General

  • Target

    5436705d1e25ce0a762a32c200158950.bat

  • Size

    218B

  • Sample

    201003-ae2x5k2r9j

  • MD5

    a9f336d51108c56fda11701557ded1ec

  • SHA1

    57aa584c781307cf32c1ff13800d0e2acdc3eb3e

  • SHA256

    b5877c4cc1d72694fa3faafa1879979975365e52e7232eb6a3a9fe8aef4aea3c

  • SHA512

    4c54738d6e6c73cba4f1376276314ee6a8ad69a33ca1eb5b011f2a46d78def7e44b01d9349495f366433ea8582fb0bdae124f554be08fa6fc314437703893274

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/5436705d1e25ce0a762a32c200158950

Extracted

Path

C:\kbokpg-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. NUV. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension kbokpg. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CB7C9BD72FBA8814 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/CB7C9BD72FBA8814 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: UuJFBA+8nRc+6Y7yeFbkFmxorjMTqtTg8om3bWXqoGbazherJGTl9SA2x1aCb/+G Y6Y3i2DOp6FikQpaqzlBoNFcf2yGHb1xFbAkgUCHfDyoWLQhlSDLH/P15iNimX2I obhzj5BBBuehkr5OXEVbo6y91gV1fXXq/rVR1FHnJzv0cmQ7I3JfvzgIDCuADnoM pCka0+I5d8bt2l4pApp5ZUnUyP8UEXMCO3aFiDl6edc0Xc27f05POP4lqTPDzpHw qTeF0IxCKyxVQGRnV5QfoH1RqG1fTVzGMf+oyn/LjA4HQyvhP/khlyVQW5ypy9vS y89Cdp0nBRsvK5+m9pjmcrGOcbb0AJy3228DOt5WGfEltHqmdVrjzDTSlNwcj2gP 1NOL612bNQbAWa1Utr3fIXVWyg3yVWJvGl+E/fplm8MyuO0oTvaaYdLak7UmzJBu lpvjT3WLi62E/iaXBmoopJAisRDOZlAsITXzZ7Z6f+OuRJtimjVQldkd7OhkkoXI az/5ENZ85ethSOzdNVyNR8/IseMel9zLg8BXmQI6JDTM3gcHVqx/yVlmb+pryw8x FLoT7XIOOxoqd/g1iiagPHW4GRaaTiH0UKYcdDfelaTESQaKi9zCZxzi8HXuww7k AsMLcypnwNLISuVPpoJTT5EVntbcf8PHJs9N5w8t5Qe1vKpTp4dKJ1K42A6lOm7q gQdV1+JUSE78aZY21WiXxtvHD91bXc/qX+XHamNQ4Q52RfLJLIsODnSMwz+QSkuJ WnZdKi3DOFYKT2dyBQq+bWdAIfewFr3kpPRqsdhai3NUHqTjUOz0xi5NWCSxcT5e QOwEh9s9i6sCUpbK//LUh3699My8yusK6v5ogAIHvVKctMHH7C9pc33JyXZOjxBR zGQPDB7xw6b8c2nvLBZ20fkT1tmy9yoPdzbba0sW1CkJhKcCpl5Cse3kcrn5lN61 cmHwjLNBPLEeu1RKPf61RoHR1tC5eqmGllOxUN+RPv1OFJfIFIV4Yb79OdFvQ8qG h4R6Y7c7Tb18xqZoWvLOEn/XxiciUBrZTOoiL/jrNO5Bs4kXvPs+2iOiA0vW0lp5 DE9c03kggUeUtk32nItXA1JhWPa0QZ75v8D9lWVhx6d6QcwJptjcw3KPLyI84Fuv 0NeV0Eh/pheOIudSJczBENuK6Z/uQ++Y3i3DGeIq+0r318SiikjHjxbfhVGZtqby 5zx/zTGHllrAJNEAIPDKN3VL0n8OEIdq6gzhO9x7Klw+iNRqRv4HvecXpTwr7KME Dpu6MPvVO0wfY6/lxzhZIA== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CB7C9BD72FBA8814

http://decryptor.cc/CB7C9BD72FBA8814

Targets

    • Target

      5436705d1e25ce0a762a32c200158950.bat

    • Size

      218B

    • MD5

      a9f336d51108c56fda11701557ded1ec

    • SHA1

      57aa584c781307cf32c1ff13800d0e2acdc3eb3e

    • SHA256

      b5877c4cc1d72694fa3faafa1879979975365e52e7232eb6a3a9fe8aef4aea3c

    • SHA512

      4c54738d6e6c73cba4f1376276314ee6a8ad69a33ca1eb5b011f2a46d78def7e44b01d9349495f366433ea8582fb0bdae124f554be08fa6fc314437703893274

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks