Overview

overview

10

Static

static

10

58487e8efe...7f.dll

windows7_x64

1

58487e8efe...7f.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    58487e8efe0aeac7a7c702e7961b0f15067404d273c86f9fc98cb85d6f07117f

  • Size

    164KB

  • Sample

    220124-cgakqsaad8

  • MD5

    452ec96da5a5203ddb0d3f9e5a25a1f5

  • SHA1

    a83867aab967292f7c5fa7b5eebb8d7bd8545a7c

  • SHA256

    58487e8efe0aeac7a7c702e7961b0f15067404d273c86f9fc98cb85d6f07117f

  • SHA512

    904a74afce7a04b102787d74542588d75c496324043684f886c09f09cd7a6591a01305d7cd4d9fbd284fd6a5038310869bc68da7c1e62783a175cd9c004373d0

Score
10/10
sodinokibi281493

Malware Config

Extracted

Family

sodinokibi

Botnet

28

Campaign

1493

C2

deduktia.fi

dinedrinkdetroit.com

o90.dk

thenalpa.com

letsstopsmoking.co.uk

tchernia-conseil.fr

bd2fly.com

lassocrm.com

jglconsultancy.com

autoteamlast.de

biblica.com

alene.co

bagaholics.in

richardmaybury.co.uk

adaduga.info

scietech.academy

angeleyezstripclub.com

kausette.com

kickittickets.com

k-v-f.de
Attributes
  • net

    true

  • pid

    28

  • prc

    agntsvc

    oracle

    msaccess

    dbsnmp

    powerpnt

    visio

    mydesktopservice

    xfssvccon

    dbeng50

    winword

    synctime

    thunderbird

    outlook

    thebat

    firefox

    wordpa

    mspub

    sqbcoreservice

    ocautoupds

    excel

    mydesktopqos

    onenote

    ocssd

    infopath

    isqlplussvc

    encsvc

    sql

    tbirdconfig

    ocomm

    steam

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}_Wannadie.txt and follow instructions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    1493

  • svc

    veeam

    vss

    mepocs

    sophos

    memtas

    sql

    svc$

    backup

Targets

    • Target

      58487e8efe0aeac7a7c702e7961b0f15067404d273c86f9fc98cb85d6f07117f

    • Size

      164KB

    • MD5

      452ec96da5a5203ddb0d3f9e5a25a1f5

    • SHA1

      a83867aab967292f7c5fa7b5eebb8d7bd8545a7c

    • SHA256

      58487e8efe0aeac7a7c702e7961b0f15067404d273c86f9fc98cb85d6f07117f

    • SHA512

      904a74afce7a04b102787d74542588d75c496324043684f886c09f09cd7a6591a01305d7cd4d9fbd284fd6a5038310869bc68da7c1e62783a175cd9c004373d0

    Score
    10/10

    • Suspicious use of NtCreateProcessExOtherParentProcess

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks