Overview

overview

10

Static

static

10

79abd7ee97...24.dll

windows7_x64

6

79abd7ee97...24.dll

windows10_x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    79abd7ee971040ba78f283980f10f76419980e3c3e9fc12e67a212dc87a37924

  • Size

    164KB

  • Sample

    220124-b66h2ahgdl

  • MD5

    73d65e31b345ede135461c72e8bec74b

  • SHA1

    f5084a8237c80b9d799c89da4c78b32ad1ca69ff

  • SHA256

    79abd7ee971040ba78f283980f10f76419980e3c3e9fc12e67a212dc87a37924

  • SHA512

    e3462882ccc24f31e581d7e19ec55fbb377058d6beb754371e6863038a8f2484b36602ee74b964f0b9af2f436c5433d920fc58f25c34baa00b97f9cd6cc22515

Score
10/10
sodinokibi281356

Malware Config

Extracted

Family

sodinokibi

Botnet

28

Campaign

1356

C2

2020hindsight.info

shortysspices.com

julielusktherapy.com

rubyaudiology.com

levencovka.ru

blueridgeheritage.com

envomask.com

mediogiro.com.ar

nexstagefinancial.com

eurethicsport.eu

amelielecompte.wordpress.com

n-newmedia.de

baptistdistinctives.org

four-ways.com

pazarspor.org.tr

jlgraphisme.fr

agenceassemble.fr

g2mediainc.com

skyboundnutrition.co.uk

dreamvoiceclub.org
Attributes
  • net

    true

  • pid

    28

  • prc

    thunderbird

    ocautoupds

    mspub

    onenote

    thebat

    firefox

    dbeng50

    agntsvc

    sqbcoreservice

    winword

    xfssvccon

    sql

    ocomm

    oracle

    dbsnmp

    powerpnt

    mydesktopqos

    isqlplussvc

    encsvc

    mydesktopservice

    outlook

    infopath

    ocssd

    wordpa

    excel

    msaccess

    synctime

    steam

    tbirdconfig

    visio

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    1356

  • svc

    vss

    svc$

    sophos

    backup

    veeam

    memtas

    mepocs

    sql

Targets

    • Target

      79abd7ee971040ba78f283980f10f76419980e3c3e9fc12e67a212dc87a37924

    • Size

      164KB

    • MD5

      73d65e31b345ede135461c72e8bec74b

    • SHA1

      f5084a8237c80b9d799c89da4c78b32ad1ca69ff

    • SHA256

      79abd7ee971040ba78f283980f10f76419980e3c3e9fc12e67a212dc87a37924

    • SHA512

      e3462882ccc24f31e581d7e19ec55fbb377058d6beb754371e6863038a8f2484b36602ee74b964f0b9af2f436c5433d920fc58f25c34baa00b97f9cd6cc22515

    Score
    6/10

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks