sodinokibi | 939f58c10211a768f664a8f54310dcc42eb672887be61d5d377b5a88be107b9d[.]bin[.]sample

Sharing

Copy URL

Twitter E-mail

General

Target

939f58c10211a768f664a8f54310dcc42eb672887be61d5d377b5a88be107b9d.bin.sample
Size

120KB
MD5

9a24b3de7af3b2a2f1917e72e64da268
SHA1

783bebb04eda5a88851aa741133ae49c29f44415
SHA256

939f58c10211a768f664a8f54310dcc42eb672887be61d5d377b5a88be107b9d
SHA512

631b8165326463749e8bb01e74304343158b4cd4c6c4e4a8e60922a298b90dab9c83c60fd69c4eda8ddf2dcf97c4040dc723f7e9beeb9a94aee568c30867044d

Score

10^/10

$2a$10$m5nsh9.khwyca0s51cph1.jeujldaak5p6gaudnlafhmsjqgsufra 7089 sodinokibi

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$m5NsH9.kHWycA0s51cPH1.jeUjLDAAK5P6GAUDnLAfhMsJQGSUFra

Campaign

7089

sandd.nl

webmaster-peloton.com

danskretursystem.dk

justinvieira.com

interactcenter.org

imperfectstore.com

theduke.de

digi-talents.com

innote.fi

collaborativeclassroom.org

atozdistribution.co.uk

elimchan.com

evergreen-fishing.com

beautychance.se

olejack.ru

devstyle.org

lachofikschiet.nl

slimidealherbal.com

henricekupper.com

n1-headache.com

Attributes

net
false
pid
$2a$10$m5NsH9.kHWycA0s51cPH1.jeUjLDAAK5P6GAUDnLAfhMsJQGSUFra
prc
mydesktopservice
powerpnt
excel
encsvc
thunderbird
avgadmsv
msaccess
oracle
dbsnmp
lmibackupvssservice
mspub
kavfswp
Rtvscan
BackupUpdater
kavfs
ShadowProtectSvc
TSSchBkpService
onenote
dbeng50
ocomm
NSCTOP
ocautoupds
infopath
Sage.NA.AT_AU.SysTray
SPBBCSvc
kavfsscs
DLOAdminSvcu
mydesktopqos
AmitiAvSrv
klnagent
CarboniteUI
sql
isqlplussvc
xfssvccon
thebat
firefox
ocssd
dlomaintsvcu
agntsvc
synctime
outlook
LogmeInBackupService
ccSetMgr
BackupExtender
sqbcoreservice
tbirdconfig
Microsoft.exchange.store.worker.exe
BackupMaint
BackupAgent
steam
ccSvcHst
Smc
winword
visio
wordpad
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). =========Attention!!!========= Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. ============================== [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
sub
7089
svc
AzureADConnectAuthenticationAgent
memtas
"swi_service"
SQLTELEMETRY$SQLEXPRESS
SSASTELEMETRY
Microsoft.exchange.store.worker.exe
mfemms
Telemetryserver
"Sophos System Protection Service"
Altaro.OffsiteServer.Service.exe
AltiPhoneServ
bedbg
VeeamMountSvc
Altaro.SubAgent.N2.exe
"SQLServer Analysis Services (MSSQLSERVER)"
SQLTELEMETRY$MSGPMR
HuntressAgent
"ofcservice"
MSSQL$QM
SQLAgent$MSGPMR
"SAVService"
sppsvc
MySQL
masvc
KAENDCHIPS906995744173948
AzureADConnectHealthSyncMonitor
MSSQL$SQLEXPRESSADV
TMBMServer
Altaro.SubAgent.exe
ds_notifier
VeeamDeploymentService
klnagent
veeam
msseces
LTSvcMon
MSSQL$SQLEXPRESS
MSSQL$HPWJA
"Sophos Web Control Service"
ADSync
MSSQLFDLauncher$SQLEXPRESS
"Sage.NA.AT_AU.Service"
MSSQLTESTBACKUP02DEV
KACHIPS906995744173948
Amsp
"ds_agent"
mfevtp
SQLAgent$SQLEXPRESS
"swi_filter"
"Sage 100cloud Advanced 2020 (9920)"
ALTIVRM
vss
SQLBrowser
"Sophos MCS Client"
"SophosFIM"
MSSQLFDLauncher
MBAMService
"ThreadLocker"
VeeamEndpointBackupSvc
SQLSERVERAGENT
AltiBack
"SAVAdminService"
tmlisten
SBAMSvc
AltiCTProxy
AzureADConnectAgentUpdater
"SQLServer Reporting Services (MSSQLSERVER)"
mysqld
ds_monitor
sql
ofcservice
"Sophos Clean Service"
mfewc
LTService
"Amsp"
"TeamViewer"
BackupExecAgentAccelerator
mepocs
VeeamNFSSvc
"Sophos Safestore Service"
MsDtsServer120
svcGenericHost
MsDtsServer110
AUService
backup
SQLTELEMETRY
AzureADConnectHealthSyncInsights
MsDtsServer130
ReportServer
Altaro.HyperV.WAN.RemoteService.exe
ProtectedStorage
SSISTELEMETRY130
VeeamTransportSvc
Altaro.Agent.exe
MSSQLSERVER
sqlservr
KaseyaAgent
"SQLServer Integration Services 12.0"
ntrtscan
"StorageCraft Raw Agent"
TmCCSF
sophos
ds_agent
MSSQLServerADHelper100
VeeamHvIntegrationSvc
"Sage 100c Advanced 2017 (9917)"
"SntpService"
McAfeeFramework
"StorageCraft ImageReady"
VSS
KaseyaAgentEndpoint
HuntressUpdater
VeeamDeploySvc
"Sophos AutoUpdate Service"
"Sophos MCS Agent"
KAVFS
SQLWriter
MSSQLFDLauncher$TESTBACKUP02DEV
svc$
MSSQL$MSGPMR
psqlWGE
Altaro.DedupService.exe
"Sophos Health Service"
SQLEXPRESSADV
"ProtectedStorage"
kavfsscs
sophossps
"ds_monitor"
TeamViewer
ThreadLocker
MSSQLServerOLAPService
Altaro.OffsiteServer.UI.Service.exe
MSSQLLaunchpad$SQLEXPRESS
Code42Service
Altaro.UI.Service.exe
"Sophos File Scanner Service"
macmnsvc
"ds_notifier"
ViprePPLSvc
AltiFTPUploader
"Sophos Endpoint Defense Service"
VipreAAPSvc
DsSvc
"Sophos Device Control Service"
"StorageCraft Shadow Copy Provider"

Signatures

Sodinokibi family
sodinokibi

Files

939f58c10211a768f664a8f54310dcc42eb672887be61d5d377b5a88be107b9d.bin.sample
.exe windows x86