Overview

overview

10

Static

static

10

NA_NA_38bb...JC.exe

windows7-x64

10

NA_NA_38bb...JC.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NA_NA_38bb6d3370e91dexeexe_JC.exe

  • Size

    122KB

  • MD5

    38bb6d3370e91deee960c8aeb6b0a50e

  • SHA1

    ba9e23c4f6e7435e90e92ffef836386053c04ca3

  • SHA256

    8ece3ce00a84b7365b96487f215cbbea379a8df57ed7c23a2add8758858fba6e

  • SHA512

    532b5f6d68b2526250d1c307cf265b84985ce4c4bc4b00a3c6c05edb051bcc6fa06b64c987de1279746a2c5d91c951aa6c4820546cf2985a1e6d608c0a011b22

  • SSDEEP

    1536:hxOUyl20w8bVZQ40iMSO1fY+iUyQs2r8t5p1ySotICS4A6UdSJOfTo4QVvA3T2+g:hMhQNDEtb3AirfTz0vAVR/6

Score
10/10
$2a$12$zb.xchbxkqemha8jqydfiugzvkcfc681pc5e6yq5mir807begq9hw8317sodinokibi

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$12$Zb.XchbXKQEmha8JQYdfiugzvkcFc681pc5e6Yq5miR807bEgQ9HW

Campaign

8317

Decoy

withahmed.com

simulatebrain.com

villa-marrakesch.de

higadograsoweb.com

minipara.com

oldschoolfun.net

remcakram.com

international-sound-awards.com

xn--fnsterputssollentuna-39b.se

echtveilig.nl

izzi360.com

slashdb.com

burkert-ideenreich.de

ilso.net

cwsitservices.co.uk

projetlyonturin.fr

gonzalezfornes.es

autopfand24.de

fayrecreations.com

vancouver-print.ca
Attributes
  • net

    true

  • pid

    $2a$12$Zb.XchbXKQEmha8JQYdfiugzvkcFc681pc5e6Yq5miR807bEgQ9HW

  • prc

    dbeng50

    encsvc

    mydesktopqos

    sql

    synctime

    winword

    agntsvc

    powerpnt

    dbsnmp

    infopath

    sqbcoreservice

    msaccess

    wordpad

    onenote

    mydesktopservice

    ocautoupds

    mspub

    ocomm

    tbirdconfig

    steam

    thebat

    excel

    thunderbird

    ocssd

    xfssvccon

    outlook

    visio

    firefox

    oracle

    isqlplussvc

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- We strongly encourage You to pay your attention to this message and read it to the end. All Your files are encrypted, and currently unavailable, now all files on your system has extension {EXT} Before that, all of your most important personal and business files were backed up to our secure offline storage. We took them for temporary storage - but we don't need your files and we are not personally interested in your business. Our encryption algorithm is the most technically difficult and max resistant to burglary. Only OUR specialists can decrypted your files without loss(!) Any attempts to decrypt files on your own lead to damage them beyond repair(!) Best way to you will be consent to negotiations and mutual agreement between us. To connect us you need to download TOR browser and follow the link to begin negotiations.(You can find full instructions below.) We are waiting You and ready to listen all your offers and discuss them. If You will ignore this letter - we will have to sell closed auction all yours private files, photoes, business correspondence, documents and business files + with our analysis of your work activity (weakness of your business, financial violations and the opportunity to profit from this information). It will offset our financial losses. Or we'll just put all your files in the public domain, where everyone can download and use them as they wish. * For TOR Browser http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/ We are known as "Sodinokibi (REvil) Ransomware". For example, this article: https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread You have a guarantee that your files will be returned 100 %. And remember, this is only business, nothing personal.. We have a concept of business honor, and we can promise something if we come to a mutual agreement: 1. We guarantee to decrypt all your files in the shortest possible time 2. We will delete all your files and forget about your company. 3. We will show your weaknesses in your networks. .-= INSTRUCTIONS TO CONNECT =-. How to get access on website? You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ---------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all your data!

  • sub

    8317

  • svc

    sophos

    svc$

    mepocs

    veeam

    backup

    sql

    memtas

    vss

Signatures

  • Sodinokibi family
    sodinokibi
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • NA_NA_38bb6d3370e91dexeexe_JC.exe
    .exe windows x86

    f3d46e2f8717ced6d4b220e65d6ad18a


    Headers

    Imports

    Sections