Overview

overview

10

Static

static

10

fd164c4c12...87.exe

windows7_x64

10

fd164c4c12...87.exe

windows10_x64

10

Resubmissions

23-08-2021 11:12

210823-681sdqb6fx 10

29-06-2021 23:44

210629-4zlddtzv5e 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fd164c4c121371f94cfd3a034ad8cf8edc7c0f7141a8f4c9da1683d41b212a87.zip

  • Size

    78KB

  • MD5

    53f1f7a531078d0767f395bfea173ed0

  • SHA1

    eab1314d6eb2c151787c7a3f3a7f1ea07d866702

  • SHA256

    ea08f7dece6892fe78f6e62f5b5309dd8d436a1be6983787e90ed4374d15115d

  • SHA512

    8db7800527e75da7929617248f0a05e76bd867bb53243628b1bacd0e80cbce41a3001a344947fb5fa0714ea65a5afbf06868402671b6edd441d82697645614a5

Score
10/10
$2a$12$irtgrp4st4hecwxrwl..xopjvjswkoa8t9n/dm/out9ro.fiqszcu7901sodinokibi

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$12$irtGRP4st4HecwXrwL..XOpjvJSwKoA8t9N/dM/oUt9RO.fiQsZCu

Campaign

7901

C2

freie-baugutachterpraxis.de

centromarysalud.com

the-domain-trader.com

punchbaby.com

heliomotion.com

executiveairllc.com

milltimber.aberdeen.sch.uk

tradiematepro.com.au

jacquin-maquettes.com

mediaacademy-iraq.org

portoesdofarrobo.com

cimanchesterescorts.co.uk

thaysa.com

ussmontanacommittee.us

rerekatu.com

journeybacktolife.com

videomarketing.pro

i-trust.dk

pmcimpact.com

kingfamily.construction
Attributes
  • net

    true

  • pid

    $2a$12$irtGRP4st4HecwXrwL..XOpjvJSwKoA8t9N/dM/oUt9RO.fiQsZCu

  • prc

    firefox

    dbsnmp

    excel

    isqlplussvc

    onenote

    outlook

    agntsvc

    thunderbird

    powerpnt

    mspub

    xfssvccon

    tbirdconfig

    sql

    winword

    infopath

    ocautoupds

    dbeng50

    ocssd

    encsvc

    wordpad

    sqbcoreservice

    thebat

    synctime

    msaccess

    steam

    oracle

    mydesktopservice

    ocomm

    visio

    mydesktopqos

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- We strongly encourage You to pay your attention to this message and read it to the end. All Your files are encrypted, and currently unavailable, now all files on your system has extension {EXT} Before that, all of your most important personal and business files were backed up to our secure offline storage. We took them for temporary storage - but we don't need your files and we are not personally interested in your business. Our encryption algorithm is the most technically difficult and max resistant to burglary. Only OUR specialists can decrypted your files without loss(!) Any attempts to decrypt files on your own lead to damage them beyond repair(!) Best way to you will be consent to negotiations and mutual agreement between us. To connect us you need to download TOR browser and follow the link to begin negotiations.(You can find full instructions below.) We are waiting You and ready to listen all your offers and discuss them. If You will ignore this letter - we will have to sell closed auction all yours private files, photoes, business correspondence, documents and business files + with our analysis of your work activity (weakness of your business, financial violations and the opportunity to profit from this information). It will offset our financial losses. Or we'll just put all your files in the public domain, where everyone can download and use them as they wish. * For TOR Browser http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/ We are known as "Sodinokibi (REvil) Ransomware". For example, this article: https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread You have a guarantee that your files will be returned 100 %. And remember, this is only business, nothing personal.. We have a concept of business honor, and we can promise something if we come to a mutual agreement: 1. We guarantee to decrypt all your files in the shortest possible time 2. We will delete all your files and forget about your company. 3. We will show your weaknesses in your networks. .-= INSTRUCTIONS TO CONNECT =-. How to get access on website? You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ---------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all your data!

  • sub

    7901

  • svc

    vss

    svc$

    veeam

    memtas

    sql

    backup

    mepocs

    sophos

Signatures

Files

  • fd164c4c121371f94cfd3a034ad8cf8edc7c0f7141a8f4c9da1683d41b212a87.zip
    .zip

    Password: infected

  • fd164c4c121371f94cfd3a034ad8cf8edc7c0f7141a8f4c9da1683d41b212a87.exe
    .exe windows x86