General

  • Target

    25670aeb8c557614c06e34c5a9c253e5.bat

  • Size

    219B

  • Sample

    200823-tkcsryvf6e

  • MD5

    c052ffa560e4de5251e2ea89d88526b5

  • SHA1

    5f0a6636545f8107c02801a0a190a1a8c274b190

  • SHA256

    5949574200b2d571b720bac31031f7a5b01d4224da05e5cd5064156972eba462

  • SHA512

    f5f8fc051da52356820f62fd5088115bb5108d6cb37b2c13f0538816f84247f24d0188988407d8a9351ebd1ed5275a3c74daa49c6c6dcae02241b175a5a79f84

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/25670aeb8c557614c06e34c5a9c253e5

Extracted

Path

C:\y51yj-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension y51yj. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/2B4A499010E7BCEC 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/2B4A499010E7BCEC Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: WzZ5NJjdmzyF5RasEBG4aplwp2bZXOFhpBFD0Vv+tQgEh021FmGN/QyUouI2Bz1x 1HCbv9RjTxNYYhpkYy16JoAEEUkloBd1wi+uGxAxHZnefzev/vJGThQgxUWSVJY8 OwyyJ5Bgb3o71urPtSMV9NL2SSl22WoKyXhGyZl18Ih0xi0/RWIgWguNYdCF34c+ LscYEEDsOSXfiIyrEjbYmOU6TaBgjAolbZiM7yCSUEBbGYFp2ukFt8nKRdZl5oRv +h+XRHdxKFl85njIShgiA9fT6yOAGJb7V0ltK/3abklrV8cm76uHdwRWZUK7KcfX NyRm3s8BjU1T6mHI0I2abK+NegsBbITqecHGAAApYet7ZqbaT9eH2sRQyH3gZ9Vg SvXN6rsYOEeH2/RRiUmXMz+y68MxLks4+gTYj5mgWbstiKVrGqMVgHdajeJQ+RUl eMR6vfr34BJCcUgXyNH/My9aJMzIj5PmNx5dzaqkEQ88HtffeuciMxgke9QdQbBa zYKFgSqfD1f20wDQG+upDW0wPBGEHyNGZc0bx9BoCFalGOPSapZgVyYd/J+0lmjx PGToXFH4kDN9bTCzJTiE5LmmLTzBS8HbGWudkDaFhkF78abBL7ZWyhorgNXmeiyK KnNGzFuwhLPgJNML/bWaWB2/3db7sm5Pf7AgWft4VDw7lAch5KogzYfuk4GyKmSs P66Lvici9nvQJn2GFNqdtA4q9VEqyd5LlbeK0IsT88jl4J0WKoCEVNoOmyizrcqx PxqWD2LKJOpF9Ruwg01SVGUlXhC5KsFbYUCAeymdnsVUuBayQoIS/VhqECl58FQA 76gJW+5+fRP6SLQw1CF935xuQlAwv4obXCImItMWMNuspJurhsPvri+a3l/Vz/Fw 3gitxGSQX32+h8xXhxNylPrFvRAl0DlqomJTh8s2Gn7/UBaxbwSCvgKFhUHPGnjO eCQ7ILGQP54YhS/BSajbXeukBsRMzpMm8xubcB5D//deojP7psSgIFXDTAOTOnqA l3I3m53I9wEmHwI/jqBR8RGk5KcZGCUZemiSEsGM/A0CFJS0lxWDofPQih3qqTEC sC5G3fJX4gIkGR28sWh4dF66x3DFVYVBq9YGtWi+a0T8jk5QoJPdhyknJEDRNIkb IVGVgm47A/9rI54+9eoanJu1LgR6BUOG4ULa+yxTo1+Vnw8DnT+TE/l6rsnyFV/g 8hlFAZwIXo0V2b4x1YfV8V09PrESOF1fuuDSjvne7r0gg6RHy450KQbwtBI9/nBt CB5XBFI/SbGWLGJoGjejvEcLWCoNFkm3uKgjmskU ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/2B4A499010E7BCEC

http://decryptor.cc/2B4A499010E7BCEC

Extracted

Path

C:\429c34h-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 429c34h. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5EBEAD0EEC4F7ACC 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/5EBEAD0EEC4F7ACC Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 59FakZ9H2xzuFbUyEf3poL2aAk9xitN5pjDXEQdwwxZnOoCciCtfJi47cocTJgDB /xZ0nB6U3MNQWM49AfcV0GoGM7SH0OE7Ak7Cq6bMCLRkGrRRizqqRPrB3GMcXYw6 Or2oK3zi3QrKfX1u81nBAjkcDK5mi4FaNRWK0pniFcD4Kt7ldLgsjfTC+L4DGT56 +IBD8CVItEsGSww9UJmL/87HD07RMVBefsWxlTehkRAxYATk587e+v64uXULOhIj d6feE17mWSvNEpmqT9xe3LZ+fyH+KzwOKZ/gK6Azlk5quCOcKRr+kysRA0gv3SiW x94JTZvoXv2Y3uab8RbUsZWKuQSOOxO7UP++KrjLLopADHsGbivBGeO6AGHdd7YA RnMbVay0lmMrKH63PosII7cj6L9Eqtx5zVT5Lpc6OTP14Aivaek8YofAIw0LoIIr fyvYEe27w9dTIsmAxXAYsOhUOQFFjtgEEjjpWPc/vALsUEAe2WniO4VNNZ/6dVBF Qbu/QEGuRB96xXcwF+DHkcQOYNE7OYhYephTPPvSg10wLqs2ZWkdjrZauRLUSYtV H0HdaDn7ixYrv37Mp7u8cByn26NC7iwioQSLSHiqrTB9IzqMNBV0V099Wlz/Su66 94Vfi8NpVtDi6H/PwTn4xsiVKPEBig+CTDnkGBrrbLOSB3GYXFbYGzfYJcMS7XCA VwwAhG8NWbFnnakjSGgYqjIJ1Q38EId2P5a2s3Z4krzjbBz/3b73Z/BV/hdSBPad 2QjGQhtzLtLgMOyCRM6AIAvcJ3nmexlRijTNRe8Z7BA3lGsNuhdv/Z/P+FWkmKBh gRBb5H0rsj3sFJ2GQbrR16CqBF6o/nP+mrs8qlsMgtszcfwtxwnDEDYvU5L7vR2X lFB7ZTB7WIppdkRHV4dRdx+ssYUaDBn6iWHVtzTqKzxtQaCIyfhxPzkd8xz0sHXW QpRAhl/gl5Hl/tBq04/MbXwTSZSTjBvxG4kOGhVQhPUbapo5DQe004Ycx9EiwH5n LQbtnBhlMllD2y1QjNISaVHZKNc4Ad9Q3m+1xNeUSysfk1XHDO+L9a4dcIUMsvVt X5bkTuuNTJSGsGRIbV0FjYaxhVQ01lIxe+Q8qBmHDqPE2h9WT9QVyEQRDd+n56xz e791rB5xgcKz8Sw/Eh93I3TZcaquh7XuTFFO/s2L9QmK6r2stRdsW/ld2mUeXAfe nqoIJK5JHusyXSpLd0j3iu7OESrCsnWiK95clG2gwu1DT7qp+L5zKgkp7oxmFLUW k25vZ7hIHjDusVoTDs9tgQfu ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5EBEAD0EEC4F7ACC

http://decryptor.cc/5EBEAD0EEC4F7ACC

Targets

    • Target

      25670aeb8c557614c06e34c5a9c253e5.bat

    • Size

      219B

    • MD5

      c052ffa560e4de5251e2ea89d88526b5

    • SHA1

      5f0a6636545f8107c02801a0a190a1a8c274b190

    • SHA256

      5949574200b2d571b720bac31031f7a5b01d4224da05e5cd5064156972eba462

    • SHA512

      f5f8fc051da52356820f62fd5088115bb5108d6cb37b2c13f0538816f84247f24d0188988407d8a9351ebd1ed5275a3c74daa49c6c6dcae02241b175a5a79f84

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks