Overview

overview

10

Static

static

10

2fea45f7be...ef.dll

windows7_x64

1

2fea45f7be...ef.dll

windows10-2004_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2fea45f7be7c7313ee6e4fe7ad9ef64d9966a2391003a00dcbbd6214e9c522ef

  • Size

    164KB

  • Sample

    220621-wxflgacaa4

  • MD5

    7354af1a63f222ede4c9e0a6f84d57c2

  • SHA1

    e6ebf8b4a340bc7f6043112eac16b46c13ce924f

  • SHA256

    2fea45f7be7c7313ee6e4fe7ad9ef64d9966a2391003a00dcbbd6214e9c522ef

  • SHA512

    08d0647c8731957e3d4bf9aeb5ffc8a7c474413a2f9bb0ac7be7326655e062de6755c59562f56f10c140472fd5098848ff89c28a88ace87db2bca52bf2261732

Score
10/10
sodinokibi231108

Malware Config

Extracted

Family

sodinokibi

Botnet

23

Campaign

1108

C2

leloupblanc.gr

customroasts.com

hypogenforensic.com

karelinjames.com

bluetenreich-brilon.de

professionetata.com

nginx.com

janellrardon.com

nepal-pictures.com

holocine.de

springfieldplumbermo.com

baptistdistinctives.org

christopherhannan.com

acb-gruppe.ch

ddmgen.com

hameghlim.com

pinthelook.com

citydogslife.com

agendatwentytwenty.com

lookandseen.com
Attributes
  • net

    true

  • pid

    23

  • prc

    winword

    wordpa

    isqlplussvc

    excel

    xfssvccon

    infopath

    powerpnt

    ocssd

    tbirdconfig

    agntsvc

    encsvc

    thunderbird

    synctime

    dbeng50

    mydesktopservice

    firefox

    outlook

    sqbcoreservice

    ocautoupds

    thebat

    steam

    sql

    mspub

    oracle

    mydesktopqos

    ocomm

    msaccess

    visio

    onenote

    dbsnmp

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    1108

  • svc

    sophos

    memtas

    veeam

    vss

    backup

    svc$

    mepocs

    sql

Targets

    • Target

      2fea45f7be7c7313ee6e4fe7ad9ef64d9966a2391003a00dcbbd6214e9c522ef

    • Size

      164KB

    • MD5

      7354af1a63f222ede4c9e0a6f84d57c2

    • SHA1

      e6ebf8b4a340bc7f6043112eac16b46c13ce924f

    • SHA256

      2fea45f7be7c7313ee6e4fe7ad9ef64d9966a2391003a00dcbbd6214e9c522ef

    • SHA512

      08d0647c8731957e3d4bf9aeb5ffc8a7c474413a2f9bb0ac7be7326655e062de6755c59562f56f10c140472fd5098848ff89c28a88ace87db2bca52bf2261732

    Score
    1/10
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks