General

  • Target

    7ea94d4f5d4b54cc7b266644eb7c5555.bat

  • Size

    216B

  • Sample

    201003-66qvjcl8x6

  • MD5

    4944228a925ef6dc45f160546d123fa0

  • SHA1

    f6864b976df62dbe266805a1fd81b68bd106ec17

  • SHA256

    6918fc00fa266da8167e2a7842710a6cb4740f4188d31f546bc92d659d1cad09

  • SHA512

    55d1ea4e2a72197a1fd8728fe9ab488fc3e45b569739ba897518f1300743e538fd528f5104719f2a1f151b590e3dfd86eb0bcd45cb50481c1ac74b7e69aa1674

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/7ea94d4f5d4b54cc7b266644eb7c5555

Extracted

Path

C:\l6a18vlbri-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension l6a18vlbri. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/22F567D070B0F439 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/22F567D070B0F439 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 3TcHlRv9euZAg8zO37iUU0rbwKEirrDwRyrHjcZsZVLiZW4RPMzr7YN+ddId2ulr 7rsc4SX/Jk/M7nZmxq6DvyqCsq5VRzeiLbJfvIuWwu+lRqs2zbqucNQD04/X779t FZYlrUdLf6oSx3TMP5g9nyG6sowtwfA9Bjr1R9CxrVbk4XlneYOhk+wLeF2lUyUg 0hPng+8iqEvRMgqYc27Isr4/1TCVwcAo/FHVt54pG/qo86vRdKIfeQfW4BdA7P9o zY3jbcvskaPRk5+YtaSJo32H72EmR6lHDQ2xFEmbrX/5reBv92da2lMwXpmdSZV3 hV0YoKo8GPbELGJIKnADb+SmqUc18E9Hsmm2ZfTWJJcD038sRz0BERztlpGlXbn4 a8JqQaSnNETvZI1CFb/kTMHFeh9UFH9jMwFLUr8N55xR4aG86k8RAQkZxqu7YmrY oo5L9QRWYrBzDQYJ7HvG10ykHfOzkgckGBQG9NrlBFMtHAUve9odYCplvTdToCbJ +PwT2unU7d67Nd5vZyF3mNH1hetrbKwH/iZCWXoAHIKmt2YlVVuWI/dCnJLK+ZnL N/uc7le7dF/wnlNzxavYmDMiuwZpqF2Kf1x66imh77lfOxmLWBy/qr/salElvAp1 BnAXkeBrS1VkXG5wHEYMMxrn5rCN+f9UVHm3oi4NgZSYbrRL5a3asdwiEGdjp99q M7mHu2bqjsgCY8jqRi9eNv3KdIueThUskiCYttaw9vz8RGTgMDHZ16/aoh5HX3Q7 tkHMXkIGlHc5HHNR7shAyp8I5XhtRhBTm1gRNTAt09/fQVWfmMP7kCjj6yaAgxsb 0IiL9pkVNxbLCs32jCoTDO9goKb3MFOtpYW5URh3fBpobrbwkmdg7u54QdWZx6D4 v9CguZVOp+L+IF6dsxou7uB/5z0jbbZE02+O/56vSHhNiYjD9PG5HLqOmlOtfxV1 5llGkENdvXmrFPjadnNXwJQhSxa3aElVbqFfvzRB5BALLWu2x0UZiEy+nrKyryIT VHkVTpkr4hAX2geKcW13ZDo/R+6RRwwzG4E28xVUAI/Q4SqtKkOKxDoHvnlAwBa6 ej9j7FoxbFrhfpuV6xKGABDyG4sga3WEfY/3ftN6zft4MQeCoSEh3NCqgPU/MPJg vrAAaxdB4VSm9xLAKRCVbff3kv0M0QE1scyb9jOtC7Om/gimwTdw0T5ZczI54cFB ZUx5K4sjLI9q4R80YNP7E1b4I4XnIJMfMS2HEneqt6mvh6xDsrxWVi8ShDkB9Kfq nSwnepwzUAANR/h0NWQGkEmegB72PiL1 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/22F567D070B0F439

http://decryptor.cc/22F567D070B0F439

Targets

    • Target

      7ea94d4f5d4b54cc7b266644eb7c5555.bat

    • Size

      216B

    • MD5

      4944228a925ef6dc45f160546d123fa0

    • SHA1

      f6864b976df62dbe266805a1fd81b68bd106ec17

    • SHA256

      6918fc00fa266da8167e2a7842710a6cb4740f4188d31f546bc92d659d1cad09

    • SHA512

      55d1ea4e2a72197a1fd8728fe9ab488fc3e45b569739ba897518f1300743e538fd528f5104719f2a1f151b590e3dfd86eb0bcd45cb50481c1ac74b7e69aa1674

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks