Overview

overview

10

Static

static

10

b0e62abca4...13.dll

windows7-x64

1

b0e62abca4...13.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b0e62abca43fa26ebed66f2ef103c1921b510a75cfb51a192a194add7d076113

  • Size

    164KB

  • Sample

    220724-z3v5wsgfb6

  • MD5

    4670f18860a9c455aa07fc6c3c4d3a26

  • SHA1

    539ff401746625275d2ff74a5bb5c6564c526ba8

  • SHA256

    b0e62abca43fa26ebed66f2ef103c1921b510a75cfb51a192a194add7d076113

  • SHA512

    1bf7e3dcf9873b2f3f3a393f792c2618375068fa3f47adafb975f45a780296b154cf2eeeb2da3790eb46b33052fc6a512f6fdece83196a1b3cec1859e4de6eae

Score
10/10
sodinokibi351613

Malware Config

Extracted

Family

sodinokibi

Botnet

35

Campaign

1613

C2

ygallerysalonsoho.com:443

jimprattmediations.com

jaaphoekzema.nl

mariamalmahdi.com

spirello.nl

monstarrsoccer.com

hensleymarketing.com

silkeight.com

beandrivingschool.com.au

b3b.ch

saberconcrete.com

mursall.de

oththukaruva.com

klapanvent.ru

strauchs-wanderlust.info

ownidentity.com

frameshift.it

kickittickets.com

dreamvoiceclub.org

johnstonmingmanning.com
Attributes
  • net

    true

  • pid

    35

  • prc

    ocomm

    onenote

    mydesktopqos

    steam

    thebat

    ^QB.*$

    encsvc

    tbirdconfig

    mspub

    excel

    dbsnmp

    powerpnt

    agntsvc

    synctime

    mydesktopservice

    wordpa

    xfssvccon

    visio

    sqbcoreservice

    dbeng50

    isqlplussvc

    SQL

    ^qb.*$

    msaccess

    oracle

    infopath

    winword

    ocautoupds

    thunderbird

    ocssd

    outlook

    ^Qb.*$

    Sql

    sql

    ntdbsmgr

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    1613

  • svc

    svc$

    backup

    veeam

    mepocs

    sophos

    sql

    memtas

    vss

Targets

    • Target

      b0e62abca43fa26ebed66f2ef103c1921b510a75cfb51a192a194add7d076113

    • Size

      164KB

    • MD5

      4670f18860a9c455aa07fc6c3c4d3a26

    • SHA1

      539ff401746625275d2ff74a5bb5c6564c526ba8

    • SHA256

      b0e62abca43fa26ebed66f2ef103c1921b510a75cfb51a192a194add7d076113

    • SHA512

      1bf7e3dcf9873b2f3f3a393f792c2618375068fa3f47adafb975f45a780296b154cf2eeeb2da3790eb46b33052fc6a512f6fdece83196a1b3cec1859e4de6eae

    Score
    1/10
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks