General

  • Target

    907a9dfa1ee12bc85669faaf78bbcea4.bat

  • Size

    214B

  • Sample

    200928-vbcgjpbs12

  • MD5

    e1fe18d046cfe61c5f33836a8a3f7787

  • SHA1

    ac46f9af46ba6f847df4627fbfbff3e4f7641305

  • SHA256

    17c07801ef59676f056659dea9953b977b2950d02f48bbc4160ea748a71426aa

  • SHA512

    1799090232c52da264281d4117b1f76262d752469de2ded0db8176acde4af6c31ba7fe37bfe0339075506884e11e564726d197e27bfeb9df1d7a27487500a9d2

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/907a9dfa1ee12bc85669faaf78bbcea4

Extracted

Path

C:\8038l-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 8038l. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/EBF382E9B45D1AA0 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/EBF382E9B45D1AA0 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: hBHjnyy7AY2AembtNpmGiGWMiY8x/acKNVW2Jhocztpcn5Dv8lDtrTDOXi2uLzTp J5WZn4iiSH7A+qf4CzD0Pikd+9RX910s/QOAUAYzTOehrUzj7uGJR7yU5YtggcXx Jhtvuif7ARysn239LgymHBDLA2o8zMtxxM6ywAqIelfsdvgx531n7kvTct/2gd0R Nm4dDcmy3mZUckdZTky7NyS8xOe/MnKe1LC42DmJt9cVPUvyrre62TLZAmegfbQx daL0PdT5DXP2INQBE3qk78usEZR+35eUqJtzl4/6hGb/V8UN9ofF4S7h4sWnv7/L 2NnWJu9JArftXbzW2MvNdtKmAd07UE+CRSAPbXqbq7FjmQ7S/FUW976B81DDXQdu Xwu5+pTrLHzkLY4sjdUnOhLmpUfUUuH7H9u56L43QKokDpbsEWRndpmINY24v7JR OUC9HlKjqt0Lh5tZrHHatmR09fI/GTUf0rS57xeIyVjafh8D6iKobr4eKiivWG3m AHAD84KTfQq9FNeYgXJfJ+VQZOEB+baL1YC82Z/1d31xbeCVmohY/OYxWmA1bwzA SN1DKpxy110eg+4vkfZbhkNdjW6JSZRS0tWNrjVQLWIDjzn4pi+BdqhUqnwV5Vkd bjNSci6th+7tJIaxTd+A7C5nIrQIVDidfh+BAqENzupTMyrg1AlYgaX7oN7GgR1o fYOIcpqwkjNyVhn279GeLxwSb5btBkO5fJNQO1OimHGsFpdKqEwcldK6I+vcTzc0 XLAYg8wWgDLi/Mwe/TutidGe5EcnNY2qUusA+z9WNEYIuN3kENRWihj/gGRYnVdN vJV1tvngbq9wckFzMs2Sr9vgXHlZpxAi8oJKpwfRO13xgdtixIyIs4Qiy7P9but+ mLZmDM110AAcuS23aT0tVyG32GmEJVNZj98iep+79EvU7Eu9KGypI2KTaiYx3YZj v9mYfTT6O6bNXd3Bwlpu4FmhNhvq/G68bCL+g3irH1gDKvho6CoIk5QMgXGN7L96 EwY71Sn6I9prYfuZX04zJPRHVir4xY2bgxOB/jKnADTszuhpCxbsb8tHvGeCCd1I JqM/klb8EPOExNOpRuMLkaOxF7NULyd3T8okMMQj75wJWn5uuhFJ5fWVtNbivd5b 2GDDqr9hd4CwvCClsEUx4f3DfTulDyjgi+T6s/Oic2FOruzzaxz70kDbmIQGHvqu g5mzf6ETCiGH/AVVuwE7PW4t7xEgONWXwOhc6B//RLkt25uZOFcvyqRht1KLio6x VfigPZd1KzsUJiX73ZA= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/EBF382E9B45D1AA0

http://decryptor.cc/EBF382E9B45D1AA0

Targets

    • Target

      907a9dfa1ee12bc85669faaf78bbcea4.bat

    • Size

      214B

    • MD5

      e1fe18d046cfe61c5f33836a8a3f7787

    • SHA1

      ac46f9af46ba6f847df4627fbfbff3e4f7641305

    • SHA256

      17c07801ef59676f056659dea9953b977b2950d02f48bbc4160ea748a71426aa

    • SHA512

      1799090232c52da264281d4117b1f76262d752469de2ded0db8176acde4af6c31ba7fe37bfe0339075506884e11e564726d197e27bfeb9df1d7a27487500a9d2

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks