqEVZ whrcYoBVaoupBhtQoR9LuANzjbFck1FjFUEUABwHvSQw0T5MVyZnCs5UaQRkg9SH zG9LGNd/O+rHhnT6NclzxMDqX3pYYigduwWxvgaOha5qu65umfm9bWwMAe2DBN18 KsQgUZwvp1kDzB7fOyfFQxvO3lgQaql7B8mN1zP6Qh8ruatOKcI9ZQj6cIt0i/PR 1B/E10qFydd6n5t030DRd1cZLDOmpRJMiLOF41htd4lXcVAW0FNRP9oP3J1ZWmUx V1xiBnK0ar6pU9eJaHLmXJdcNuAo0Y8GuUUUgc4EfAEF1BvEej9dga29l2pm/2gA bXV/R3KfvOIqRyg1eDJbR9hiR4BUto3ETyRIQIRZejqDsfYqMj+I5WE1EC4hnH7W toPQoIOwk5CuLRH4QSx5mj10g3CiPgZ3M2bTzHW9o1dFwkb35SU7mo/xK78u/9P5 VjYrNkl+RqG2WfjMzoeHo0zkJf5gFj/WGleiIXDwzUz3HRfCznQDvEf2ZEwOb0Es IVNY3SfK7Id2xaR985bDnsyaXMQMuw8CJ/FGH7OQfHlUjbvLsxeRcXqCjFKG3SH+ mmWlcEM3mG4Yj/Srdm/wU5xgCy6ooJGe2n1XQ2keuJvFHazLRjZiUy3gHIOVFr4s Bd91ptX6P1UMqAYDnWu4nDUUU+flYQ92F3xMdHQogh2emdjoVv/r0/QWZ07zcBcE d7cSfiMFWaZNsbjzgO04NHY8oewYUWvIMXPlxP4fxkSXGa1yTzpZCP7+s8PsuTGv teFXFsCWGWLMzApdUm3jH3TJGlByCyC6hRdWaClP0w0I26lryHNaE3Gi224AcVLZ HMpFtIm7Fh0xMxx+rPr7lejgNbLTzwmteEARCFCOt5nNvHooVl7USkbS4vY+jCgY XadyGzp8dIffPAkSMYmeWG6cDFxjytugflzB8P91 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3A11937213753CE2

http://decryptor.cc/3A11937213753CE2

Extracted

Path

C:\8g4frqd169-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 8g4frqd169. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). We have copied financial files and other important information about personal data, it will be published on the Internet or will be used against you if you do not pay us, so if you do not want such consequences as customer churn, media coverage, fines like GDRP and other damages, we recommend you to contact us and pay the ransom. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/09D8D1069D6958FB 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/09D8D1069D6958FB Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: JAeOrWQ2b72PQIbyz6vJDzmOhTAf4K+uTTfcowFutgQ0OCg9pWVHaTd7pNMuRUul WG5tk6Bp+dpU1RcQ1jL6MEwkOfe9bE7bPM4t/1OAttSv0CYR3WdfEOajkhqoNlsr qGY6dkAbDGwXefeNOohEkk0/51MXDe4LpsxZStuiTsuWVqDU1nixzkfvTkkdANjr sfjIwAhLXvQ92eBZpGbVOD2cp6lX2wOtDUoJURs+kZATOoBjEVzZwlL91i+0ShTM I0Yna4yY844crIqPtQVKoL7JAQUDCxnvmFjMLzBlXUDAYQu8cQyo35F4QpqtlXbU r3AGrurnOUWHg5qRyDlMzPqo9161T4328snwuQNaSYWvralQg9rslwgksTvczMPV kE9Y93rOuAdQ3Lz43AQO2Yf9fzqW7qTdEnZirYZbDOHTQVjskhyDQVcZeVFRIkKn 5wP7BLhrmny1JSleG1xOEkUPuXyInzYGzO95jYcImuNDnMynghBSOSGnMXsoH/wH +CEIRkDflHh12UCLMgaPLqMzwB2rpw8CgN2oN2CGlZxvoHHQpp3vxqsw8XLSrGeC Cbb+wariJWtcuIS0o+rRCP2VYHqFT0fqb9yXZKREu6AGz5kDzNrUC+8/4MnB5fOw QpvLJ+g5hosvWS6lXrDuhwgseGF8LG7AvwNrW7lMsEvu0mqiaKNwdmciIAolEoeY K7Z/d0sAjkcTicPEInZH/dIROAsQ1t6GXo9oopoP5TrFZSc+gG4AP3fr5HtkSBo1 03tQ9OHBNBtG+fX9jp10jhBtwCoipDmzj5/DzNBYTVATG6E9P8DRLqrRpmkcj3ys /A0z91JKYASLUSCAh3EovevojzGRSpo87YZp+89wTxAi1gDOtUaij0pOTHc8Uclf R4jNucFT8CJNai79aTdRRDNwrud4cL8qjiBh7ULX+xJZp8bYrd/Norms2f9VzX0w Gjn4dWFXEd+5w8anI3iLCgPE+mD4GZ6C3kLVxbCnFWsNmlCu7QdrvS9pB6C3+/g1 gLVAmVdOe94PSTicvoNM7T2x0f0l+l4cLJuhYIwyfW/EydN3Dsa7HOcnlX0IIAMs NqWd5OEWbbIW3dQLKgi68mIK7li4pruH9vPitjB/IbiEZBTSvzpuJDkgZIeejqxN b70FrZtdIUSkROaEr5nbqccyRecxPSlPlAJ8iQEcZ4zA3TEBwR1Nrbwt+gjKaqZf DbGNciej+M6MiVJOYWc0t6J9mIq8JxnmAD/7ljAMz/swTgA3el4mPgOYfnByuAT6 qyYqIBRx2H6gmnkIOwDxGtnFDJzaDugn ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/09D8D1069D6958FB

http://decryptor.cc/09D8D1069D6958FB

Targets

    • Target

      d011698f0a0292375484c2ce503fd5f4.bat

    • Size

      221B

    • MD5

      2620ae9cab8fc22007e8184ba8972c49

    • SHA1

      fa1095550cb3150a7cadd676bb594e5c60060a2c

    • SHA256

      6031919615418117acd8af53074b43ca886e452074663ea10765ae56ff83b813

    • SHA512

      8a2b0c4537d60159956ce3edf73f136ee9bd2c7194b0a0dbed17c234df0a8bb5a0effb21752bd9d6d5c7b87e43ae50f7e6fb58e613a9e61533b0b7274dfe8ebe

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks