Overview

overview

10

Static

static

10

fcea5f8fbc...e9.exe

windows7_x64

9

fcea5f8fbc...e9.exe

windows10_x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fcea5f8fbc7bf1a48611163f4b6db1f80af51f7985ba61a5ce99d72ad0ee56e9

  • Size

    3.4MB

  • Sample

    220124-az3ccsghb4

  • MD5

    9a1a3977773a433cea558de846eebfbc

  • SHA1

    d051dee115c9176a0a2cba13f2ab36d7a1954ab2

  • SHA256

    fcea5f8fbc7bf1a48611163f4b6db1f80af51f7985ba61a5ce99d72ad0ee56e9

  • SHA512

    4cbe419e18ad0fd01f5cd005bb72c4ee1e207c67b428a1b9aacf264843d955cc687aa9367054f0077abce4ee35e9d7f329c44d6615026ae5c8d11165baa7766d

Score
10/10
sodinokibi38467ransomware

Malware Config

Extracted

Family

sodinokibi

Botnet

38

Campaign

467

C2

wallflowersandrakes.com

craftron.com

lagschools.ng

epicjapanart.com

greenrider.nl

motocrossplace.co.uk

chris-anne.com

claudiakilian.de

afbudsrejserallinclusive.dk

dayenne-styling.nl

5thactors.com

casinodepositors.com

awaisghauri.com

latableacrepes-meaux.fr

sunsolutions.es

salonlamar.nl

martha-frets-ceramics.nl

akwaba-safaris.com

inewsstar.com

vitoriaecoturismo.com.br
Attributes
  • net

    false

  • pid

    38

  • prc

    firefoxconfig

    isqlplussvc

    thebat64

    sqlservr

    mydesktopservice

    sqbcoreservice

    excel

    sqlbrowser

    mysqld

    wordpad

    msaccess

    visio

    tbirdconfig

    steam

    oracle

    mysqld_opt

    dbsnmp

    sqlwriter

    agntsvc

    synctime

    xfssvccon

    thunderbird

    outlook

    winword

    mysqld_nt

    ocomm

    dbeng50

    powerpnt

    sqlagent

    encsvc

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    467

  • svc

    backup

    vss

    mepocs

    veeam

    sophos

    svc$

    memtas

    sql

Targets

    • Target

      fcea5f8fbc7bf1a48611163f4b6db1f80af51f7985ba61a5ce99d72ad0ee56e9

    • Size

      3.4MB

    • MD5

      9a1a3977773a433cea558de846eebfbc

    • SHA1

      d051dee115c9176a0a2cba13f2ab36d7a1954ab2

    • SHA256

      fcea5f8fbc7bf1a48611163f4b6db1f80af51f7985ba61a5ce99d72ad0ee56e9

    • SHA512

      4cbe419e18ad0fd01f5cd005bb72c4ee1e207c67b428a1b9aacf264843d955cc687aa9367054f0077abce4ee35e9d7f329c44d6615026ae5c8d11165baa7766d

    Score
    9/10
    ransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks