General

  • Target

    01619b049472811b76565ddd589bc9eb.bat

  • Size

    221B

  • Sample

    200903-6gn7sqxysn

  • MD5

    3ab48b49f0f231c470e42900d1a7e59f

  • SHA1

    a25a30cfa56bd61d0484e2a37fd86fb365edf99a

  • SHA256

    d58ef2af3b2f9387c21e0e0b5b81594a995dc4a09e8befa0f0d95700bc9a342c

  • SHA512

    f6a7e33125726389dd01e7cfcce2286050cc48d56b465c719f8d5bfe6facef0fbf83ad47111c52ecd3d67f090e394dfaa842013f71b9b7d81f2c0e8c4e9ab4e5

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/01619b049472811b76565ddd589bc9eb

Extracted

Path

C:\m6h3sco-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension m6h3sco. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DFAA79F45525AB35 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/DFAA79F45525AB35 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: Nuy0DSva+AL+ABJ8keC+JL/wSl4DUoCzMkBinecrx5KbhTHPcHOj+JezRjNiReIW DKVXji9foydbl0bi+vVkN/nSEslNyLVwdxMppIivNRZsw20mQ0pJArrDM4zzSKM+ OIrnZA9Sjo8NQAgcPcB38bnGPXdRaEjcy+/ciMCwQ3puov+7N+eCzI3kbF4T8gZN ghz2Ntsj4+1zIbzYVWgDmza77Lun0VTvDy3vjW/U4hpkjnmQSBYAXvuf1+ZD7MgS ig+2bWJxKQz2OtK7/3Y6AmOtwyPc5whxyR6cx8FZpRQ2srMzsUKdoANrunhpYTjr aK6EfbRgaTtvt3PpGr9kGibEPDit7acmu63AEFC5XVCpjVQQ+yu2WWjnwUjnKkoH 9SIGCHZ3an5W9P98mfDz0wv/hL+MK36dAN6bOnz+24Ecd7+cen/FAtT2QL0vmCdk o4OwsuiVPr0ickkE52u8+3d21fZkzcB7slrad/aaOrKOKcxYhdxkIJrrxbznpJ5O fPPse84W0WMzorvRbx63gkqYX4EKnFY7Hgq6UQr1OGem9ylKH/6TT1jypLI5sZP1 5uAzEpint5mXi0p+A+oNAoMmPb4dFk7qgF+lQPra2cSCankOWXy/PP+A3/XyZkz+ xQ9dnR0t15M6J+tbhnmWbt9E3gXvxeMFxVkPU9Z4Nyx7X9O6wKovyi9keouoRtyy h0DBEbW2OEuMLBwt5zTEMf4mejyfoYDAG0gmWIV7t+is6ADZ6cxr1YTSASyR3dQw B78n2V9P3xZ9XLFCuLpRlmWaBQ4flGPPP0QIA9ZeBDWq6CKbCYSpMVZSiOg4ZXrI f03vKZ3ZS3FIuUUBCCV9DL7qjajyU2q/+P2c71N6Yt0bQpBJ2FdAr0g/rOc1XrqI LSbsyleQGsfj6MOFdvtGW8P8HxYVK1+61kWTXBOL6RKs2toXGMSe4GJQH6ySFB0+ WlZAb0w/3s6cKDFZT05pSHaSnm70+3xH5mNRYJ4cpyq7uWi4s0zcWFRlSWu9D7W9 GfEtOwZBaBErjGR/mgPKPHzL9gi4YFYAo+74YehU2Z668UXnh+kRaH9PkbN6VvxK KTC/Zcg+qDK2oFEuXPC5srVJR4MeH13Jmr29rYYKEC2ttpI3Mu+Kw/Pg694Xibca K5zqykWeaaTmheRc5gHg0w3cZ9frHKvCKT3NT4Kpm0zyC5vxiPSf+hUi7i2e1VJM gwG6GvmvlZUKWXsPkA7O4gA3Kb0UtCPmNI4ay9IzGBbG7ItTn6iTn8psxPn8ZyQW PbaAjo2RR+1fcGwpnhoMmrKf ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DFAA79F45525AB35

http://decryptor.cc/DFAA79F45525AB35

Targets

    • Target

      01619b049472811b76565ddd589bc9eb.bat

    • Size

      221B

    • MD5

      3ab48b49f0f231c470e42900d1a7e59f

    • SHA1

      a25a30cfa56bd61d0484e2a37fd86fb365edf99a

    • SHA256

      d58ef2af3b2f9387c21e0e0b5b81594a995dc4a09e8befa0f0d95700bc9a342c

    • SHA512

      f6a7e33125726389dd01e7cfcce2286050cc48d56b465c719f8d5bfe6facef0fbf83ad47111c52ecd3d67f090e394dfaa842013f71b9b7d81f2c0e8c4e9ab4e5

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks