General

  • Target
    d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299
  • Size 157KB
  • Sample220124-bbj2jshbc5
  • SHA256 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10

Malware Config

Extracted

Family
  • sodinokibi

Botnet
  • 9

Campaign
  • 5

C2
  • dnqa.co.uk

  • juergenblaetz.de

  • stabilisateur.fr

  • dentalcircle.com

  • jonnyhooley.com

  • creohn.de

  • www.factorywizuk.com

  • rubyaudiology.com

  • biodentify.ai

  • b3b.ch

  • unislaw-narty.pl

  • patassociation.com

  • aciscomputers.com

  • rename.kz

  • marmarabasin.com

  • christianscholz.de

  • www.mrmac.com

  • annida.it

  • baumfinancialservices.com

  • devplus.be

Attributes
  • net

    true

  • pid

    9

  • prc

    mysql.exe

  • ransom_oneliner

    Your computer have been infected!

  • ransom_template

    Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got {EXT} extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/{UID} Page will ask you for the key, here it is: {KEY}

  • sub

    5

Signatures

  • Sodinokibi family
  • Sodinokibi/Revil sample 1 IoCs

File Explorer

  • d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299
    .exe 157KB

d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299

  • SHA256 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299
  • MD5 SHA1 SHA512 SSDEEP
  • Sodinokibi/Revil sample

Minor OS version
Major OS version
Entry point
12310
Magic Number
267
Subsystem
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE
PDB paths