Overview

overview

10

Static

static

10

95f7c2f8be...28.dll

windows7_x64

1

95f7c2f8be...28.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    95f7c2f8bea207767f8d90c3b53dc24a9fc8c0025f7bcd113adde90d2f8cfa28

  • Size

    164KB

  • Sample

    220124-bx5kdahefn

  • MD5

    117dc83b400a889887c4e959f76ba1f7

  • SHA1

    230743fc8e88c547d27de91192e9892cd8708c9f

  • SHA256

    95f7c2f8bea207767f8d90c3b53dc24a9fc8c0025f7bcd113adde90d2f8cfa28

  • SHA512

    9f17f3b8f53a2e4a2267d15900117b7674450c389ff53e1fa18b73b723703f5d5f6e5b61201f5b1b594c101607f92c4a2c80557684e4f16112286ff617b96fa6

Score
10/10
sodinokibi652904

Malware Config

Extracted

Family

sodinokibi

Botnet

65

Campaign

2904

C2

invela.dk

mondolandscapes.com

ikzoekgod.be

davedavisphotos.com

peninggibadan.co.id

ruggestar.ch

cp-bap.de

fsbforsale.com

initconf.com

elitkeramika-shop.com.ua

redctei.co

mediogiro.com.ar

theatre-embellie.fr

haus-landliebe.de

galatee-couture.com

pourlabretagne.bzh

malzomattalar.com

rsidesigns.com

jalkapuu.net

casinodepositors.com
Attributes
  • net

    true

  • pid

    65

  • prc

    xfssvccon

    synctime

    ocssd

    oracle

    thebat

    sqbcoreservice

    outlook

    ocomm

    dbeng50

    mspub

    encsvc

    msaccess

    infopath

    firefox

    steam

    agntsvc

    sql

    onenote

    powerpnt

    winword

    tbirdconfig

    excel

    ocautoupds

    thunderbird

    isqlplussvc

    dbsnmp

    mydesktopqos

    mydesktopservice

    visio

    wordpad

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    2904

  • svc

    memtas

    svc$

    sql

    vss

    veeam

    backup

    mepocs

    sophos

Targets

    • Target

      95f7c2f8bea207767f8d90c3b53dc24a9fc8c0025f7bcd113adde90d2f8cfa28

    • Size

      164KB

    • MD5

      117dc83b400a889887c4e959f76ba1f7

    • SHA1

      230743fc8e88c547d27de91192e9892cd8708c9f

    • SHA256

      95f7c2f8bea207767f8d90c3b53dc24a9fc8c0025f7bcd113adde90d2f8cfa28

    • SHA512

      9f17f3b8f53a2e4a2267d15900117b7674450c389ff53e1fa18b73b723703f5d5f6e5b61201f5b1b594c101607f92c4a2c80557684e4f16112286ff617b96fa6

    Score
    10/10

    • Suspicious use of NtCreateProcessExOtherParentProcess

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks