crimsonrat | 78a28b25b330513649439305a5d9293cb07fb796ad6521ef31f39a5453a549d8

Resubmissions

07-09-2023 14:45

230907-r45fysaf5s 10

07-09-2023 14:12

230907-rjbyxaad5s 10

Sharing

Copy URL

Twitter E-mail

General

Target

gm.rar
Size

22MB
Sample

230907-rjbyxaad5s
MD5

d9aa719336b223b19cc30d1066a6955e
SHA1

a5ba381e11b859554431ecd3b1d89c1d6524421c
SHA256

78a28b25b330513649439305a5d9293cb07fb796ad6521ef31f39a5453a549d8
SHA512

26de419b91c188182616195ce3c0c2adcc0e9cfb1b77a7bb504deb9327a968251d86aa35c356c4b23c0e87831fd7935d03b05b81403ec82aebcbc7c71579a7fd
SSDEEP

393216:1WCDBR5/qcMb6ezNjpONekKdZKE1R2GjCEyvuCE3EZuzJy3Dzc1Ktp:1WCtDgb1ztpO4OE1IGmEWuhXzJIDzc1e

Score

10^/10

Malware Config

Extracted

Family

sodinokibi

Botnet

Campaign

296

Decoy

craftron.com

piestar.com

tages-geldvergleich.de

pxsrl.it

framemyballs.com

photographycreativity.co.uk

cincinnatiphotocompany.org

billyoart.com

midwestschool.org

supercarhire.co.uk

encounter-p.net

ncn.nl

fanuli.com.au

gosouldeep.com

greenrider.nl

renehartman.nl

entdoctor-durban.com

astrographic.com

advesa.com

skyscanner.ro

Attributes

net
true
pid
33
prc
sqlbrowser.exe
sqlwriter.exe
firefoxconfig.exe
thunderbird.exe
agntsvc.exe
thebat.exe
infopath.exe
mysqld_nt.exe
winword.exe
tbirdconfig.exe
sqlagent.exe
onenote.exe
ocautoupds.exe
msaccess.exe
sqlservr.exe
mydesktopservice.exe
outlook.exe
wordpad.exe
dbeng50.exe
thebat64.exe
msftesql.exe
dbsnmp.exe
mydesktopqos.exe
oracle.exe
ocssd.exe
excel.exe
visio.exe
isqlplussvc.exe
mysqld_opt.exe
sqbcoreservice.exe
mspub.exe
ocomm.exe
mysqld.exe
steam.exe
synctime.exe
encsvc.exe
xfssvccon.exe
powerpnt.exe
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
sub
296

Extracted

Family

sodinokibi

Botnet

Campaign

Decoy

eshop.design

harleystreetspineclinic.com

qrs-international.com

stabilisateur.fr

imaginekithomes.co.nz

watchsale.biz

levencovka.ru

acornishstudio.co.uk

kroophold-sjaelland.dk

frameshift.it

aberdeenartwalk.org

leadforensics.com

craftron.com

diverfiestas.com.es

kenmccallum.com

billscars.net

ncn.nl

towelroot.co

sochi-okna23.ru

oro.ae