General

  • Target

    57948d7f2e776c683d1bec54a461ce1d.bat

  • Size

    220B

  • Sample

    200914-z5nkf219e6

  • MD5

    f639a0fd02a603ce76b6024956fdc25b

  • SHA1

    783590b7e2a89acb69468ac3ece79f3bcf9b6137

  • SHA256

    63c63bb4f93c338d10395291b9b6255eb0d16250de46491f572a20284da5a007

  • SHA512

    7ff6c69a22632f4adc6dae824d095714bebbe45023f7a961c293a0faa472063b8965c183442977ba54453154d02dade43d2d7c3dd2234bf97e27b1422e81e4bb

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/57948d7f2e776c683d1bec54a461ce1d

Extracted

Path

C:\37fj7cqpj9-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 37fj7cqpj9. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/54CD3F1033C33A4E 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/54CD3F1033C33A4E Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: UbxADLJRW8KieAR3aqEd3uXWdH9KbiJdkhsrBHUv8imRjwscFMPahuPw1/S6hXUh r+UyvbBMEZmB5SYREL1noPiCiBNbntESPnG15xpnAaEnIlny8uFryt1jRR7BImfd OKRAl4bLZktsV7nm0m8A6ar5j9hJNAzoiKGFhn1DQzKVrxkmavVN2IHgeZxTXRnx 2GqJVEfXdnQBjBHWHvd/SYMeJkogYOS8OeRRL8rB8sTt5D3Ev4ajHNhm/uCl5On9 F0xCcIgXvaam5nH+FKTUT8lJtQQoCxBA8NknRy6KAbAMGFwX+wqegIzNwBbaYn0Q faB3MI5RmWON5vqZEqBWI4lAcDA06st0Cjs2BFNEd5lcZ6uNvYbWyaS20QkLGyGs q8LJzF5JAFpn9gLp4a/ynyHksw2geGf7siUPikbCLN5Z6+bxRrDKDvyXnN0ctsu0 oc2KgKnLQTTo5fkLrZYxMOHcJify7HOHtgoLlo1+JeKjWruWIo35yG5MPH0gyOes H2vF36iM2xMD5KbaXg1j+Di3eZIlfFgwzddK1en25QDPIl1hNKwq4LM+WiJqRqcv RqMb6a6vwGH5boTco6w7hfs7FYbVdDT3zE3DzJkQuEI5hFsp0eYeeU3bMWPQdAs7 X138VMv37NZmLpC0Lp+eLLM4VvIShMz5YsomRyxRbm3ESL1uDsvAtFTNC9uNf+MT qs9km5ciEnmJ9EL8mafIFdyNLI/Jv6eTzpsByYr3NTypDGg3ZiZjwkCgQfiMEaal 2g0fyhlMqFNnxzZb3HKcSXBhc6pGHlszO/pBT+VdVgvkiC6MEozZlik/9tlteafA 6SxaJVcWcxNPZ6bQriGsTgfZUaxtuerw28rV3H4IFmG4mB9bZPrrF59wL0lQBPUj Hfn2GVw605Uz95VcFftzpYrjceY0ic6C7ZWUpKeVSjIPLvAtAeeaEDHFteCs5cF6 supINA/XnkJBizIxm1pQOHws+nNg/O3bmHnT3Z2XO0d6Zccy9JqLhuXzhXLVK6ra Vl4Gc+Whdjn8qHW4EMsovvk/FRy82MRTrjUsH0JkPkaqHZm+MXH2zakMzSb2/HKg BQnTN/LBB1nBT0f9buncQwGXDljuTmWaK3UC9cMo9ZrO+J6AdfXm+14OO2ahWRE5 el3dq8wBaWVLk0APsWoS5tx8NUdGr2JQoNlHX1sv4tdHXOHJKOVjEGnfjnXwDz1a IVv14WMRMko7JLv6fr78lPI5EK8LjdpgvJSp67mt+Vl56rtK5NluufoTA1jnkDAu onehJONGTTOkQ80CUq6TXVm6wJvDiWAQ ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/54CD3F1033C33A4E

http://decryptor.cc/54CD3F1033C33A4E

Targets

    • Target

      57948d7f2e776c683d1bec54a461ce1d.bat

    • Size

      220B

    • MD5

      f639a0fd02a603ce76b6024956fdc25b

    • SHA1

      783590b7e2a89acb69468ac3ece79f3bcf9b6137

    • SHA256

      63c63bb4f93c338d10395291b9b6255eb0d16250de46491f572a20284da5a007

    • SHA512

      7ff6c69a22632f4adc6dae824d095714bebbe45023f7a961c293a0faa472063b8965c183442977ba54453154d02dade43d2d7c3dd2234bf97e27b1422e81e4bb

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks