General

  • Target

    87f461a62a7de4013da81005cdc4ac08.bat

  • Size

    213B

  • Sample

    200929-4pm7cngybs

  • MD5

    b80441d6d88bed0ea2c4aee192320ab0

  • SHA1

    cc5062b68194e72fcc39d78ec794eef77c631e11

  • SHA256

    3f89ce5be773c28644ec626cd94037a02958f69cb9a571c6c69788af498e06c4

  • SHA512

    fd370a4178ed0204241dd84df0e234b4c971c27ef8d6d7a423a1a1e0679ffd82d3879642f9d484f0089ea11785361104073fae26f860dbabd594b8300de3bd35

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/87f461a62a7de4013da81005cdc4ac08

Extracted

Path

C:\91ol0-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. HB-Technik. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 91ol0. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3CE2AD4ABB424937 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/3CE2AD4ABB424937 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: oPwzljKGjRdLfkbrtktuZXaVQCGGqS3Rwq9bYqP8EY5Z4CaVPXSKa0YqgHDj8sK1 wYz6knndHAslVErR84sDeMyeEUnvUzWqVHqn2/JqTdSa1s+P7I293wzOGJW8CWlU pUrYrS7frSjoYFnCldJmG0a4i8Jwst9PBWdqkjJfNcAY5v5BdIGqmfwPnxZStfNr t90NcRoF2KMEQ92HF3In62gYzaDrC8Q4ZUW2ZILUFo4UJ7DvdsrrEELvQe0Y/NIj T4WBuBhtjG0eq9WcLFfEZzLRf+B4rLYHrMYh4dPAGsZUMvdw6uvf+GhD3E90Nmg/ WQhvxJQhUqe0e+XtJ4F02GchIVJOjh9gBC39DGHVFudi2mWvO/7C2RRv9ko+eyxU eHQQE1Xmfv+4z0pTZrlL1t1UmVYQN3B0irhTmMUxglc2c6WJI+dov+S79vALs/fX KwB8NHgnd7IPBUwvKoaD79czlPQ0H+v4nePWErnT+9+Zjvwgx6hYTOlGefvL9HrG nYX7IYScWlQQIloQg+5jVOTwFVSISDPCtTtrnCjJFdzkZ11S38qS3AlUov1uN5QH 4BTzXGfmqFxkS2MvAOIfgKQYEpAimtcEZKrOfBAkXRpT0Yx+ll1AyyhXA3JtDJxb 4QD5Uxu0XgFJ5CROKX3UjV666vYpydFxF9037qtpKitIjLOYj/e8D3jt9DJKTuve T8M/nNblDBStHCS8pB8OtTHfxi/eUloMauPxTSvKVsF43D5zMnaKpU8k+dOnIb8M XVmRk0DJJ66k7OG/cMBFFtG1BgBzgaYUDITzUUVp+7yJ9tfBWCkff2rb5Z9PrPLO CvEh11eAtqmjiywvMn7o/CSQK5aiEv4A8n5pchDlI86xTH7n3eSdYR9v6O0w0mVc IaZg3rjgpYQDnEn42LXJMKMCnh3RoOQE1qCPjpRyWi9S2drePhT5REAz+BbPXOwz V/DbEOCNWss8S7iBEjXgNMeZcUCViy/FPvSzTdrvF8mrBFAoIXEiGBFqO0l8uLfc XF4GHe/BRX1VHjQw7xlWnNMuu0OZFbirammHgJjrGDsRRp/hiCho0KqvOB3BegWz 8Oja0xzEzAnT02Gjv0KIFmd839HzAnheAhaZXD+vacmOmI3wrfCcrthIRFEU8hJL msJPTfnxvE66nNUv28OntDYA5YouXp4BI38Ao4WgKPS9Yin181PzyNKb6bwY3xon otccjUTPLMq11lxDsomDwPnk9mX4WUhpdXCWZ+mtb1EdpJEDTwBNw7YB/dTa0Cmz xcNgKlm3g36hOgGbok8= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3CE2AD4ABB424937

http://decryptor.cc/3CE2AD4ABB424937

Targets

    • Target

      87f461a62a7de4013da81005cdc4ac08.bat

    • Size

      213B

    • MD5

      b80441d6d88bed0ea2c4aee192320ab0

    • SHA1

      cc5062b68194e72fcc39d78ec794eef77c631e11

    • SHA256

      3f89ce5be773c28644ec626cd94037a02958f69cb9a571c6c69788af498e06c4

    • SHA512

      fd370a4178ed0204241dd84df0e234b4c971c27ef8d6d7a423a1a1e0679ffd82d3879642f9d484f0089ea11785361104073fae26f860dbabd594b8300de3bd35

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks