sodinokibi | c5fe12bdf192101aa298a324a7fed6410aaac997ccdc4f97bd2a7fa66faa547e

General

Target

4979965338746880.zip
Size

121KB
Sample

210806-nryv4jdnhn
MD5

7919aeefc0b30647af8c09c589b6c958
SHA1

7d756c32f7ec555137ea1f1bd9be459ff599b677
SHA256

c5fe12bdf192101aa298a324a7fed6410aaac997ccdc4f97bd2a7fa66faa547e
SHA512

1de16a0724c79ec80701ada362561f778f5d4227817fb82eef0dfa453803f4a4f3ccccdde450107bbfd6e80b9f8828959fae0a667280c1a60000f2b4933ef9e1

Score

10^/10

sodinokibi 39 1332

Malware Config

Extracted

Family

sodinokibi

Botnet

39

Campaign

1332

C2

wyreforest.net

clemenfoto.dk

centuryvisionglobal.com

ruggestar.ch

furland.ru

rechtenplicht.be

innovationgames-brabant.nl

acumenconsultingcompany.com

pedmanson.com

stressreliefadvice.com

lsngroupe.com

sshomme.com

tetameble.pl

optigas.com

skidpiping.de

hekecrm.com

corporacionrr.com

albcleaner.fr

ddmgen.com

katherinealy.com

Attributes

net
true
pid
39
prc
sql
dbsnmp
mydesktopqos
ocautoupds
firefox
msaccess
sqbcoreservice
synctime
tbirdconfig
xfssvccon
infopath
powerpnt
excel
visio
encsvc
ocssd
onenote
isqlplussvc
mspub
wordpa
agntsvc
steam
thunderbird
thebat
ocomm
winword
oracle
outlook
dbeng50
mydesktopservice
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
sub
1332
svc
svc$
sql
veeam
sophos
memtas
mepocs
backup
vss

Targets

- Target
  
  2ca64feaaf5ab6cf96677fbc2bc0e1995b3bc93472d7af884139aa757240e3f6
- Size
  
  164KB
- MD5
  
  6e3efb83299d800edf1624ecbc0665e7
- SHA1
  
  0bd22f204c5373f1a22d9a02c59f69f354a2cc0d
- SHA256
  
  2ca64feaaf5ab6cf96677fbc2bc0e1995b3bc93472d7af884139aa757240e3f6
- SHA512
  
  dd1675bb15eb8ea2933b25413271117823ad7ff38280e7f552b5201e3a5bef8607a2112df2e24f598449ebfdb570ff9458aba0314ed8819dd4d774ea855e9ad2
Score

10^/10
- Suspicious use of NtCreateProcessExOtherParentProcess
behavioral1