Overview

overview

10

Static

static

10

evil.exe

windows7_x64

10

evil.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    evil.exe

  • Size

    157KB

  • MD5

    cbf729eace9735977cf545be8f37a28f

  • SHA1

    a247e58c2671283b0889db953af284517d75668b

  • SHA256

    80bbe933cc68fd5837b0ba84f17b9f796918125c52321d3d504468e837239765

  • SHA512

    115f1f3ae9900eda0d1c19fdb7b7a35d0cf4392831a54190c9c51ffe67463f888a58a4ce4edfd8cea72bd4359be755e82f5b1a6d1ccc2a324b8db37e95b32bb9

Score
10/10
sodinokibi

Malware Config

Extracted

Family

sodinokibi

C2

sjtpo.org

baptistdistinctives.org

ideamode.com

unboxtherapy.site

yourhappyevents.fr

mesajjongeren.nl

suonenjoen.fi

utilisacteur.fr

grafikstudio-visuell.de

elitkeramika-shop.com.ua

bulyginnikitav.000webhostapp.com

netadultere.fr

phoenixcrane.com

successcolony.com.ng

schroederschoembs.com

aberdeenartwalk.org

patassociation.com

alpesiberie.com

arearugcleaningnyc.com

golfclublandgoednieuwkerk.nl
Attributes
  • pid

    18

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} c) Open our secondary website: http://decryptor.top/{UID} When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    37

Signatures

  • Sodinokibi/Revil sample 1 IoCs
  • Sodinokibi family
    sodinokibi

Files

  • evil.exe
    .exe windows x86