Overview

overview

10

Static

static

10

43cd585e36...e4.exe

windows7_x64

1

43cd585e36...e4.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    43cd585e36a8b4edf2b6ef406ae5f019b1480401c684bd2bf594195f075433e4
  • Size 164KB
  • Sample220707-1lm9dsdbep
  • SHA256 43cd585e36a8b4edf2b6ef406ae5f019b1480401c684bd2bf594195f075433e4
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
1837sodinokibi

Malware Config

Extracted

Family

  • sodinokibi

Botnet

  • 18

Campaign

  • 37

C2

  • koncept-m.ru

  • weddingceremonieswithtim.com

  • rivermusic.nl

  • hom-frisor.dk

  • ronielyn.com

  • lapponiasafaris.com

  • queertube.net

  • cp-bap.de

  • signededenroth.dk

  • johnsonweekly.com

  • ludoil.it

  • foerderverein-vatterschule.de

  • atelierkomon.com

  • otpusk.zp.ua

  • parseport.com

  • vitoriaecoturismo.com.br

  • perfectgrin.com

  • docarefoundation.org

  • traitware.com

  • annenymus.com

Attributes
  • net

    true

  • pid

    18

  • prc

    steam

    sqlwriter

    infopath

    thebat64

    mysqld_opt

    sqbcoreservice

    visio

    dbeng50

    xfssvccon

    msftesql

    agntsvc

    encsvc

    tbirdconfig

    wordpad

    sql

    sqlservr

    dbsnmp

    mysqld_nt

    winword

    firefoxconfig

    sqlbrowser

    mydesktopservice

    thunderbird

    ocssd

    mysqld

    oracle

    sqlagent

    synctime

    ocautoupds

    isqlplussvc

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} c) Open our secondary website: http://decryptor.top/{UID} When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    37

  • svc

    sql

    memtas

    svc$

    veeam

    mepocs

    sophos

    backup

    vss

Signatures

  • Sodinokibi family
    sodinokibi
  • Sodinokibi/Revil sample 1 IoCs

File Explorer

  • 43cd585e36a8b4edf2b6ef406ae5f019b1480401c684bd2bf594195f075433e4
    .exe 164KB

43cd585e36a8b4edf2b6ef406ae5f019b1480401c684bd2bf594195f075433e4

  • IMPHASH c88f20b29592f2107a629e815db6afae
  • SHA256 43cd585e36a8b4edf2b6ef406ae5f019b1480401c684bd2bf594195f075433e4
  • MD5 SHA1 SHA512 SSDEEP
windowsx86

  • Sodinokibi/Revil sample

Minor OS version
Major OS version
Entry point
15286
Magic Number
267
Subsystem
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE
PDB paths