Resubmissions

24-07-2023 06:32

230724-haylwaag65 10

16-07-2023 18:15

230716-wwbacshb7z 10

General

  • Target

    2020-07-20.zip

  • Size

    347.3MB

  • Sample

    230724-haylwaag65

  • MD5

    712b5aa5e08566a0f01a0a39418d6132

  • SHA1

    91349082a104f862b531278769f3d0c587244fc0

  • SHA256

    18fcb8604dc88c010d786be917f618a461876f5db6f80f1f8a64bc3b8fe48a98

  • SHA512

    12642ecf4ebc7be19bd78b5b18d4a283ce5d7008eaa616dcc962e9fd21a083bb59821f72995843a8884fd1e6722a74da1461dea6bb49e789b4bf7b4fcb019016

  • SSDEEP

    6291456:7EC9ko9Z5jyHn8ly4KT5uOXAKcXPAANTaqWXmhN0pxn+UeXiGf9dHh2hWFr40VCn:7E09Z5mc4FcfAAvhWpxnoLf9dHZxVQrz

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$MN/9PlT2MnK8i7UVjwbr0ep8gPm9H4sNOFD0lcgzoH4.2q72IHSkK

Campaign

4710

Decoy

coastalbridgeadvisors.com

comparatif-lave-linge.fr

thomasvicino.com

colorofhorses.com

nacktfalter.de

global-kids.info

xoabigail.com

cursoporcelanatoliquido.online

brawnmediany.com

importardechina.info

plastidip.com.ar

higadograsoweb.com

wari.com.pe

blgr.be

mastertechengineering.com

d2marketing.co.uk

littlebird.salon

geekwork.pl

101gowrie.com

beyondmarcomdotcom.wordpress.com

Attributes
  • net

    true

  • pid

    $2a$10$MN/9PlT2MnK8i7UVjwbr0ep8gPm9H4sNOFD0lcgzoH4.2q72IHSkK

  • prc

    encsvc

    steam

    intuit

    mspub

    tbirdconfig

    ^MSExchange.*$

    ocssd

    isqlplussvc

    wordpa

    agntsvc

    sqbcoreservice

    sql

    mydesktopservice

    ^store$

    mydesktopqos

    dbeng50

    msaccess

    xfssvccon

    onenote

    winword

    ^qb.*$

    infopath

    thebat

    ocomm

    synctime

    ntdbsmgr

    ^Microsoft.Exchange.*$

    oracle

    thunderbird

    ^store.exe$

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instructions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    4710

  • svc

    mepocs

    vss

    backup

    veeam

    sql

    sophos

    svc$

    memtas

Extracted

Family

nanocore

Version

1.2.2.0

C2

dera118.hopto.org:7031

185.140.53.135:7031

harolds.ooguy.com:6051

harold.2waky.com:6051

Mutex

4ca1922c-b93c-4fb2-826c-d0806938edcc

Attributes
  • activate_away_mode

    true

  • backup_connection_host

    185.140.53.135

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2020-04-30T22:08:05.557339036Z

  • bypass_user_account_control

    false

  • bypass_user_account_control_data

    PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+

  • clear_access_control

    true

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    7031

  • default_group

    Default

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    4ca1922c-b93c-4fb2-826c-d0806938edcc

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    dera118.hopto.org

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    false

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Extracted

Family

sodinokibi

Botnet

$2a$10$DNoARQjmlusPylr6hH6sDuMN4xmQbhpYUWfKtAGJzvnUBouo7OgnC

Campaign

4874

Decoy

educar.org

chrissieperry.com

bookspeopleplaces.com

itelagen.com

craftleathermnl.com

testzandbakmetmening.online

bordercollie-nim.nl

kidbucketlist.com.au

lubetkinmediacompanies.com

vorotauu.ru

presseclub-magdeburg.de

siluet-decor.ru

xtptrack.com

buymedical.biz

panelsandwichmadrid.es

body-armour.online

makeurvoiceheard.com

lapinvihreat.fi

fannmedias.com

americafirstcommittee.org