Overview

overview

10

Static

static

10

42438a6763...35.exe

windows7_x64

1

42438a6763...35.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    42438a67636a6981b4e3209449040f6b393f10fe0636dfca2260fc0f4271e135.zip

  • Size

    74KB

  • MD5

    933e0f0dfbf9904aaf42c62ab3d12d87

  • SHA1

    97bbf6cb81565e41011cf644456fc11cc134c7a0

  • SHA256

    eaf694487564111633c2126f02f8608fb1facab7fcf8c65dac4b0198462dad54

  • SHA512

    825f243507b3c1cefbc2048d14c5b8cb6e9ae92e04f4ca8bc5000b6bbbd0c6b0df89a7219c13631b83dfb89afbe5e359f68d8212341dbdb7a5b664d5c955ae40

Score
10/10
$2a$12$8rdjpkhsbcl4to.cuojftolgy5u2urywif4abgxs9hxobz/zu0iia7337sodinokibi

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$12$8RdjpkhSbCl4TO.CuojftOLGy5U2uRywIf4AbgXS9HXOBZ/zU0Iia

Campaign

7337

C2

fiscalsort.com

filmstreamingvfcomplet.be

corelifenutrition.com

bargningavesta.se

elimchan.com

jolly-events.com

bierensgebakkramen.nl

amylendscrestview.com

calabasasdigest.com

fizzl.ru

myzk.site

jerling.de

faronics.com

schoolofpassivewealth.com

balticdentists.com

vorotauu.ru

katiekerr.co.uk

centuryrs.com

schmalhorst.de

daklesa.de
Attributes
  • net

    false

  • pid

    $2a$12$8RdjpkhSbCl4TO.CuojftOLGy5U2uRywIf4AbgXS9HXOBZ/zU0Iia

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    7337

Signatures

Files

  • 42438a67636a6981b4e3209449040f6b393f10fe0636dfca2260fc0f4271e135.zip
    .zip

    Password: infected

  • 42438a67636a6981b4e3209449040f6b393f10fe0636dfca2260fc0f4271e135.exe
    .exe windows x86