General

  • Target

    yKWgfxGs.bat

  • Size

    194B

  • Sample

    200402-m524wvf3j6

  • MD5

    b1ff6dcf9f315d022a6401c4de7097d7

  • SHA1

    88343be4d54d374a1be5ccd095c0d913bda11a76

  • SHA256

    c60b9a2978335eff184b3fdb2c955136899de8c118b53f87a128687be7f1a17d

  • SHA512

    e44453250ed4f5fdb935a921e88c69b6a023814f9058a787c5d97a27b0f779ff09a8680073c253bab6b1b773a357c5a6b61c10bbcd05c709d26c0d0cbe6dc6fb

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/yKWgfxGs

Extracted

Path

C:\amid6299d9-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion amid6299d9. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8291F9CFA58D4290 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/8291F9CFA58D4290 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 8rfZSkVXU78E0F7avoMI/1dLYtDpZ3N/7K9Xy4ausrgmnfBMPrxOCbxErWiD4+Et jrHrc7cJA/V0N+2XxPStm0TNNR7eUFd/SPsdKX+WfRBdmx/yyTqCldJ+3t2W9KxU ZLlhapMfw+tdCHnokax2JNllqheobVunZxzyR0zOhe1QDW/I2QLsjMYSoZLehPAN VHq/0Y/SzNYY2gS4SnuaXiZZXFMRNqnDbEIrNlaZr/1qwvHzoaIJnJLdkyL8Z7gM K17W7S/7QOluOhqJqXtNtCqX7+dxCbBF7HM2LQLffKLLkl65wemMRNaFMxmVL4zd 9X2Tmv9sgN39872qGK7CfBzDw8F3fG8PO2yla56kz3zZ16vy7RYfjmRCjKBAdQjm qV5V3S/75qWTllIKfo3wh9Q8d1m6cz0JeC5tnNwm27PKMxFnO4O0kTyDFkXYRP+P 66qSih3ubJ6gGJ7geYhA+7Xu0ra5rAM1qVTU54fVs3IzZuaUA69y5OfYJeOpAQLm Fx1wHflsq+2XZaYM/m1hjRLgcVcdbPTSUCzKMlKzbBxryEiq1siUaTFKN+8cSFn8 LBfvFiNafH3oAi6wzi92AvmItGq1qpHkvXHsx48TNju8sW+fCCsemYpiqIqvVvcR niTR8/kKcAnyZcEkWn2U8s7jCo2+r5lcRUr0qSvYgQzQSOykp03YonEfhwp9fFmO XcsclgmPAevQM3T3pO642AYAvh7ygyhTgO3zTBl+dJKgoVdj9Fy4oZl5PkttFY7U vz/EiuMm7s0NmX4CpnQ9/FqSz7+Wlp7kK8PP8zR9Tnq2yG4DdeHxzK65F49h1bru 4FJxI7pgJxLWbwn0iHBPuX9ZyPJrrImSkTVM40exhuO6YturO48pdZ2CUh4ptmsW wIXpNN30yDVyeffRZzuVgOgshLdddXbMr/FzqO4in86UpS/H/rdxj/b+fCFMVu0K kdhSxhfPYQMivahn10fmu21pnDwYULEPySAneVah6fECULsRqsS/FmoFV3mN1bR3 lS4pdnt6Dc9r3da1T2s11x71+grzxGb7j2u8Q+OZHyg8atM3UjnPUL4D6hFxG7R/ U5WaKjSxTsUaiCjr/HnruaO+ftG53eQrAQ1i9HNc4n7F/HojzLv0+GfOZF79eqjd sIn6OJR56zrMgpFFdohkpFhd6iHc7N8g9A1gWWD+DEwbuRT9INHyhnDsx9fwVeOD BRh9VaQzqVP/+Nddsa9Zrv8+v44KIl/kVF105199iEIeFQKeauYtd3QBJMRPRr9S SKC/VSA4qX9FxDqEEIxchq1La4AOoaMomrsp1IWEcll7hA6+XyE= Extension name: amid6299d9 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8291F9CFA58D4290

http://decryptor.cc/8291F9CFA58D4290

Targets

    • Target

      yKWgfxGs.bat

    • Size

      194B

    • MD5

      b1ff6dcf9f315d022a6401c4de7097d7

    • SHA1

      88343be4d54d374a1be5ccd095c0d913bda11a76

    • SHA256

      c60b9a2978335eff184b3fdb2c955136899de8c118b53f87a128687be7f1a17d

    • SHA512

      e44453250ed4f5fdb935a921e88c69b6a023814f9058a787c5d97a27b0f779ff09a8680073c253bab6b1b773a357c5a6b61c10bbcd05c709d26c0d0cbe6dc6fb

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Program crash

    • Discovering connected drives

    • Modifies system certificate store

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

3
T1112

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Impact

Defacement

1
T1491

Tasks