General

  • Target

    7d1eec1c6975c5a77516623c815be642.bat

  • Size

    221B

  • Sample

    201018-y9vc49z5ha

  • MD5

    48add727eaae6f420a9c27eb1d60e60b

  • SHA1

    b6963e1cd892f7b1ef4fb1328675a7bdb54b848e

  • SHA256

    445563cddcd7872b33085dee21623dfafe822daa94dff0eecb32fd8fe409c31c

  • SHA512

    f1e1a38ec0e9565df933e46ba35f15a841d5352f699ca6e995226cfb31d5486ea1f044d05ec5e93234ef8f8726b164cad3bba2b3dfba281089d70527822f8805

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://185.103.242.78/pastes/7d1eec1c6975c5a77516623c815be642

Extracted

Path

C:\6sqbpj9r-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 6sqbpj9r. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). We have copied financial files and other important information about personal data, it will be published on the Internet or will be used against you if you do not pay us, so if you do not want such consequences as customer churn, media coverage, fines like GDRP and other damages, we recommend you to contact us and pay the ransom. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B9D15C2C4EA8CCAF 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/B9D15C2C4EA8CCAF Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 9zcFlMQuhDDTxE//7V0LLYqqxUCkIJWgbBaQ9g5TeYz5+aCTKngO9pZJ2T9N79W9 S1tR7H7YY9LDru1a99RNJX6Mqqjx/fEeRHuR7kWgMyU2yvF+Pj9mqVlyvCw2pqYK LyjIOlMyMY1Rwx4CaNGB96hYF0zPT3E3ciQ8/fg0hyxP2nTrew/C9FdTkppJyC+s Z3Ks8IJdBwpJ4F9O1Y+kCL4O6CZbIfgM7qEOxMZ8TSqJOg+d3DVwK7rGecmi3g4Q xqkgNOQsO5eBHFx/DUFNG1vMfaT+seIkumxQLh/a/UsSUDy30TsYWA7esEQxgMBx ZC5KrDTnqHiKRd9qBrQVGtrjmjPMHxT4ktucpLqz/ro9lZM7EUuXlPgd6jpBSLj5 uEAkQysdLYbtbg8nBCxA+dU0KR64z3qJrhTHZsnIjmxUGmco5fKOE1hk0CorUoSI Hxjy6gIAXaPUlYhVABzLUJvVrOaYffXj2qugf+bkHDDfMBZVJVGWKJJg+uggb3JU RlXqQtzQJZO2umoag4394UEVf3umksY1sbnuLrfdR1Qsc0MBfSGIRR9+h5FyDhwr zh+CWFId8qLiH82n9LUbiY8UMfrLyq0DEYYIHJC2bDn5VHycqlVCik8a43qjqjL6 XfpLiiMqAWkEgJkE/qozwmA/jfBuYIsz7EbOjkAwcJ59xV1a/GpAcqqtCDSFtvOu LT9oeE3kwAp0GhFac5ts/Q5AIHiDsrFHyb70voItzJ3X8hnXwvoqjeHOWrDm7rat rHbk7v8FpZAXHhUmaUBkC53p+anA3/dwffQVhk+UqHw4PILfCk4lQq4HPRIkpxYB Blq6YbkyRsJoTT/tSpdSfXWvCj/HlKF1DmZEgNAD/o6b1rCq1NLumYPgmhSQNtJj kZ75DpnIG40kd1fNxOgfolWu4dof8LyZeMRz2+8heS88XsHtqRCIwfd/MutJkozZ zzRlKuRnmHflUmFkgxvP1w9K2vDKOjjqEiXzezVmNPqtOrus3w5ORVbzAuU9hR3v LqGbQwEzveI+g9S3mUlYyRleR15kHCV0gI0+drhv1m6XfMYI1Mn/W7yuZcNgkq8q td/GKrEzrhJ8dR5y4RBxEkfsUFjj4E51BlmVH2Yhnuie1THOVNsc3HC5J+QlsEuf i5yhRA+h+p9dRjP7TSmjIq/DFz6XyQIuQlFQ3ZEjOkQfDV/HrnDPqlLkXxbNyjrH BlE53I7S/U3OBdjeT2MgNwsHdrZ8ZfxnaKkMSsuZrPzpRHOWg4LlufSNI8cxusot bFeMsMws+6xr9eYXKjyRdVNBuZA= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B9D15C2C4EA8CCAF

http://decryptor.cc/B9D15C2C4EA8CCAF

Targets

    • Target

      7d1eec1c6975c5a77516623c815be642.bat

    • Size

      221B

    • MD5

      48add727eaae6f420a9c27eb1d60e60b

    • SHA1

      b6963e1cd892f7b1ef4fb1328675a7bdb54b848e

    • SHA256

      445563cddcd7872b33085dee21623dfafe822daa94dff0eecb32fd8fe409c31c

    • SHA512

      f1e1a38ec0e9565df933e46ba35f15a841d5352f699ca6e995226cfb31d5486ea1f044d05ec5e93234ef8f8726b164cad3bba2b3dfba281089d70527822f8805

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks