Overview

overview

10

Static

static

10

DomainName.bin.exe

windows7-x64

1

DomainName.bin.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DomainName.bin.exe

  • Size

    120KB

  • MD5

    af94ccb62f97700115a219c4b7626d22

  • SHA1

    bb67edcfe4e5b6fe09ee96e5b8ace7a4cfe39eb7

  • SHA256

    2896b38ec3f5f196a9d127dbda3f44c7c29c844f53ae5f209229d56fd6f2a59c

  • SHA512

    08c05f8dc98aba168734732d043c3e403f531522e0ec0ec64484d15375f353aa23f9654852ad2c54a3e6b2a9344f4ffb553cac24455f62bb65b55800e311c12a

  • SSDEEP

    1536:J8A4krBJLarHZZd/M4PI8iwplAXpzK88ICS4Aer9DIPcG5zXbwMcClFyFfjRto2C:+/LPrlAZZE0cOzbwMflEBPo

Score
10/10
$2a$10$mkbuaybjn4w3ipqct6e7royxml5sszgubpua7pkuspqju10kb4bma7114sodinokibi

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$mKbuAybjn4W3ipQCt6E7ROYxmL5SSZgUbPuA7PKUsPqJU10KB4bma

Campaign

7114

Decoy

withahmed.com

scenepublique.net

aglend.com.au

jyzdesign.com

nsec.se

cirugiauretra.es

gopackapp.com

tinyagency.com

crediacces.com

xn--rumung-bua.online

bowengroup.com.au

mastertechengineering.com

kmbshipping.co.uk

homng.net

fitnessingbyjessica.com

oldschoolfun.net

roygolden.com

sotsioloogia.ee

real-estate-experts.com

mir-na-iznanku.com
Attributes
  • net

    false

  • pid

    $2a$10$mKbuAybjn4W3ipQCt6E7ROYxmL5SSZgUbPuA7PKUsPqJU10KB4bma

  • prc

    oracle

    klnagent

    mydesktopqos

    infopath

    BackupExtender

    powerpnt

    outlook

    BackupAgent

    Smc

    sql

    ccSvcHst

    BackupUpdater

    Rtvscan

    winword

    kavfsscs

    ocssd

    isqlplussvc

    visio

    ShadowProtectSvc

    tbirdconfig

    TSSchBkpService

    dbeng50

    ccSetMgr

    agntsvc

    Sage.NA.AT_AU.SysTray

    dbsnmp

    thebat

    onenote

    AmitiAvSrv

    wordpad

    msaccess

    avgadmsv

    thunderbird

    BackupMaint

    Microsoft.exchange.store.worker.exe

    CarboniteUI

    excel

    SPBBCSvc

    LogmeInBackupService

    encsvc

    ocomm

    sqbcoreservice

    NSCTOP

    mydesktopservice

    kavfs

    kavfswp

    ocautoupds

    mspub

    xfssvccon

    DLOAdminSvcu

    synctime

    lmibackupvssservice

    firefox

    steam

    dlomaintsvcu

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). =========Attention!!!========= Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. ============================== [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    7114

  • svc

    Telemetryserver

    "Sophos AutoUpdate Service"

    sophos

    Altaro.Agent.exe

    mysqld

    MSSQL$MSGPMR

    "SophosFIM"

    "Sophos Web Control Service"

    SQLWriter

    svcGenericHost

    AltiBack

    "SQLServer Analysis Services (MSSQLSERVER)"

    BackupExecAgentAccelerator

    "StorageCraft ImageReady"

    SQLTELEMETRY

    AzureADConnectAuthenticationAgent

    ntrtscan

    ds_notifier

    TeamViewer

    "StorageCraft Raw Agent"

    "StorageCraft Shadow Copy Provider"

    SQLTELEMETRY$SQLEXPRESS

    VeeamHvIntegrationSvc

    AltiCTProxy

    MsDtsServer130

    ViprePPLSvc

    McAfeeFramework

    MSSQL$QM

    "swi_service"

    "ThreadLocker"

    ofcservice

    AUService

    sophossps

    AzureADConnectHealthSyncMonitor

    Altaro.OffsiteServer.UI.Service.exe

    "SAVAdminService"

    ds_monitor

    ALTIVRM

    SSASTELEMETRY

    TmCCSF

    MsDtsServer110

    "Sophos MCS Client"

    TMBMServer

    SBAMSvc

    mfewc

    "Sophos System Protection Service"

    MSSQLFDLauncher$TESTBACKUP02DEV

    VeeamDeploymentService

    masvc

    backup

    MSSQL$SQLEXPRESS

    AltiPhoneServ

    MSSQLServerOLAPService

    SSISTELEMETRY130

    VeeamEndpointBackupSvc

    mepocs

    Altaro.UI.Service.exe

    "ds_agent"

    HuntressUpdater

    MSSQLFDLauncher

    "Sophos File Scanner Service"

    SQLAgent$MSGPMR

    ADSync

    KaseyaAgent

    ReportServer

    MSSQLFDLauncher$SQLEXPRESS

    MSSQL$HPWJA

    KaseyaAgentEndpoint

    VeeamTransportSvc

    "ds_monitor"

    mfevtp

    MSSQLTESTBACKUP02DEV

    SQLTELEMETRY$MSGPMR

    ThreadLocker

    MSSQLServerADHelper100

    veeam

    tmlisten

    AzureADConnectHealthSyncInsights

    "swi_filter"

    MsDtsServer120

    ProtectedStorage

    VeeamDeploySvc

    memtas

    ds_agent

    VeeamMountSvc

    HuntressAgent

    SQLAgent$SQLEXPRESS

    bedbg

    MSSQLSERVER

    "ofcservice"

    VipreAAPSvc

    "Sophos Endpoint Defense Service"

    KACHIPS906995744173948

    DsSvc

    MSSQLLaunchpad$SQLEXPRESS

    msseces

    macmnsvc

    LTService

    Code42Service

    Altaro.HyperV.WAN.RemoteService.exe

    LTSvcMon

    MSSQL$SQLEXPRESSADV

    "SAVService"

    Altaro.OffsiteServer.Service.exe

    "Sage 100cloud Advanced 2020 (9920)"

    Altaro.SubAgent.exe

    mfemms

    "TeamViewer"

    "SQLServer Reporting Services (MSSQLSERVER)"

    VSS

    sql

    Altaro.SubAgent.N2.exe

    "SQLServer Integration Services 12.0"

    SQLSERVERAGENT

    vss

    "Sophos Safestore Service"

    klnagent

    "Sage.NA.AT_AU.Service"

    MBAMService

    "Sophos Health Service"

    SQLBrowser

    MySQL

    "ProtectedStorage"

    "Sophos Clean Service"

    "Sage 100c Advanced 2017 (9917)"

    "SntpService"

    VeeamNFSSvc

    KAVFS

    SQLEXPRESSADV

    KAENDCHIPS906995744173948

    sppsvc

    Amsp

    psqlWGE

    Microsoft.exchange.store.worker.exe

    kavfsscs

    "Amsp"

    sqlservr

    Altaro.DedupService.exe

    svc$

    "ds_notifier"

    "Sophos Device Control Service"

    AzureADConnectAgentUpdater

    AltiFTPUploader

    "Sophos MCS Agent"

Signatures

Files

  • DomainName.bin.exe
    .exe windows x86

    031931d2f2d921a9d906454d42f21be0


    Headers

    Imports

    Sections