Overview

overview

10

Static

static

10

2896b38ec3...9c.exe

windows7-x64

1

2896b38ec3...9c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2896b38ec3f5f196a9d127dbda3f44c7c29c844f53ae5f209229d56fd6f2a59c(sodinokibi).zip

  • Size

    77KB

  • MD5

    1cdd591e3505bef21cd47f8f43d36a54

  • SHA1

    2cbf8b7a597f5f58c7a94ddd8df02889019db8e8

  • SHA256

    89d7faff53bd5acf6e71d15d499a093a5cd420311d86daafecb51eca6aa91608

  • SHA512

    aea358106358e09ac2faa649cf78961dfe279b1b8508ffb849eaba49adf924c360a5caf2f3417e948a733e19db3beee961d41e9bc3b29c5b29f3e91687a730b4

  • SSDEEP

    1536:oQQ0cc1gGq/zru6RfwWY2UU5NkOma9+vFA35Tk0dsSAVY22ZmX5S:vgtb2J4kOX9Y+d+DVUGY

Score
10/10
$2a$10$mkbuaybjn4w3ipqct6e7royxml5sszgubpua7pkuspqju10kb4bma7114sodinokibi

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$mKbuAybjn4W3ipQCt6E7ROYxmL5SSZgUbPuA7PKUsPqJU10KB4bma

Campaign

7114

Decoy

withahmed.com

scenepublique.net

aglend.com.au

jyzdesign.com

nsec.se

cirugiauretra.es

gopackapp.com

tinyagency.com

crediacces.com

xn--rumung-bua.online

bowengroup.com.au

mastertechengineering.com

kmbshipping.co.uk

homng.net

fitnessingbyjessica.com

oldschoolfun.net

roygolden.com

sotsioloogia.ee

real-estate-experts.com

mir-na-iznanku.com
Attributes
  • net

    false

  • pid

    $2a$10$mKbuAybjn4W3ipQCt6E7ROYxmL5SSZgUbPuA7PKUsPqJU10KB4bma

  • prc

    oracle

    klnagent

    mydesktopqos

    infopath

    BackupExtender

    powerpnt

    outlook

    BackupAgent

    Smc

    sql

    ccSvcHst

    BackupUpdater

    Rtvscan

    winword

    kavfsscs

    ocssd

    isqlplussvc

    visio

    ShadowProtectSvc

    tbirdconfig

    TSSchBkpService

    dbeng50

    ccSetMgr

    agntsvc

    Sage.NA.AT_AU.SysTray

    dbsnmp

    thebat

    onenote

    AmitiAvSrv

    wordpad

    msaccess

    avgadmsv

    thunderbird

    BackupMaint

    Microsoft.exchange.store.worker.exe

    CarboniteUI

    excel

    SPBBCSvc

    LogmeInBackupService

    encsvc

    ocomm

    sqbcoreservice

    NSCTOP

    mydesktopservice

    kavfs

    kavfswp

    ocautoupds

    mspub

    xfssvccon

    DLOAdminSvcu

    synctime

    lmibackupvssservice

    firefox

    steam

    dlomaintsvcu

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). =========Attention!!!========= Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. ============================== [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    7114

  • svc

    Telemetryserver

    "Sophos AutoUpdate Service"

    sophos

    Altaro.Agent.exe

    mysqld

    MSSQL$MSGPMR

    "SophosFIM"

    "Sophos Web Control Service"

    SQLWriter

    svcGenericHost

    AltiBack

    "SQLServer Analysis Services (MSSQLSERVER)"

    BackupExecAgentAccelerator

    "StorageCraft ImageReady"

    SQLTELEMETRY

    AzureADConnectAuthenticationAgent

    ntrtscan

    ds_notifier

    TeamViewer

    "StorageCraft Raw Agent"

    "StorageCraft Shadow Copy Provider"

