Overview

overview

10

Static

static

10

d9df5cc632...f6.dll

windows7_x64

6

d9df5cc632...f6.dll

windows10_x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d9df5cc632c30b072839b4a5b151c130cfe5d97308c18fe8ce5aea82f0f26bf6

  • Size

    164KB

  • Sample

    220124-a9xjvshael

  • MD5

    6ac71654e1024cfee54d59654f5f3cc1

  • SHA1

    399db3a65bc28ee8fca77c15edd252db6bf2b2b2

  • SHA256

    d9df5cc632c30b072839b4a5b151c130cfe5d97308c18fe8ce5aea82f0f26bf6

  • SHA512

    102166b70872ecb9da83b8c9bcd2784ed922a3d9d7f552dd923f6f047806cbcffae14f2e06666c117c7862f7affd6ba417b3165c33d41ed53f7c36ae50945df4

Score
10/10
sodinokibi4242

Malware Config

Extracted

Family

sodinokibi

Botnet

4

Campaign

242

C2

skooppi.fi

tzn.nu

groovedealers.ru

subyard.com

nourella.com

pro-gamer.pl

kompresory-opravy.com

domaine-des-pothiers.com

greenrider.nl

descargandoprogramas.com

liepertgrafikweb.at

eos-horlogerie.com

stagefxinc.com

gardenpartner.pl

antesacademy.it

wademurray.com

mrcar.nl

smartspeak.com

jeanmonti.com

hepishopping.com
Attributes
  • net

    false

  • pid

    4

  • prc

    sqlbrowser

    mysqld_nt

    ocssd

    visio

    mydesktopservice

    mysqld

    agntsvc

    steam

    winword

    sqlwriter

    tbirdconfig

    infopath

    sqbcoreservice

    thebat

    firefoxconfig

    excel

    sqlservr

    encsvc

    powerpnt

    mydesktopqos

    thebat64

    ocomm

    oracle

    wordpad

    thunderbird

    ocautoupds

    sqlagent

    onenote

    outlook

    synctime

    xfssvccon

    mysqld_opt

    isqlplussvc

    dbeng50

    mspub

    msftesql

    dbsnmp

    msaccess

  • ransom_oneliner

    All your bases are belong to us

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    242

  • svc

    svc$

    vss

    sql

    veeam

    memtas

    sophos

    backup

    mepocs

Targets

    • Target

      d9df5cc632c30b072839b4a5b151c130cfe5d97308c18fe8ce5aea82f0f26bf6

    • Size

      164KB

    • MD5

      6ac71654e1024cfee54d59654f5f3cc1

    • SHA1

      399db3a65bc28ee8fca77c15edd252db6bf2b2b2

    • SHA256

      d9df5cc632c30b072839b4a5b151c130cfe5d97308c18fe8ce5aea82f0f26bf6

    • SHA512

      102166b70872ecb9da83b8c9bcd2784ed922a3d9d7f552dd923f6f047806cbcffae14f2e06666c117c7862f7affd6ba417b3165c33d41ed53f7c36ae50945df4

    Score
    6/10

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks