Overview

overview

10

Static

static

10

cb0ce59773...1c.exe

windows7_x64

10

cb0ce59773...1c.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cb0ce597738bc7cacaf401b12aae3ddb431ff139a6648cc326a303f3d94fa31c

  • Size

    118KB

  • MD5

    0cf6dc8500639f66a7ac56c5a6b36b57

  • SHA1

    45f93a774ceaad53f93c3ee560adb37ce50c3440

  • SHA256

    cb0ce597738bc7cacaf401b12aae3ddb431ff139a6648cc326a303f3d94fa31c

  • SHA512

    039e385df79aaf80b3f7be864aad228698288c4960bc80538177d88ea475c4ba7f46324ea49da077e6e6a6ecfab42683ae14f8bf02c36ab3b21aba6eb7f549d0

Score
10/10
$2a$10$ya1l43rwh6fokpbi8qy0hedpexwom/v5z0hnyee32cjyfdubwihug6387sodinokibi

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$yA1l43rWH6fokpBi8Qy0HedpEXWoM/v5z0hNyeE32cJyfduBWiHuG

Campaign

6387

C2

hannah-fink.de

craftleathermnl.com

ilcdover.com

helikoptervluchtnewyork.nl

zso-mannheim.de

compliancesolutionsstrategies.com

easytrans.com.au

tophumanservicescourses.com

iyengaryogacharlotte.com

morawe-krueger.de

lionware.de

nijaplay.com

ulyssemarketing.com

calxplus.eu

zenderthelender.com

slupetzky.at

brevitempore.net

longislandelderlaw.com

hmsdanmark.dk

teknoz.net
Attributes
  • net

    true

  • pid

    $2a$10$yA1l43rWH6fokpBi8Qy0HedpEXWoM/v5z0hNyeE32cJyfduBWiHuG

  • prc

    mydesktopservice

    sql

    synctime

    thebat

    encsvc

    mydesktopqos

    msaccess

    infopath

    winword

    excel

    onenote

    ocssd

    outlook

    firefox

    xfssvccon

    thunderbird

    visio

    ocautoupds

    isqlplussvc

    sqbcoreservice

    mspub

    powerpnt

    agntsvc

    oracle

    dbsnmp

    steam

    dbeng50

    tbirdconfig

    wordpad

    ocomm

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    6387

  • svc

    sql

    vss

    sophos

    backup

    veeam

    mepocs

    memtas

    svc$

Signatures

Files

  • cb0ce597738bc7cacaf401b12aae3ddb431ff139a6648cc326a303f3d94fa31c
    .exe windows x86

    023da91a090ec3af1347acc06423b2e0


    Code Sign

    Headers

    Imports

    Sections