sodinokibi | f0c60f62ef9ffc044d0b4aeb8cc26b971236f24a2611cb1be09ff4845c3841bc

General

Target

f0c60f62ef9ffc044d0b4aeb8cc26b971236f24a2611cb1be09ff4845c3841bc
Size

157KB
Sample

220124-a3nclsghf8
MD5

65aa793c000762174b2f86077bdafaea
SHA1

95a21e764ad0c98ea3d034d293aee5511e7c8457
SHA256

f0c60f62ef9ffc044d0b4aeb8cc26b971236f24a2611cb1be09ff4845c3841bc
SHA512

d1667d0aca264ae7ba0f3da04baf55af6d94230de549b087812080b8e71d6dc782e4aefd84a3ef9b17729a8f03de91be5ed07f40e1e4d4420c5811fb50f54362

Score

10^/10

Family

sodinokibi

Botnet

8

Campaign

10

C2

imajyuku-sozoku.com

www.marcandy.com

benchbiz.com

yayasanprimaunggul.org

premiumweb.com.ua:443

ddmgen.com

jandhpest.com

designimage.ae

zinnystar.com

www.blucamp.com

www.beandrivingschool.com.au

www.sppdstats.com

omegamarbella.com

www.albcleaner.fr

parksideseniorliving.net

ntinasfiloxenia.gr

krishnabrawijaya.com

brownswoodblog.com

www.thiagoperez.com

lmmont.sk

Attributes

net
true
pid
8
prc
mysql.exe
ransom_oneliner
Your computer have been infected! Read the {EXT}-readme.txt file for more information.
ransom_template
Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got {EXT} extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/{UID} Page will ask you for the key and extension name: {EXT}. Your key code: {KEY}
sub
10