Overview

overview

10

Static

static

10

f0c60f62ef...bc.exe

windows7_x64

10

f0c60f62ef...bc.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f0c60f62ef9ffc044d0b4aeb8cc26b971236f24a2611cb1be09ff4845c3841bc

  • Size

    157KB

  • MD5

    65aa793c000762174b2f86077bdafaea

  • SHA1

    95a21e764ad0c98ea3d034d293aee5511e7c8457

  • SHA256

    f0c60f62ef9ffc044d0b4aeb8cc26b971236f24a2611cb1be09ff4845c3841bc

  • SHA512

    d1667d0aca264ae7ba0f3da04baf55af6d94230de549b087812080b8e71d6dc782e4aefd84a3ef9b17729a8f03de91be5ed07f40e1e4d4420c5811fb50f54362

  • SSDEEP

    1536:LGSo+/qur6qn9oOP9LhpbW3ox7Pbi4eTMluxtXDCntTnICS4AKseeVEZKUlk3OB:F6woOP9LDdLbi4eTMlwDCnuko7akcf

Score
10/10
810sodinokibi

Malware Config

Extracted

Family

sodinokibi

Botnet

8

Campaign

10

C2

imajyuku-sozoku.com

www.marcandy.com

benchbiz.com

yayasanprimaunggul.org

premiumweb.com.ua:443

ddmgen.com

jandhpest.com

designimage.ae

zinnystar.com

www.blucamp.com

www.beandrivingschool.com.au

www.sppdstats.com

omegamarbella.com

www.albcleaner.fr

parksideseniorliving.net

ntinasfiloxenia.gr

krishnabrawijaya.com

brownswoodblog.com

www.thiagoperez.com

lmmont.sk
Attributes
  • net

    true

  • pid

    8

  • prc

    mysql.exe

  • ransom_oneliner

    Your computer have been infected! Read the {EXT}-readme.txt file for more information.

  • ransom_template

    Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got {EXT} extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/{UID} Page will ask you for the key and extension name: {EXT}. Your key code: {KEY}

  • sub

    10

Signatures

  • Sodinokibi family
    sodinokibi
  • Sodinokibi/Revil sample 1 IoCs

Files

  • f0c60f62ef9ffc044d0b4aeb8cc26b971236f24a2611cb1be09ff4845c3841bc
    .exe windows x86


    Code Sign

    Headers

    Sections