General

  • Target

    08f4c5c03fc0cc5d53abc87c636fa352.bat

  • Size

    221B

  • Sample

    200928-jx91wta3kx

  • MD5

    7ee19b8c819ff3a99af00edb39c76594

  • SHA1

    bca4f04f6195e10b42ff3332972479534a08facd

  • SHA256

    cb305053b4e91dec8aedea6cd2cab583157579077bf24200d126be60856abae2

  • SHA512

    37ef4e655549d664b8385ccdc6749a3322956d61f3f05076ffbdcfdc07d479ddfeeddc5a1ffa710044eb1e4b9a597417df459c9dc6bc1733e7dba5f3061bbb5f

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/08f4c5c03fc0cc5d53abc87c636fa352

Extracted

Path

C:\b2wp3hgp2i-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. sml.com ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension b2wp3hgp2i. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/EF643CC24900CB20 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/EF643CC24900CB20 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: GJeZoDhkQbVArn/5V3xPe8q/XFwsGA/vnBLF/w6VaIEFuFq/r86Z1BkKaAky0Eqb DvPoh48S7hwAl1al+0QpEURbI33QEgXEizyvtd0973dtx4E10CxBPJYbpNsj/uvs p8jvRNPZTp3xE+H0HvLsPVPlTS1TqNm4TTYbluHvCkXjnoCijWwrTbe7LoopShhm OKltcI6QTBYA4RaRtinRyyb58rRnmfLxR5nPY2hzEhc/VTp9ee1rwM0TZR35O5E+ iuCBSbzA0G3qy0Jht0SExKaWLyt/UZHHMcdZ7RgfO8GdAA0xL0rYRTTsrBwDqKPn klTtp2NlIdBfJKStFEBcxOpL+vcRz4jsKX5hhU8qYyCPFfDrgcRnDyUXMM4wZZJP j46sHTiD0C0tAdDUOsz/GSBO7B079KkJBC5JzK8bjModPNGXEAvsVFe5wxRHmBlv cHnaH4kQpcXS9ADgLJnJgs1B8sUURqzALnOU/ApwQl+TEbVEstZd04hyK/IKmg/I hX+TsOWn2Gv6fVcv3L9Zu4EFC8x9un9sRVCtuZ31p/FOz4KhtXkp/RLpo2S2fExs EzYjIlmL0Fw96BU/R7pM33s7kzqvCD4sDQD2vY1EDODYEBogEdtYLtAdfr5i8v0p NTc2E/jKNzSgE6cFLjNNSpD28yFnfbpLHPm9K5kLYMLXbCTmVJOpIztir+BWg0bC Dm0YVJpJDI2sh4LdfybzeQvAW+LhlW2tJrI3MU61DVPKMlvMUbZzADlhfs/ULNDd O5l0U931Fako+tveXKrB2xepwNCSaQBXSC521q947McUIMmHWiVnEMDBFgf2d9Wq owfyDD4ITgq/e0A88H1piPyNHBvTDfluvz4gw+Ku3/CoymLWZlibTx/88fBw36DF uPjI6miK9w+TrIqfr31nLfIKMZrs13mtAhodS2HWV5+DAPLf5uWy6qRwGJIDiiO9 +/HbdafqgViVQGr7SbbjfTTGJ9eHlIvUgVE5hgXEuzrTE52IKUMreqoFVsS0SAl7 fTqryg2pOX8VLnUuJSppxEPmr4QcdUs/ZvlKOjxfJ7JcdnHYwx/WK7CqOgWQNpCM 1q3fCp5vivJ6ml8W8/aVlnEnVqEISmFt5i7cqgJLec3ilQjrTXUdFQI/g8RTIXiQ dsR9liLYQGkzQU4XrpPVSLyXrOLzqSyVSoLnA3T25Zl51RL5TBPz/dqJOeh28vkU KpO9Lu1crCu2mF2IMJExAEbFquGDJr9R5VFnl2Xp0GxttaPU3BDr6OLe36FLTrCR RF9AJz9DJOXSXtrhakmHfCJzhFlU4iqC ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!! !!!WARING!!! also, if you do not contact us, we will start to contact your partners, notifying them about the leak and hacking
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/EF643CC24900CB20

http://decryptor.cc/EF643CC24900CB20

Targets

    • Target

      08f4c5c03fc0cc5d53abc87c636fa352.bat

    • Size

      221B

    • MD5

      7ee19b8c819ff3a99af00edb39c76594

    • SHA1

      bca4f04f6195e10b42ff3332972479534a08facd

    • SHA256

      cb305053b4e91dec8aedea6cd2cab583157579077bf24200d126be60856abae2

    • SHA512

      37ef4e655549d664b8385ccdc6749a3322956d61f3f05076ffbdcfdc07d479ddfeeddc5a1ffa710044eb1e4b9a597417df459c9dc6bc1733e7dba5f3061bbb5f

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks