Overview

overview

10

Static

static

10

43cd585e36...e4.exe

windows7_x64

1

43cd585e36...e4.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    43cd585e36a8b4edf2b6ef406ae5f019b1480401c684bd2bf594195f075433e4

  • Size

    164KB

  • MD5

    f110035255ecf395f0d5fa1cd89bf15f

  • SHA1

    e60d841b1630f1c6abc0060448ed718a92ec3b56

  • SHA256

    43cd585e36a8b4edf2b6ef406ae5f019b1480401c684bd2bf594195f075433e4

  • SHA512

    974d4babf66d1cd7d20fe61390b248c2251d403fe15d8e0b2eea29096db4ab83e8488bfbce82dceb725cda11bdd26284656394e8d30fa1cbf592973c8456691a

  • SSDEEP

    3072:xdHwJK3BMoFiWjmfb+HP+rnRfU7qK4F9co:xNwE3q4jmfCHWtU7i9

Score
10/10
1837sodinokibi

Malware Config

Extracted

Family

sodinokibi

Botnet

18

Campaign

37

C2

koncept-m.ru

weddingceremonieswithtim.com

rivermusic.nl

hom-frisor.dk

ronielyn.com

lapponiasafaris.com

queertube.net

cp-bap.de

signededenroth.dk

johnsonweekly.com

ludoil.it

foerderverein-vatterschule.de

atelierkomon.com

otpusk.zp.ua

parseport.com

vitoriaecoturismo.com.br

perfectgrin.com

docarefoundation.org

traitware.com

annenymus.com
Attributes
  • net

    true

  • pid

    18

  • prc

    steam

    sqlwriter

    infopath

    thebat64

    mysqld_opt

    sqbcoreservice

    visio

    dbeng50

    xfssvccon

    msftesql

    agntsvc

    encsvc

    tbirdconfig

    wordpad

    sql

    sqlservr

    dbsnmp

    mysqld_nt

    winword

    firefoxconfig

    sqlbrowser

    mydesktopservice

    thunderbird

    ocssd

    mysqld

    oracle

    sqlagent

    synctime

    ocautoupds

    isqlplussvc

    outlook

    thebat

    excel

    ocomm

    mydesktopqos

    powerpnt

    mspub

    msaccess

    onenote

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} c) Open our secondary website: http://decryptor.top/{UID} When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    37

  • svc

    sql

    memtas

    svc$

    veeam

    mepocs

    sophos

    backup

    vss

Signatures

  • Sodinokibi family
    sodinokibi
  • Sodinokibi/Revil sample 1 IoCs

Files

  • 43cd585e36a8b4edf2b6ef406ae5f019b1480401c684bd2bf594195f075433e4
    .exe windows x86

    c88f20b29592f2107a629e815db6afae


    Headers

    Imports

    Sections