Overview

overview

10

Static

static

10

file.dll

windows7_x64

1

file.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file

  • Size

    164KB

  • MD5

    0192dd37e2473913dddf82b3912f928e

  • SHA1

    d4ca6df549db7bb747ba63df70720cea68679b07

  • SHA256

    b7ae1fa5ac7ee65dffd93e9defd51b2e39a1030620560fe9eff51315e75c8885

  • SHA512

    939e359de10339bdf5a23990bc76e41a82d199a425931ceb0c2870babdb2204dd3dad567801e8be45d1df9500d438fe30b8b1274c7c785b64846e919b2f2c88c

Score
10/10
sodinokibi

Malware Config

Extracted

Family

sodinokibi

C2

mondolandscapes.com

frankgoll.com

peninggibadan.co.id

invela.dk

g2mediainc.com

yourcosmicbeing.com

phukienbepthanhdat.com

dinedrinkdetroit.com

sarahspics.co.uk

parentsandkids.com

makingmillionaires.net

nexstagefinancial.com

so-sage.fr

advance-refle.com

ziliak.com

metroton.ru

aceroprime.com

designimage.ae

jonnyhooley.com

plbinsurance.com
Attributes
  • pid

    28

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    1819

Signatures

Files

  • file
    .dll windows x86