General

  • Target

    ee784cf3584e7d556683ef667f8905c7.bat

  • Size

    213B

  • Sample

    200908-3grsre8ews

  • MD5

    f875790db1a23bbb0f99b5d028e3dcdb

  • SHA1

    be6db7752b70a78736535d0b832da469ee3030d2

  • SHA256

    e7e8cf1b2c56a7d5810b8158b78da915ec54ccaf837e10277a88baf327edac05

  • SHA512

    1a301a17acfb97cb522278aa77a3d06efa64338931509ce8a49431d481954a2f209bb5b41a25daae11c59de88eb232f702c5559a9b52f04f20f0aaee0f6b42d7

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/ee784cf3584e7d556683ef667f8905c7

Extracted

Path

C:\owgae0e-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension owgae0e. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/6301BF5911DE7F8B 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/6301BF5911DE7F8B Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 9p/k/EszcOOz3doF/wUAZrHqBNQuxxrstC5LNSG1Ri0JZYms54aaYaQn1uhBbakq 4yq6har32zU4+WkARKbD6E5Go3AbmO7EpZ3SqZPWePcryEDCS6ZpWXgJxMT/Yeyl bkHQ7DqArO9psXJ3JohbIy6VyA96hoDazzv4McwQblGzdegmP9euDsb7c0c1I6VU nRRCoLp+/V3XIiD/Vqj9+SwA/Rml4F3chHXKFTRmXB2nzZjnEsM1/Ol5rgJZ+e/1 8ybYu5732cbR2f+s3zHxFtuk+eaR+fmI1YDm21TFFYSgtQovsLbwtROBJt2pSrt0 PvZ3xh828ML9hkQCfp/1bLw2Q9bdNYmsnh68PeL00EVDJbYK8c7h5GAtH9yOQ8yl jpTGnfjv4tWTkW1PoK6tGkwEYb6QWQYtzQF/seiw9LjXAWPrxpPKyVhrULtq4BYI SNGjOM3r7kVVa4kTaAb4fRDXSeDubU9Bqu1wt5to4Evf3tstv/zrTtyt/+f+yvSV CXbfwJer1jsxpA/D3zHcFPIz7XG9zwIaNlt7U7UZ+zW7CQqrYOJTPZ8UsuIj3LYD PMQoRY3qQlQvvwvznEmOzFsRdmc2gpK0TmjUvxMNbdBsFGcnpCGL1Q6n9WxlOm1N JhHENr1KwRRrWP0M4Iz7o0yvGv/XRPxkObqeXi5VKdNfLkvJ1mre5R6aUNxD/DrM Q4lgGDLZnlkEcxenmzUoyTNCkGhvpf4bnTJIU967r13/sWD0hiQXsK0xAOiR0SJ8 m1xlEBbzkIreGpMjg8ZB69pb6u54scHMg8iTIOdviXIfmVzRCKfeMnfy+dWsj5mK pomhWWoja7hq6aq7RTMMGm+8t3IVA5QO9FdnNIO/33omryfoTfdJr4eyZG1AaT/o 5Jiy6JWwDBqx0xwpemHBe0HMrCCYbiSgXKi3+D/lO74NEk/cjG+IZlIz0drDJ8jH E9RCFmaLybfFJ8+l0AwKcsg1bjptiDP+pQ7fqlhzXD8Vpe9uzmKptZ+UAwxr1P3F KlFMMv4CZwi1b0eEK4xoMgr3YoJdrOhgCyAaha8DVRkZLnVqXGPLYabQxxwpVCnp XtdQwbY+5SPSKYI1gryRNYJF/ANYAWReozkZ/NVXzZjrV7JpwJcZMmdWZtGF5IYW zwI4rauF3IDGSLzdXzKDiHAnuK+UlNKoJ/htcVr8eSNRfZdX0FsOurQxn2i+cIx+ TFfcMAgDw1oMY2B4AoeJ/+iVEfkT8BDgKY2rHN6cUWgZGNhSQFbI9nKdJcSyPUv3 FnJo5tPkoD2H33wQRphn977t ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/6301BF5911DE7F8B

http://decryptor.cc/6301BF5911DE7F8B

Targets

    • Target

      ee784cf3584e7d556683ef667f8905c7.bat

    • Size

      213B

    • MD5

      f875790db1a23bbb0f99b5d028e3dcdb

    • SHA1

      be6db7752b70a78736535d0b832da469ee3030d2

    • SHA256

      e7e8cf1b2c56a7d5810b8158b78da915ec54ccaf837e10277a88baf327edac05

    • SHA512

      1a301a17acfb97cb522278aa77a3d06efa64338931509ce8a49431d481954a2f209bb5b41a25daae11c59de88eb232f702c5559a9b52f04f20f0aaee0f6b42d7

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks