Overview

overview

10

Static

static

10

001e9becdd...93.exe

windows10-2004-x64

7

1a1cf2a2f6...31.exe

windows10-2004-x64

7

2eac3720bc...61.exe

windows10-2004-x64

1

320e3af17b...4c.exe

windows10-2004-x64

3

33bcab7033...70.exe

windows10-2004-x64

6

47a52afd63...2e.exe

windows10-2004-x64

10

4b24d27301...69.exe

windows10-2004-x64

7

4c481d251f...5a.exe

windows10-2004-x64

1

4c9ab76300...dd.exe

windows10-2004-x64

6

50a04b093c...95.dll

windows10-2004-x64

6

5266183553...2f.dll

windows10-2004-x64

8

547798defb...6e.exe

windows10-2004-x64

10

5fb2242c04...96.exe

windows10-2004-x64

1

63a0bf6385...12.exe

windows10-2004-x64

10

6a08b51e02...68.exe

windows10-2004-x64

5

803d827a2c...53.exe

windows10-2004-x64

7

85523c6377...c3.exe

windows10-2004-x64

3

8ab3db7349...03.exe

windows10-2004-x64

9

9b87457fe8...f0.exe

windows10-2004-x64

8

a3c7b0df18...cc.exe

windows10-2004-x64

1

ab4fa067af...38.exe

windows10-2004-x64

10

b1c5c3ca41...7d.exe

windows10-2004-x64

3

ca561f9403...c5.exe

windows10-2004-x64

7

d278eb3d6c...8f.exe

windows10-2004-x64

6

d3e04348f4...91.exe

windows10-2004-x64

10

d7e876a714...c9.exe

windows10-2004-x64

7

dd8bf2763c...38.exe

windows10-2004-x64

dd9ca1355f...9a.exe

windows10-2004-x64

7

dd9d07d1f5...27.exe

windows10-2004-x64

10

ef3c260fed...49.exe

windows10-2004-x64

10

f40df86d68...df.exe

windows10-2004-x64

10

fb861230c0...01.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Desktop.rar

  • Size

    5.6MB

  • MD5

    9462bef27d5673bc39e7c6197f0b30f1

  • SHA1

    5f4814afabbcc89a9d47b99f90b91b13b5edf250

  • SHA256

    ad3bcb65313043b1a43b8fb210f3a20a87df8a8145ed9a18b086d0859616caa2

  • SHA512

    f4c64d04ff64646e21abbe5d8abc828546e765e0f00817fbe70c1f11983ff46f9cc09ee94bfda335a1f0c5db01010ac1173746bee4e9dc52b802973dfc1dba7f

  • SSDEEP

    98304:1fyslh/MRTs8LWWCxyJrMqTnucb85kcK5+u4CYtivrRFQNogZX/Tko+0+xE:Mqh0RI8LW3xkrxV9cArLQH

Score
10/10
upx33360gandcrabsodinokibi

Malware Config

Extracted

Family

gandcrab

C2

http://gdcbghvjyqy7jclk.onion.top/

Extracted

Family

sodinokibi

Botnet

33

Campaign

360

Decoy

2020hindsight.info

frameshift.it

billyoart.com

omegamarbella.com

scholarquotes.com

ziliak.com

matthieupetel.fr

cardsandloyalty.com

limmortelyouth.com

solutionshosting.co.uk

gsconcretecoatings.com

annenymus.com

barbaramcfadyenjewelry.com

ciga-france.fr

ayudaespiritualtamara.com

fann.ru

paprikapod.com

galaniuklaw.com

azerbaycanas.com

testitjavertailut.net
Attributes
  • net

    true

  • pid

    33

  • prc

    xfssvccon.exe

    mspub.exe

    tbirdconfig.exe

    sqlservr.exe

    dbeng50.exe

    oracle.exe

    excel.exe

    winword.exe

    synctime.exe

    sqlagent.exe

    encsvc.exe

    msftesql.exe

    mydesktopqos.exe

    mysqld_nt.exe

    thebat.exe

    dbsnmp.exe

    msaccess.exe

    thebat64.exe

    mydesktopservice.exe

    mysqld.exe

    outlook.exe

    ocssd.exe

    ocautoupds.exe

    onenote.exe

    thunderbird.exe

    infopath.exe

    sqbcoreservice.exe

    wordpad.exe

    sqlbrowser.exe

    powerpnt.exe

    firefoxconfig.exe

    ocomm.exe

    mysqld_opt.exe

    sqlwriter.exe

    steam.exe

    agntsvc.exe

    isqlplussvc.exe

    visio.exe

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    360

Signatures

  • GandCrab payload 1 IoCs
  • Gandcrab family
    gandcrab
  • Sodinokibi family
    sodinokibi
  • Sodinokibi/Revil sample 1 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 31 IoCs

    Checks for missing Authenticode signature.

Files

  • Desktop.rar
    .rar
  • 001e9becdd7d9887c6fbe487073ad3dc068124a5300f4128d9ed32db4f63f793
    .exe windows:10 windows x86


    Headers

    Sections

  • out.upx
    .exe windows:10 windows x86


    Headers

    Sections

  • 1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31
    .exe windows:8 windows x86


    Headers

    Sections

  • 2eac3720bcfb4550e3093f053880b373068360bc8583f2aee059905bcad29c61
    .exe windows:4 windows x86

    86c5032ebe1784dfd13edabd0e3b62d4


    Headers

    Imports

    Sections

  • 320e3af17bb8787283fe0c4af9d3a778c191d8374f19c0bc6b6ee2f22363094c
    .exe windows:4 windows x86

    ebdae8689983d2d4f2a5e3392ba9074c


    Headers

    Imports

    Sections

  • 33bcab70334406fb3331b4b3fffbf8c51df52d93efb5d673d865b7a7496b1570
    .exe windows:4 windows x86

    dca093669585f7dd5cb689ef9c0b872b


    Headers

    Imports

    Sections

  • 47a52afd63406238b1b5ce59a7cb282685629b14169405015b0cef20fbe4f62e
    .exe windows:4 windows x86


    Code Sign

    Headers

    Sections

  • 4b24d273019579ba3c1e0ad261954c0941d114aab802fa2d1fcb14dab9f3e869
    .exe windows:4 windows x86


    Headers

    Sections

  • 4c481d251f29295af1af599374ea93f9fc24b6139fbb02ec115bec9f4e7bc25a
    .exe windows:4 windows x86


    Headers

    Sections

  • 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd
    .exe windows:5 windows x86

    40306b615af659fc1f93cfb121cc38d9


    Headers

    Imports

    Sections

  • 50a04b093c8f05481eb672ebec0537f61e233071798d1f3b939e17e333b51795
    .dll regsvr32 windows:4 windows x86

    909f624e572dcec5586bb66b15a6e2e0


    Headers

    Imports

    Exports

    Sections

  • 5266183553addd392a0968ea9e835c00e55a27468829ab65832cda37508c8e2f
    .dll windows:4 windows x86

    dbc85e544dca7716b13cd917d856ee32


    Headers

    Imports

    Exports

    Sections

  • 547798defb6d577ec9f13b00fb1be293f903aaa974ddc049be16d6437aeec86e
    .exe windows:5 windows x86


    Headers

    Sections

  • 5fb2242c04ce18830b84de73c4f0fc4e9c8a5e6877a14f414fcbfaa5a3948896
    .exe windows:4 windows x86

    4afc596e677872a5ef6d27ddd953788c


    Headers

    Imports

    Sections

  • 63a0bf6385356dd0297449bdca2a2f171846315505800e81a4c0285f09c87312
    .exe windows:4 windows x86

    0a274c5d333aa95e832cc4b84514e41e


    Headers

    Imports

    Sections

  • 6a08b51e02a7b510972907c326041222ff4632ba53b89573fca7e80b59c4e168
    .exe windows:4 windows x86

    f622cc721bf8c5cc1be479f646f7409a


    Headers

    Imports

    Sections

  • 803d827a2cd764008783e691ce132ef853dbfa77017e5d2eeae47ceb3ca50f53
    .exe windows:4 windows x86

    4ea4df5d94204fc550be1874e1b77ea7


    Headers

    Imports

    Sections

  • 85523c6377c27e22068a2ef347997a295981b91e103b3cf3387ed80aa0b010c3
    .exe windows:4 windows x86

    98c88d882f01a3f6ac1e5f7dfd761624


    Headers

    Imports

    Sections

  • 8ab3db7349f38d6463a3c6a7155ab297f18d92262a098064ea2472cecc7e3103
    .exe windows:4 windows x86

    aaa734bdf233e7b6248c47353f08a15f


    Headers

    Imports

    Sections

  • 9b87457fe85670e2c059cedaa560a8a31027e96fe18b2b6a7fe610f38423b2f0
    .exe .vbs windows:4 windows x86
  • a3c7b0df189bdd47c7e113ff3b664f26b0bcd6f4f878186e882ea199e15c28cc
    .exe windows:5 windows x86

    462f63682626cfc5c88f45cce550cbee


    Headers

    Imports

    Sections

  • ab4fa067af1c9a107b879341e255eb9f05779608ce31217c1a2d60d28a2c8838
    .exe windows:4 windows x86

    7683d28964209698f6dd9edcf95d8e20


    Headers

    Imports

    Sections

  • b1c5c3ca41c322b47a5feb62ebb0e5daa3c1c682aa1dedb98fd3b7dff3eca57d
    .exe windows:5 windows x86


    Headers

    Sections

  • ca561f9403ab4be76ca66646df1a3da826fa2cc1972dd005ad23861abb317cc5
    .exe windows:4 windows x86


    Headers

    Sections

  • d278eb3d6cc29c6de4b086aaa6214412d62fe2bb850c0ead63a403c3a24b2c8f
    .exe windows:4 windows x86


    Headers

    Sections

  • d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91
    .exe windows:4 windows x86

    4864beef2287df1a1aba41c566ec3cf6


    Headers

    Imports

    Sections

  • d7e876a714e2632fa42e6636177962516736074c76f486dc34de020ec13af0c9
    .exe windows:5 windows x86

    75e120c0b3ae2cd5fd452b1b18eb4bde


    Headers

    Imports

    Sections

  • dd8bf2763ce09cbeb21cdbf802b9f7475c7998e459714150fae07ffcd027bb38
    .exe windows:4 windows x86


    Headers

    Sections

  • dd9ca1355ff3ddd883f9d2d0e6df9b7a8ebff650003a616c533b30554cee2a9a
    .exe windows:4 windows x86


    Headers

    Sections

  • dd9d07d1f5bb4facb1b4e412ce9e52a5ca9a689f2f78c34bacf63af19f7ce127
    .exe windows:4 windows x86


    Headers

    Sections

  • ef3c260fed0a71f0e679261aeb242133899f9ff03d68b5f95711a66ef919e549
    .exe windows:5 windows x86

    55cf7d46d588cca3d1dc219960711b38


    Headers

    Imports

    Sections

  • f40df86d68d075c73e1be8ed5b3201f0e55a9eccf662258a219acee35df398df
    .exe windows:4 windows x86


    Headers

    Sections

  • fb861230c088dd68f1a6c782e9ad0b44a1831ccc29c0516635cc4b3de2a91a01
    .exe windows:4 windows x86

    3c4aced1f950f10bbfafe22fe8451575


    Headers

    Imports

    Sections