Overview

overview

10

Static

static

10

ransomware...3n.exe

windows7-x64

ransomware...3n.exe

windows10-2004-x64

ransomware...le.exe

windows7-x64

ransomware...le.exe

windows10-2004-x64

ransomware...it.exe

windows7-x64

10

ransomware...it.exe

windows10-2004-x64

10

ransomware...le.exe

windows10-2004-x64

10

ransomware... 5.exe

windows7-x64

10

ransomware... 5.exe

windows10-2004-x64

10

ransomware...de.exe

windows7-x64

10

ransomware...de.exe

windows10-2004-x64

10

ransomware...ck.exe

windows7-x64

7

ransomware...ck.exe

windows10-2004-x64

7

ransomware...ye.exe

windows7-x64

6

ransomware...ye.exe

windows10-2004-x64

6

ransomware...ap.exe

windows7-x64

6

ransomware...ap.exe

windows10-2004-x64

6

ransomware...ya.exe

windows7-x64

6

ransomware...ya.exe

windows10-2004-x64

6

ransomware...om.exe

windows7-x64

10

ransomware...om.exe

windows10-2004-x64

10

ransomware...ab.exe

windows7-x64

10

ransomware...ab.exe

windows10-2004-x64

10

ransomware...ye.exe

windows7-x64

10

ransomware...ye.exe

windows10-2004-x64

10

ransomware...ni.exe

windows7-x64

10

ransomware...ni.exe

windows10-2004-x64

10

ransomware...pt.exe

windows7-x64

10

ransomware...pt.exe

windows10-2004-x64

10

ransomware...ya.exe

windows7-x64

7

ransomware...ya.exe

windows10-2004-x64

7

ransomware...en.exe

windows7-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    faef0354ee5f7c458afa16423e9ab04d.bin

  • Size

    41.4MB

  • MD5

    faef0354ee5f7c458afa16423e9ab04d

  • SHA1

    a30b5673664f797cb40cd287260136e145071b85

  • SHA256

    2eaccf2ffad0c83282b940b5ed1e65f38acacc9e002b48e3bf4f852e1097232a

  • SHA512

    e8f9958c346936da0b1e5a92cc8cf08fbf750029eda3ea341c0ce7e27e452b7ec937a1deb4a147e6694fbcdc60dc2280d30ca709a2d950ed6732482c2337628a

  • SSDEEP

    786432:Ox4aSbJJZiGQkTVugwej6bryq3sdGn/lCKVEKAhiDB9+DZwX1TpIb86PRzOISnxB:OyDCkTb+XpcdMnEAHWZATpIbBPRzOZxB

Score
10/10
upx$2a$10$hipnytfl4yad01j./dips.tdwq.qurm2fbum4pqfinkq45tak6xw65891sodinokibi

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$hIPnYTfL4yAd01j./DIPs.Tdwq.QURm2fbUM4pQFInKQ45tak6xW6

Campaign

5891

Decoy

notmissingout.com

employeesurveys.com

delchacay.com.ar

sw1m.ru

sofavietxinh.com

samnewbyjax.com

pawsuppetlovers.com

panelsandwichmadrid.es

frontierweldingllc.com

antenanavi.com

nokesvilledentistry.com

partnertaxi.sk

tomaso.gr

levihotelspa.fi

myhealth.net.au

midmohandyman.com

kirkepartner.dk

zewatchers.com

lapmangfpt.info.vn

purposeadvisorsolutions.com
Attributes
  • net

    false

  • pid

    $2a$10$hIPnYTfL4yAd01j./DIPs.Tdwq.QURm2fbUM4pQFInKQ45tak6xW6

  • prc

    firefox

    oracle

    visio

    xfssvccon

    steam

    winword

    mspub

    isqlplussvc

    ocssd

    ocautoupds

    mydesktopqos

    outlook

    dbeng50

    sql

    agntsvc

    tbirdconfig

    encsvc

    thebat

    synctime

    onenote

    mydesktopservice

    thunderbird

    excel

    powerpnt

    dbsnmp

    sqbcoreservice

    ocomm

    infopath

    wordpad

    msaccess

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    5891

  • svc

    veeam

    vss

    backup

    sophos

    svc$

    mepocs

    memtas

    sql

Signatures

  • Sodinokibi family
    sodinokibi
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Unsigned PE 40 IoCs

    Checks for missing Authenticode signature.

Files

  • faef0354ee5f7c458afa16423e9ab04d.bin
    .zip

    Password: infected

  • ransomwares/7ev3n/7ev3n.exe
    .exe windows:6 windows x86 arch:x86

    Password: infected

    008aca28b7c001acc5e0ab32fabaad84


    Headers

    Imports

    Sections

  • ransomwares/Annabelle/Annabelle.exe
    .exe windows:4 windows x64 arch:x64

    Password: infected


    Headers

    Sections

  • ransomwares/BadRabbit/BadRabbit.exe
    .exe windows:5 windows x86 arch:x86

    Password: infected

    e3bda9df66f1f9b2b9b7b068518f2af1


    Code Sign

    Headers

    Imports

    Sections

  • ransomwares/Birele/Birele.exe
    .exe windows:10 windows x86 arch:x86

    Password: infected


    Headers

    Sections

  • out.upx
    .exe windows:10 windows x86 arch:x86


    Headers

    Sections

  • ransomwares/Cerber 5/Cerber 5.exe
    .exe windows:5 windows x86 arch:x86

    Password: infected

    604de9c4534997ea4f32f86753fab871


    Code Sign

    Headers

    Imports

    Sections

  • ransomwares/Darkside/Darkside.exe
    .exe windows:5 windows x86 arch:x86

    Password: infected

    17a4bd9c95f2898add97f309fc6f9bcd


    Headers

    Imports

    Sections

  • ransomwares/DeriaLock/DeriaLock.exe
    .exe windows:4 windows x86 arch:x86

    Password: infected

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • ransomwares/Fake GoldenEye/FakeGoldenEye.exe
    .exe windows:5 windows x86 arch:x86

    Password: infected

    aa59bb138ba9dcdca5ef5c1e473df22c


    Headers

    Imports

    Sections

  • ransomwares/Fake GoldenEye/Key.txt
  • ransomwares/Fake PetrWrap/FakePetrWrap.exe
    .exe windows:5 windows x86 arch:x86

    94f5979c154e333230727201857ca2b3


    Headers

    Imports

    Sections

  • ransomwares/Fake PetrWrap/Key.txt
  • ransomwares/FakePetya/FakePetya.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • ransomwares/Fantom/Fantom.exe
    .exe windows:5 windows x86 arch:x86

    bf5a4aa99e5b160f8521cadd6bfe73b8


    Headers

    Imports

    Sections

  • ransomwares/GandCrab/GandCrab.exe
    .exe windows:4 windows x86 arch:x86

    754f05425de4ad06169098be9bbe56cb


    Headers

    Imports

    Sections

  • ransomwares/GoldenEye/GoldenEye.exe
    .exe windows:5 windows x86 arch:x86

    eadbe699c9f56194b9bbdf2dd7631233


    Headers

    Imports

    Sections

  • ransomwares/Huzuni/Huzuni.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • ransomwares/InfinityCrypt/InfinityCrypt.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • ransomwares/JanusPetya/Decryption key.txt
  • ransomwares/JanusPetya/JanusPetya.exe
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • ransomwares/Krotten/Krotten.exe
    .exe windows:4 windows x86 arch:x86

