Overview

overview

10

Static

static

10

2df2fab33c...8c.exe

windows7_x64

1

2df2fab33c...8c.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.zip

  • Size

    75KB

  • MD5

    7029552406bd2ddb472dd3ee681d977e

  • SHA1

    573263fb6208090e7c6565ed5ae64868e319ce0d

  • SHA256

    096a57887cb1a281f9626b2df47666422a34bdc995c9693ae0ecad8b015945a8

  • SHA512

    4071b35650145e95149bfb2a4b64a955371189520af16c00b8345f699b963c4903c2bd7cb7d5762f31462e957142781ce4876b3dccef73f04a8aed11942909b1

Score
10/10
$2a$10$tnj5upbgemq8lwxqrs0q6eumbqptm4rdy1lwlnldtunnxggalexyq7138sodinokibi

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$TnJ5upBgemQ8LWXqRs0q6eumBqPTM4Rdy1lwLnlDTUNNXgGALExYq

Campaign

7138

C2

ianaswanson.com

klimt2012.info

dinslips.se

fotoscondron.com

gadgetedges.com

luckypatcher-apkz.com

bundabergeyeclinic.com.au

perbudget.com

verbisonline.com

hashkasolutindo.com

sinal.org

remcakram.com

zervicethai.co.th

cirugiauretra.es

securityfmm.com

profectis.de

hihaho.com

roadwarrior.app

brigitte-erler.com

urmasiimariiuniri.ro
Attributes
  • net

    true

  • pid

    $2a$10$TnJ5upBgemQ8LWXqRs0q6eumBqPTM4Rdy1lwLnlDTUNNXgGALExYq

  • prc

    kavfs

    agntsvc

    firefox

    Sage.NA.AT_AU.SysTray

    avgadmsv

    kavfswp

    mspub

    CarboniteUI

    mydesktopservice

    NSCTOP

    BackupUpdater

    mydesktopqos

    ccSvcHst

    lmibackupvssservice

    AmitiAvSrv

    tbirdconfig

    winword

    BackupMaint

    encsvc

    ShadowProtectSvc

    ocomm

    dlomaintsvcu

    LogmeInBackupService

    dbeng50

    oracle

    outlook

    synctime

    xfssvccon

    steam

    ocssd

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] Attention!!! [+] Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    7138

  • svc

    swi_filter

    svcgenerichost

    ds_notifier

    ofcservice

    reportserver

    auservice

    storagecraft

    bedbg

    ds_agent

    sql

    huntressagent

    protectedstorage

    ssistelemetry

    vss

    sophos

    mbamservice

    altiftpuploader

    ltservice

    vipreaapsvc

    mfewc

    altivrm

    kavfs

    mepocs

    kaseyaagentendpoint

    kaseyaagent

    ds_monitor

    mfemms

    altaro

    dssvc

    sppsvc

Signatures

Files

  • 2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.zip
    .zip

    Password: infected

  • 2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
    .exe windows x86