Overview

overview

10

Static

static

10

fa52e9a0f3...b9.dll

windows7_x64

6

fa52e9a0f3...b9.dll

windows10_x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fa52e9a0f3ea72b98d34fd2ebb6f6cf57944e3e5e535add59213f0fc2cb612b9

  • Size

    164KB

  • Sample

    220124-a1m9tsghc7

  • MD5

    2fa5c892e8c030dc128a2c94e67a69e3

  • SHA1

    8fc5d2fc29fc1a7d0824bbf300f98b26741e7156

  • SHA256

    fa52e9a0f3ea72b98d34fd2ebb6f6cf57944e3e5e535add59213f0fc2cb612b9

  • SHA512

    70b2287921c7bf5f024c5ec01c0ea2e9464f31241e186b85fed74bf8c67ec7a50738b2e1ab7b019b8b7433e09ed3a071420a86e29294aa0dae30ffd16406b3bb

Score
10/10
sodinokibi251300

Malware Config

Extracted

Family

sodinokibi

Botnet

25

Campaign

1300

C2

cp-bap.de

prometeyagro.com.ua

stabilisateur.fr

watchsale.biz

adabible.org

aquacheck.co.za

yournextshoes.com

onlinemarketingsurgery.co.uk

creohn.de

zwemofficial.nl

bilius.dk

aoyama.ac

bychowo.pl

haus-landliebe.de

wademurray.com

worldproskitour.com

c-sprop.com

poems-for-the-soul.ch

brisbaneosteopathic.com.au

renehartman.nl
Attributes
  • net

    true

  • pid

    25

  • prc

    dbeng50

    encsvc

    thebat

    mspub

    onenote

    outlook

    xfssvccon

    winword

    ocautoupds

    agntsvc

    oracle

    firefox

    dbsnmp

    isqlplussvc

    ocomm

    powerpnt

    sqbcoreservice

    wordpa

    synctime

    sql

    visio

    tbirdconfig

    excel

    thunderbird

    mydesktopservice

    msaccess

    steam

    ocssd

    mydesktopqos

    infopath

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    1300

  • svc

    veeam

    sql

    mepocs

    sophos

    svc$

    memtas

    backup

    vss

Targets

    • Target

      fa52e9a0f3ea72b98d34fd2ebb6f6cf57944e3e5e535add59213f0fc2cb612b9

    • Size

      164KB

    • MD5

      2fa5c892e8c030dc128a2c94e67a69e3

    • SHA1

      8fc5d2fc29fc1a7d0824bbf300f98b26741e7156

    • SHA256

      fa52e9a0f3ea72b98d34fd2ebb6f6cf57944e3e5e535add59213f0fc2cb612b9

    • SHA512

      70b2287921c7bf5f024c5ec01c0ea2e9464f31241e186b85fed74bf8c67ec7a50738b2e1ab7b019b8b7433e09ed3a071420a86e29294aa0dae30ffd16406b3bb

    Score
    6/10

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks