Overview

overview

10

Static

static

10

02db3ec764...ce.exe

windows7-x64

09f27e0189...2e.exe

windows7-x64

5

0abe62de95...d2.exe

windows7-x64

7

13ad5c6c04...20.exe

windows7-x64

181d5a2aa3...54.exe

windows7-x64

7

19bdaadf42...ed.exe

windows7-x64

1

1f1cc17473...5e.exe

windows7-x64

8

1f4e927f6e...a4.exe

windows7-x64

222d06b236...66.exe

windows7-x64

8

23b5ce252f...5b.exe

windows7-x64

10

24ebe7609d...a9.exe

windows7-x64

6

25fcedbb8b...78.exe

windows7-x64

26f2bf1fc3...fe.exe

windows7-x64

32a22a65aa...2f.exe

windows7-x64

35fdad147c...8f.exe

windows7-x64

1

36bfd9f40c...07.exe

windows7-x64

1

39a6618795...45.exe

windows7-x64

1

3c8ac670d8...98.exe

windows7-x64

1

401beec1e5...c3.exe

windows7-x64

3

46c17836fd...b2.exe

windows7-x64

54edb6518a...9a.exe

windows7-x64

7

56ec95785f...a4.exe

windows7-x64

1

5c959580ad...bd.dll

windows7-x64

675e7e38d9...a8.exe

windows7-x64

9

6b4f6a820d...96.exe

windows7-x64

1

721ccbb780...29.exe

windows7-x64

3

75a9ade196...1d.exe

windows7-x64

10

7a2aa7c097...bd.exe

windows7-x64

1

87bcc495ec...65.exe

windows7-x64

8d11fa1067...54.exe

windows7-x64

7

97d846563e...3b.exe

windows7-x64

1

9e4e60ee2a...c6.exe

windows7-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dsggggggggggg.rar

  • Size

    8.9MB

  • MD5

    dbec78bdbaba117fd6b57a0ce38693ed

  • SHA1

    1349841ca7396fcb7ec485d73472eb0c99c754c7

  • SHA256

    92e5a2fb9c2403bcdfffc5d91c7cc959da76e0ddd843b2d43a8a3a858f9c90a6

  • SHA512

    e1b3cccf152e030dbd678b4be1dc3f540d4cedf84bbdc6af9a1cae59c46689179bbf45ba2ff49652d14373c94228d132a557b1abb0bf04b434305ac196c407e0

  • SSDEEP

    196608:T30YHEGK6uym+Nky87wjLVjYQ6JaGJIMwF9ksMQkhXap1GVnJ2/aHkOt2b:FJ/ky7PVJAVwF9khXm1GVnJaOt8

Score
10/10
upxaspackv233429sodinokibi

Malware Config

Extracted

Family

sodinokibi

Botnet

33

Campaign

429

Decoy

rvside.com

tzn.nu

parentsandkids.com

ayudaespiritualtamara.com

universelle.fr

mamajenedesigns.com

buerocenter-butzbach-werbemittel.de

janellrardon.com

katherinealy.com

hm-com.com

the-beauty-guides.com

queertube.net

mneti.ru

bohrlochversicherung.info

rino-gmbh.com

karelinjames.com

janasfokus.com

skolaprome.eu

verbouwingsdouche.nl

dogsunlimitedguide.com
Attributes
  • net

    true

  • pid

    33

  • prc

    dbsnmp.exe

    mspub.exe

    encsvc.exe

    sqbcoreservice.exe

    infopath.exe

    firefoxconfig.exe

    sqlwriter.exe

    isqlplussvc.exe

    ocautoupds.exe

    winword.exe

    steam.exe

    mydesktopservice.exe

    msftesql.exe

    ocomm.exe

    synctime.exe

    mysqld_nt.exe

    sqlbrowser.exe

    tbirdconfig.exe

    powerpnt.exe

    wordpad.exe

    outlook.exe

    thebat.exe

    sqlservr.exe

    ocssd.exe

    thebat64.exe

    msaccess.exe

    visio.exe

    sqlagent.exe

    excel.exe

    dbeng50.exe

    agntsvc.exe

    mydesktopqos.exe

    thunderbird.exe

    mysqld.exe

    oracle.exe

    mysqld_opt.exe

    xfssvccon.exe

    onenote.exe

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    429

Signatures

  • Sodinokibi family
    sodinokibi
  • Sodinokibi/Revil sample 1 IoCs
  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 35 IoCs

    Checks for missing Authenticode signature.

Files

  • dsggggggggggg.rar
    .rar
  • 02db3ec76453f4a8ed495b9befac3ce2d51ef58c22d167e25a20bd050f5094ce.exe
    .exe windows:5 windows x86 arch:x86

    353396c72c961cf620fb378efdfac8d3


    Headers

    Imports

    Sections

  • 09f27e01898779236a9f31185667b9f4a97dd1f30c972386fd995502acfb992e.exe
    .exe windows:4 windows x86 arch:x86

    0e6d6fc6375377197a2a401b6bbe37ca


    Headers

    Imports

    Sections

  • 0abe62de95ad966482f445504eb8a385afb8e4b4ba5a36ea34fce13b3da3dad2.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • 13ad5c6c04c32e246dba78cf2e3737470af66b0b73553ab8f025ade626b8a120.exe
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • 181d5a2aa39493c50bc73723047157d843ecbc22d7cb56766eb737f529910854.exe
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections

  • 19bdaadf42c44a28941ff6ecea6925de28caf172acb131085d93c7e56ac5fded.exe
    .exe windows:4 windows x86 arch:x86

    f78d9d06b9070b73486ec891ec3620c5


    Headers

    Imports

    Sections

  • 1f1cc1747387db85919ee8af854dd1afe5239b34a1cdc98c5cea347de804205e.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
    .exe windows:4 windows x64 arch:x64

    efca766733fc46327b4f9355c8be8373


    Headers

    Imports

    Sections

  • 222d06b23600bbd1fd66b6649618e5f3a7f4d81fcb8dfd961680d949aea31a66.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 23b5ce252f1cb3ff40a3bcb3ea53dd674175c3ad782b00e33ae45c8c87fa265b.exe
    .exe windows:5 windows x86 arch:x86

    43ed6e1ea41b9a53f91c91dbf8b95f27


    Headers

    Imports

    Sections

  • 24ebe7609d56c62fca780bf5ef346aa91c0412418f1f85d591005b4509bcbca9.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • 25fcedbb8b0ae97c1e9b7b56e0ce3511976661bbdcf075dfed18b36a58ab5d78.exe
    .exe windows:4 windows x86 arch:x86

    268a1e0271f20a60427afd9c5f92e4ff


    Headers

    Imports

    Sections

  • 26f2bf1fc3ee321d48dce649fae9951220f0f640c69d5433850b469115c144fe.exe
    .exe windows:5 windows x86 arch:x86

    37fafc84b5539386cee216e006f2d799


    Headers

    Imports

    Sections

  • 32a22a65aa2666a6a34f0be77cb6bd3f275bcd1e1c54ad49e187984d76f49e2f.exe
    .exe windows:4 windows x86 arch:x86

    4afc596e677872a5ef6d27ddd953788c


    Headers

    Imports

    Sections

  • 35fdad147c2ab2c36dd7fd1ad1ae26b80be6c501bb22120b741be3ab34be168f.exe
    .exe windows:6 windows x86 arch:x86

    60b49bcc45629d73f7233c4f83703612


    Headers

    Imports

    Sections

  • 36bfd9f40ce0043c878b28ca80dda5315cf681215baf4e1d539456d89b907807.exe
    .exe windows:4 windows x86 arch:x86

    f78d9d06b9070b73486ec891ec3620c5


    Headers

    Imports

    Sections

  • 39a6618795b858d4f9a976c203bb9bee199db3555b9583b308954ccc09cffc45.exe
    .exe windows:1 windows x86 arch:x86


    Headers

    Sections

  • 3c8ac670d8c920170dd431a5a08cbefd62a98e369eb552acbc04a0eeb2f2a198.exe
    .exe windows:5 windows x86 arch:x86

    7af2fe87a3ab930007d141d21c36ceda


    Headers

    Imports

    Sections

  • 401beec1e5e07bfe7d0ebf18d9219f4f0a504284b6f9aab664e8af6e8bef31c3.exe
    .exe windows:4 windows x86 arch:x86

    15654036c21ef7a700e91621275c5bd9


    Headers

    Imports

    Sections

  • 46c17836fd2d65343ca0d1adae5fa3209a1f2a128736c81f5d7d40fe7ee608b2.exe
    .exe windows:4 windows x86 arch:x86

    4afc596e677872a5ef6d27ddd953788c


    Headers

    Imports

    Sections

  • 54edb6518a4ba6561d14cfc2875b281f3a9a87aca7d839c5bc814ef5e6a0229a.exe
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • 56ec95785f91418751ad5788f9076af108ae19e03d2e0c0551ae8f8d8f5acba4.exe
    .exe windows:6 windows x86 arch:x86

    8df505348d6b0f8009519e11bb59d2db


    Headers

    Imports

    Sections

  • 5c959580adf1fbdfea872ece4d29ee6a8319a88273a9923988ef8be4197833bd.exe
    .dll windows:5 windows x86 arch:x86

    e0b0f3e119bdcdb2ff10b051ac75cde0


    Headers

    Imports

    Sections

  • 675e7e38d969e9c0af164337a180b2941d4a676b7e0c345da1de1b2d42ed31a8.exe
    .exe windows:5 windows x86 arch:x86

    bf5a4aa99e5b160f8521cadd6bfe73b8


    Headers

    Imports

    Sections

  • 6b4f6a820d415a88ee156607b13450cbe0bedad4eb05961c55f5926f86262296.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 721ccbb780b308c6c40817749b6764ad06cd2e56389bba1618a0dadc362d6429.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 75a9ade19696be512a894b659c4bebd174a868f404da5479f4fd96494e04c71d.exe
    .exe windows:5 windows x86 arch:x86

    993552dae29051193848bdafd3c378a0


    Headers

    Imports

    Sections

  • 7a2aa7c097a2e48184694d2d70027f7ac4081db7c6d555324aa5f060a37800bd.exe
    .exe windows:4 windows x86 arch:x86

    71efab0179518ac02b0b90889b9dab6a


    Headers

    Imports

    Sections

  • 87bcc495ec10c56b860450897f03869b74c66c2a2bd336d4fff67d2d777ad865.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • 8d11fa106742bd9038bf92ed3b3912b51f9b768ebd85b380081f61940fd92754.exe
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • 97d846563e9c5da173d27fd11a6f182709c665dba0cb3f85a882c7b3e9cd9a3b.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 9e4e60ee2a8a8ce65072e3aa9b648d4e8ff45474a41d374126f3c045901550c6.exe
    .exe windows:4 windows x86 arch:x86

    31a10f02aae886ccb4b8260ae723b46f


    Headers

    Imports

    Sections