General

  • Target

    7cbc48d6ae9ecd184f501f7b6335c610.bat

  • Size

    216B

  • Sample

    201007-eaqpnv5zla

  • MD5

    f413de542b9c7ffad61e390a12df9530

  • SHA1

    f533e65ef43aa735f705c4e90453ab73191030a9

  • SHA256

    6404114463be10557553648d2adbd3fad665f24bdf9596ae4eac9b1c085728cd

  • SHA512

    ec5cc6220178daa514948eb3490643101495f69dcc9b73d0c8692a14107420e0f97fd34a7045d5479f905022e72ee835b62a375a33fde085e7f7732d3711e1a2

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/7cbc48d6ae9ecd184f501f7b6335c610

Extracted

Path

C:\18i3262-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 18i3262. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). We have copied financial files and other important information about personal data, it will be published on the Internet or will be used against you if you do not pay us, so if you do not want such consequences as customer churn, media coverage, fines like GDRP and other damages, we recommend you to contact us and pay the ransom. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/85E986F3615ED08D 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/85E986F3615ED08D Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 6iA44niklpPY8eELdTv9bL0Bi6ik2X/VuhYastQcv67nksGlPFRNNrWIhd97CMsk f32ZC/WzOMJftBSI0bopk3+yEg+xb1Wn+bB2GfDGqju24LesBUddx3GOE2d/eBw5 h1Vd5wyExM5pjDpEtS92Rs9SGemSHsEflQez5ussrbqJYX7blUKl3sz778kku1cr gSO+3eJk80cCsT6L5/WKADZs+sECYwbJr2y9LmX0araFdTgIBAdT7+8leTveTEvP luxdKCKECa5VhBfulIA4drP8skgPIfXuMSEoEbj8yzMsGeaMPoGmPT8Nh5IzZ/Bk Xp7D1tW/uddkqQAdgeTKcq62mDHwW14zUgaBSKuMYDrD66IpSK/+9tpVRn0998Uw jleQ3M/SvZQNzEt8A9smVAyeoldVlLqO5gFFiUHlYJd4s1o3g/0pQIPPjbStpiih k88/wTi/Sc+AkUlxDROQ3MNtxGkATzUGNQkqRJkLRcE3lU+ZXoS41qKNGf6lk+Va aWvXScKau43q9MH8R0JybVBwp5RLCsdxGUjYvaRRrJlyAbUi2OMejze3mgVC8N1O 5SrLwwGwtKMG5CPP1ywgTFF9qWOJjsXmGcBre7Q5OtcsTC/YlGa+gHcOs2SkTO6z ZhYsUQ9lzS4GQ0LIfdD8gXKNFiZa49t/hvs/v7OyrMluCQWwNj2TC6UdzXCvsOJ9 0uj+uu7P0VABUY6Jlh5L04aQo1+7EYiIvi5qRBzbNMTz9LOEPKTDWCJaB+uYV0EH 1aeVNm2/oAp6Yr6fdoElHDkTGheCEuUjT8gJXRukk1LMWrV3dbfgV+mnmxgSpA1s f5FBTvFEhQXn/LWCVptWnqgiwKlNk5pE/84eHbFw+qA1ostCU9TK8DMeJERJBuoa orBAM+xh9qh/le3ByopQkJTtAcuhb/FoLs09Qu92cGNVRU209TMN8C9RxEwQwiI3 uWlo3bRROvjahVyyiA94R758CJNH6USTK4bxdPYc2eo0gNyhK2KOc+iYDEvW4TEN R9oQYuQq8ocv8gWRFP7omuGIOuQcXapIhBh86tBtfTm9ZKAadZ7BG8W+EAFpDLhe +TxCEOnGvE/RXbmXVEEUat0f8Mhaj7cU/fFC5f3uKw96cnRKUb9Vf3ZWkqdoxKnW ST9PVpWujece/MB/3M2pzbybm9OMPGcHby/m1ETev/Ky1vriu2a93XbClp0NkSLa dsgkzAeBBIOAEtBrM5LLyEfpgKFZGfaC2llSWpFv6t7CuzagAniGG4s2Gx6CfVem 6mSf8IIoAZcDH3yOWky9rxCR ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/85E986F3615ED08D

http://decryptor.cc/85E986F3615ED08D

Targets

    • Target

      7cbc48d6ae9ecd184f501f7b6335c610.bat

    • Size

      216B

    • MD5

      f413de542b9c7ffad61e390a12df9530

    • SHA1

      f533e65ef43aa735f705c4e90453ab73191030a9

    • SHA256

      6404114463be10557553648d2adbd3fad665f24bdf9596ae4eac9b1c085728cd

    • SHA512

      ec5cc6220178daa514948eb3490643101495f69dcc9b73d0c8692a14107420e0f97fd34a7045d5479f905022e72ee835b62a375a33fde085e7f7732d3711e1a2

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks