General
-
Target
92bfcee9c35d12182819cdbd8a0be9ff
-
Size
92KB
-
MD5
92bfcee9c35d12182819cdbd8a0be9ff
-
SHA1
9df82000b77326f14e12e7ffcbcaba1fecb678f7
-
SHA256
62a27299a63f16f14ab36532e5afc203f817df9eef94630a4873d35d8f685fbd
-
SHA512
6418c2a9807d27a9d15e4a49e7da230ba241d2eaa29518de2186c13322f4b27763f4fcb29e23e5d7171d2f088c35cffaa4f0c8ce374fb0b7fd6dc50f0dac70b8
-
SSDEEP
1536:o73nkB0DyMgQSm9NwcKzwpR+7JICS4AR8ujGC:M/hKzstrZ
Malware Config
Extracted
sodinokibi
$2a$12$/ICg7f9Gs.ilG5uoy7p.EejXpQa61tMjPtceh37712Bv/W34pZTMe
7456
-
net
true
-
pid
$2a$12$/ICg7f9Gs.ilG5uoy7p.EejXpQa61tMjPtceh37712Bv/W34pZTMe
-
prc
mydesktopservice
mydesktopqos
sqbcoreservice
agntsvc
tbirdconfig
excel
outlook
dbsnmp
sql
wordpad
winword
thebat
infopath
powerpnt
synctime
visio
msaccess
xfssvccon
onenote
isqlplussvc
oracle
dbeng50
ocomm
ocssd
mspub
firefox
steam
ocautoupds
thunderbird
encsvc
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
7456
-
svc
veeam
sophos
mepocs
memtas
svc$
backup
sql
vss
Signatures
-
Sodinokibi family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
92bfcee9c35d12182819cdbd8a0be9ff
eb68d746c420bd3a83ab3b0473d926ae
Headers
Imports
Sections