    SQLTELEMETRY$SQLEXPRESS

    VeeamHvIntegrationSvc

    AltiCTProxy

    MsDtsServer130

    ViprePPLSvc

    McAfeeFramework

    MSSQL$QM

    "swi_service"

    "ThreadLocker"

    ofcservice

    AUService

    sophossps

    AzureADConnectHealthSyncMonitor

    Altaro.OffsiteServer.UI.Service.exe

    "SAVAdminService"

    ds_monitor

    ALTIVRM

    SSASTELEMETRY

    TmCCSF

    MsDtsServer110

    "Sophos MCS Client"

    TMBMServer

    SBAMSvc

    mfewc

    "Sophos System Protection Service"

    MSSQLFDLauncher$TESTBACKUP02DEV

    VeeamDeploymentService

    masvc

    backup

    MSSQL$SQLEXPRESS

    AltiPhoneServ

    MSSQLServerOLAPService

    SSISTELEMETRY130

    VeeamEndpointBackupSvc

    mepocs

    Altaro.UI.Service.exe

    "ds_agent"

    HuntressUpdater

    MSSQLFDLauncher

    "Sophos File Scanner Service"

    SQLAgent$MSGPMR

    ADSync

    KaseyaAgent

    ReportServer

    MSSQLFDLauncher$SQLEXPRESS

    MSSQL$HPWJA

    KaseyaAgentEndpoint

    VeeamTransportSvc

    "ds_monitor"

    mfevtp

    MSSQLTESTBACKUP02DEV

    SQLTELEMETRY$MSGPMR

    ThreadLocker

    MSSQLServerADHelper100

    veeam

    tmlisten

    AzureADConnectHealthSyncInsights

    "swi_filter"

    MsDtsServer120

    ProtectedStorage

    VeeamDeploySvc

    memtas

    ds_agent

    VeeamMountSvc

    HuntressAgent

    SQLAgent$SQLEXPRESS

    bedbg

    MSSQLSERVER

    "ofcservice"

    VipreAAPSvc

    "Sophos Endpoint Defense Service"

    KACHIPS906995744173948

    DsSvc

    MSSQLLaunchpad$SQLEXPRESS

    msseces

    macmnsvc

    LTService

    Code42Service

    Altaro.HyperV.WAN.RemoteService.exe

    LTSvcMon

    MSSQL$SQLEXPRESSADV

    "SAVService"

    Altaro.OffsiteServer.Service.exe

    "Sage 100cloud Advanced 2020 (9920)"

    Altaro.SubAgent.exe

    mfemms

    "TeamViewer"

    "SQLServer Reporting Services (MSSQLSERVER)"

    VSS

    sql

    Altaro.SubAgent.N2.exe

    "SQLServer Integration Services 12.0"

    SQLSERVERAGENT

    vss

    "Sophos Safestore Service"

    klnagent

    "Sage.NA.AT_AU.Service"

    MBAMService

    "Sophos Health Service"

    SQLBrowser

    MySQL

    "ProtectedStorage"

    "Sophos Clean Service"

    "Sage 100c Advanced 2017 (9917)"

    "SntpService"

    VeeamNFSSvc

    KAVFS

    SQLEXPRESSADV

    KAENDCHIPS906995744173948

    sppsvc

    Amsp

    psqlWGE

    Microsoft.exchange.store.worker.exe

    kavfsscs

    "Amsp"

    sqlservr

    Altaro.DedupService.exe

    svc$

    "ds_notifier"

    "Sophos Device Control Service"

    AzureADConnectAgentUpdater

    AltiFTPUploader

    "Sophos MCS Agent"

Signatures

Files

  • 2896b38ec3f5f196a9d127dbda3f44c7c29c844f53ae5f209229d56fd6f2a59c(sodinokibi).zip
    .zip

    Password: infected

  • 2896b38ec3f5f196a9d127dbda3f44c7c29c844f53ae5f209229d56fd6f2a59c.exe
    .exe windows x86

    031931d2f2d921a9d906454d42f21be0


    Headers

    Imports

    Sections