Overview

overview

10

Static

static

10

39fca7fbfd...1e.dll

windows7_x64

1

39fca7fbfd...1e.dll

windows10-2004_x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    39fca7fbfd1b8a31cd899a6b649e85ca8bb9fe770d2ecbe75cad29e24eceba1e

  • Size

    164KB

  • Sample

    220625-hzha7aafbk

  • MD5

    c26a7ea5728b33a046b0c77a59a6ccc9

  • SHA1

    98c717ca6a721ba73ec9afdd6e827e8bcd2873a0

  • SHA256

    39fca7fbfd1b8a31cd899a6b649e85ca8bb9fe770d2ecbe75cad29e24eceba1e

  • SHA512

    9b75945175914edba61d0ea8a91bdb692ef31e15786ea73313f8e8528e8d06ade99fce8cc5ee0c9952da661d5e37f987475565b7c9ae9e37013a72ab4e00cb93

Score
10/10
sodinokibi391531

Malware Config

Extracted

Family

sodinokibi

Botnet

39

Campaign

1531

C2

cmeow.com

fi-institutionalfunds.com

magnetvisual.com

birthplacemag.com

mollymccarthydesign.com

p-ride.live

epicjapanart.com

gta-jjb.fr

k-zubki.ru

richardkershawwines.co.za

nauticmarine.dk

brannbornfastigheter.se

brighthillgroup.com

kryptos72.com

acornishstudio.co.uk

luvbec.com

maxcube24.com.ua

domilivefurniture.com

interlinkone.com

donau-guides.eu
Attributes
  • net

    true

  • pid

    39

  • prc

    sqbcoreservice

    firefox

    msaccess

    onenote

    steam

    xfssvccon

    visio

    dbeng50

    winword

    thunderbird

    ocssd

    tbirdconfig

    sql

    isqlplussvc

    powerpnt

    mydesktopqos

    excel

    infopath

    agntsvc

    mydesktopservice

    outlook

    ocomm

    mspub

    ocautoupds

    encsvc

    oracle

    synctime

    wordpa

    dbsnmp

    thebat

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    1531

  • svc

    sophos

    backup

    veeam

    mepocs

    sql

    vss

    memtas

    svc$

Targets

    • Target

      39fca7fbfd1b8a31cd899a6b649e85ca8bb9fe770d2ecbe75cad29e24eceba1e

    • Size

      164KB

    • MD5

      c26a7ea5728b33a046b0c77a59a6ccc9

    • SHA1

      98c717ca6a721ba73ec9afdd6e827e8bcd2873a0

    • SHA256

      39fca7fbfd1b8a31cd899a6b649e85ca8bb9fe770d2ecbe75cad29e24eceba1e

    • SHA512

      9b75945175914edba61d0ea8a91bdb692ef31e15786ea73313f8e8528e8d06ade99fce8cc5ee0c9952da661d5e37f987475565b7c9ae9e37013a72ab4e00cb93

    Score
    6/10

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks