sodinokibi | 17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4

Sharing

Copy URL

Twitter E-mail

General

Target

17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4
Size

115KB
MD5

f4197dd28646000528e651ee1aead23a
SHA1

7b1b259c0b84cae045f02c1d17154673141b6947
SHA256

17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4
SHA512

5b97ed21b885f0f2c6db8c35d27dbd0bfd1e0f1b5e34d566556db9ffe6f7cb38a2c639d8281e9a8798dd31ef9b4075cb57c98fef7243a9a9795c8c8adfe393df

Score

10^/10

$2a$10$ctl6mpbcozzcr.aru3gxp.pcftg0jof6upmmrky0hc0o.x.alltz.4085 sodinokibi

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$CtL6MpBCOZZcR.aRU3GXp.pcFtg0joF6uPmmrKY0hC0o.x.alLtZ.

Campaign

4085

sandd.nl

digivod.de

southeasternacademyofprosthodontics.org

resortmtn.com

mdk-mediadesign.de

tetinfo.in

fayrecreations.com

ecpmedia.vn

physiofischer.de

highlinesouthasc.com

antenanavi.com

blog.solutionsarchitect.guru

deepsouthclothingcompany.com

coursio.com

quickyfunds.com

atmos-show.com

pawsuppetlovers.com

hokagestore.com

midmohandyman.com

mmgdouai.fr

Attributes

net
true
pid
$2a$10$CtL6MpBCOZZcR.aRU3GXp.pcFtg0joF6uPmmrKY0hC0o.x.alLtZ.
prc
sqbcoreservice
dbsnmp
mydesktopservice
outlook
ocomm
excel
mydesktopqos
isqlplussvc
onenote
tbirdconfig
msaccess
encsvc
infopath
steam
thebat
agntsvc
sql
visio
wordpad
winword
dbeng50
powerpnt
firefox
xfssvccon
mspub
oracle
thunderbird
ocssd
synctime
ocautoupds
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
sub
4085
svc
memtas
mepocs
backup
sophos
sql
svc$
veeam
vss

Signatures

Sodinokibi family
sodinokibi

Files

17a54bd46e7815b74ccb29af6a836dda52b63d5ae46b51c941f93aeca5eb2ec4
.exe windows x86