Overview

overview

10

Static

static

10

78fa32f179...bf.dll

windows10_x64

1

Resubmissions

06-08-2021 11:11

210806-1xr98yl812 10

06-08-2021 11:03

210806-76frfeflls 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5984073059303424.zip

  • Size

    121KB

  • Sample

    210806-1xr98yl812

  • MD5

    5e484d8c9b5ef3823fe8ac74b9bbfdc6

  • SHA1

    1b06eb047618228bdac923007488f493129cc825

  • SHA256

    b145e08da9f0318978efaf2f39738c3786b8efa2f90e3a592c9fdf1c8f00e3d6

  • SHA512

    0c8b6557a29eda04c33c695c251aa7768175702411ea934b400b86d7fcee82c338dbb2acdcb97b3e1006fdd4a533f29de5d245b4fb78cfdbad80b36d5f56482f

Score
10/10
sodinokibi21707

Malware Config

Extracted

Family

sodinokibi

Botnet

21

Campaign

707

C2

marmarabasin.com

hartofurniture.com

klapanvent.ru

hiddensee-buhne11.de

tilldeeke.de

chris-anne.com

nalliasmali.net

ultimatelifesource.com

druktemakersheerenveen.nl

buerocenter-butzbach-werbemittel.de

advesa.com

skooppi.fi

rubyaudiology.com

abulanov.com

michaelfiegel.com

mercadodelrio.com

paradigmlandscape.com

boloria.de

neolaiamedispa.com

lgiwines.com
Attributes
  • net

    true

  • pid

    21

  • prc

    ocomm

    excel

    dbsnmp

    onenote

    firefox

    xfssvccon

    infopath

    wordpa

    isqlplussvc

    dbeng50

    mspub

    mydesktopqos

    ocautoupds

    thunderbird

    encsvc

    outlook

    oracle

    mydesktopservice

    thebat

    agntsvc

    steam

    ocssd

    sql

    tbirdconfig

    synctime

    visio

    sqbcoreservice

    winword

    msaccess

    powerpnt

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    707

  • svc

    backup

    mepocs

    memtas

    veeam

    svc$

    vss

    sophos

    sql

Targets

    • Target

      78fa32f179224c46ae81252c841e75ee4e80b57e6b026d0a05bb07d34ec37bbf

    • Size

      164KB

    • MD5

      3cae02306a95564b1fff4ea45a7dfc00

    • SHA1

      0ce2cae5287a64138d273007b34933362901783d

    • SHA256

      78fa32f179224c46ae81252c841e75ee4e80b57e6b026d0a05bb07d34ec37bbf

    • SHA512

      5c9aa3ed6bf80c2478595504a6f4be50c436798f98852c8dc8b331443a07f9baf018fb36ce0326570901544f62ec9a376d7ef2cd98b1036bea4e27bd64fd8fee

    Score
    1/10
    behavioral1

MITRE ATT&CK Matrix

Tasks