    79fd079e9d3e0619831be2cf92afa94a


    Headers

    Imports

    Sections

  • ransomwares/Locky/Locky.exe
    .exe windows:5 windows x86 arch:x86

    7ff21f6c00d977be0f3e10fe2269c48f


    Headers

    Imports

    Sections

  • ransomwares/Mischa/Mischa.exe
    .exe windows:5 windows x86 arch:x86

    b69d08e7a9e8d45257d48420e3bd8e18


    Headers

    Imports

    Sections

  • ransomwares/MischaV2/MischaV2.exe
    .exe windows:6 windows x86 arch:x86

    f49f0205185750caf2c9a1ab85519307


    Headers

    Imports

    Sections

  • ransomwares/NoMoreRansom/NoMoreRansom.exe
    .exe windows:5 windows x86 arch:x86

    f4aae2cc8a2971ab9714645e85b7edb6


    Headers

    Imports

    Sections

  • ransomwares/NotPetya/NotPetya.exe
    .exe windows:5 windows x86 arch:x86

    adc91e78c31ad4f7f2dc94e73db3a3f2


    Code Sign

    Headers

    Imports

    Sections

  • ransomwares/PetrWrap/PetrWrap(Patched).exe
    .exe windows:5 windows x86 arch:x86

    90cfb770dd8b0646a46fc541c93185a2


    Headers

    Imports

    Sections

  • ransomwares/PetrWrap/PetrWrap.exe
    .exe windows:5 windows x86 arch:x86

    90cfb770dd8b0646a46fc541c93185a2


    Headers

    Imports

    Sections

  • ransomwares/Petya.A/Petya.A.exe
    .exe windows:5 windows x86 arch:x86

    1a63922d5931d1bb8ca5188313f78eaa


    Headers

    Imports

    Sections

  • ransomwares/PetyaMFTDestroyer/Key.txt
  • ransomwares/PetyaMFTDestroyer/PetyaMFTDestroyer.exe
    .exe windows:5 windows x86 arch:x86

    21e4a55f42c2dcfd0d47cf2cda2692aa


    Headers

    Imports

    Sections

  • ransomwares/PolyRansom/PolyRansom.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • ransomwares/PowerPoint/PowerPoint.exe
    .exe windows:4 windows x86 arch:x86

    91b2790c505bbe69e215e722d884b1b4


    Headers

    Imports

    Sections

  • ransomwares/RansomBlox/RansomBlox.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • ransomwares/RedBoot/RedBoot.exe
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • ransomwares/RedEye/RedEye.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • ransomwares/Rensenware/Rensenware.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • ransomwares/Rokku/Rokku.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • ransomwares/Seftad/Seftad.exe
    .exe windows:5 windows x86 arch:x86

    45f43067991f331f7e6d9d92f382f3ef


    Headers

    Imports

    Sections

  • ransomwares/Sodinokibi/Sodinokibi.exe
    .exe windows:5 windows x86 arch:x86

    3eff7b78fa879bdd7bc10b8b899e0ab3


    Headers

    Imports

    Sections

  • ransomwares/ViraLock/ViraLock.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • ransomwares/WannaCry 1.0/WannaCry 1.0.exe
    .exe windows:4 windows x86 arch:x86

    e858a14f217810d78466806d95d7fceb


    Headers

    Imports

    Sections

  • ransomwares/WannaCrypt0r/WannaCrypt0r.exe
    .exe windows:4 windows x86 arch:x86

    68f013d7437aa653a8a98a05807afeb1


    Headers

    Imports

    Sections

  • ransomwares/Wannacry (Plus)/Wannacry (Plus).exe
    .dll windows:4 windows x86 arch:x86

    2e5708ae5fed0403e8117c645fb23e5b


    Headers

    Imports

    Exports

    Sections

  • ransomwares/Windows10Update/Windows10Update.exe
    .exe windows:5 windows x86 arch:x86

    eb97e4fc5518ac300a92a11673825e0b


    Headers

    Imports

    Sections

  • ransomwares/Winlocker.VB6.Blacksod/Winlocker.VB6.Blacksod/WinlockerVB6Blacksod.exe
    .exe windows:5 windows x86 arch:x86

    fdc840a7a99c43c34a60188ec8cc1596


    Headers

    Imports

    Sections

  • ransomwares/Xyeta/Xyeta.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections