General

  • Target

    dsghdrdrdfhdfh.rar

  • Size

    18.6MB

  • MD5

    5cf63fe35f1e994c6b3f0a25c4b9f6ef

  • SHA1

    482c6fbb6b70213376c40e1b2179484344915c02

  • SHA256

    ee48174864ae0ef8c1e2da6b91b17c2f1df32195f69173adcc3013bf97c76ad5

  • SHA512

    e178e5ea5609bd4636a8c464a36cffdb361d1d9c04f05477b153b2640142d914da8c7282fc610b3279dd1acfe521aec9cfb8d5dae8e4a70add244f61766a063d

  • SSDEEP

    393216:sWeta0N6Fh4gSuTVGUYQW+GfB8a8lENPHeG7wW0rDEj/5TKPOB8:oNAz42/9GfBntHeG7wW0rDEj/FeOB8

Malware Config

Extracted

Family

sodinokibi

Botnet

23

Campaign

1306

Decoy

richardkershawwines.co.za

itheroes.dk

medicalsupportco.com

bakingismyyoga.com

goodherbalhealth.com

computer-place.de

cp-bap.de

ahgarage.com

tramadolhealth.com

liepertgrafikweb.at

cascinarosa33.it

opt4cdi.com

spartamovers.com

iactechnologies.net

projektparkiet.pl

carolynfriedlander.com

galaniuklaw.com

lovetzuchia.com

enactusnhlstenden.com

watchsale.biz

Attributes
  • net

    true

  • pid

    23

  • prc

    wordpa

    synctime

    onenote

    excel

    mydesktopqos

    ocomm

    msaccess

    thebat

    firefox

    visio

    steam

    sql

    isqlplussvc

    dbeng50

    winword

    agntsvc

    thunderbird

    dbsnmp

    ocssd

    powerpnt

    infopath

    tbirdconfig

    mspub

    xfssvccon

    oracle

    encsvc

    outlook

    ocautoupds

    mydesktopservice

    sqbcoreservice

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    1306

  • svc

    svc$

    mepocs

    vss

    sophos

    veeam

    memtas

    sql

    backup

Signatures

  • Nirsoft 1 IoCs
  • Sodinokibi family
  • Sodinokibi/Revil sample 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Detects Pyinstaller 1 IoCs
  • Unsigned PE 46 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 4 IoCs

Files

  • dsghdrdrdfhdfh.rar
    .rar
  • 0383282038e4b6b1daa69a9b71bfff42b8091a4004bbe780c98239ada99f77bd.exe
    .exe windows:5 windows x86 arch:x86

    973fad5e8517c63ab0ce5f9271483926


    Headers

    Imports

    Sections

  • 082060e3320870d1d576083e0ee65c06a1104913ae866137f8ca45891c059a76.exe
    .exe windows:6 windows x86 arch:x86

    2fb40ed232ce119fffafdcc8e83b0b1f


    Headers

    Imports

    Sections

  • 1035f1b289e6d88148431da56ed5fb3c3d251b51f38bfd498690537e57a3c8b8.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • 24592b881440b004bfcc51692deef734babdfc0cd5719826bd05ae678584bfb9.exe
    .exe windows:4 windows x86 arch:x86

    7ecf5ef6e5d2e144bae0caf08e9f5ccc


    Headers

    Imports

    Sections

  • 31459fd8f4ca241e9f2eedcaddf848d8be9eaa76f05102b30872eedbe6c250d2.exe
    .exe windows:4 windows x86 arch:x86

    55e0c80a67b6141798f1b63b011a3631


    Headers

    Imports

    Sections

  • 3216f3b1bf985c045c18f16e00abcec112149ce8ecad190c620500f5cefb59ae.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • 43026556eaa76df4544dd37cc1f708eb3df18b7e33969042b343c2b8be4ff697.exe
    .exe windows:4 windows x86 arch:x86

    4afc596e677872a5ef6d27ddd953788c


    Headers

    Imports

    Sections

  • 4499426b05f7f17b48d3aa805681c53aed09b5b48e25c9070c08dbfae464698b.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • 79271d57c531c79536bc0be0d71e3a372bed9c10689257a7727475ab41e3e161.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • *.*/ConfigTool.exe
    .exe windows:5 windows x86 arch:x86

    10d0ef988379db77e47ddff72c346969


    Headers

    Imports

    Sections

  • *.*/GGDUI.dll
    .dll windows:5 windows x86 arch:x86

    47f4cca7bf4e239c0e00d4d07b6f5daf


    Headers

    Imports

    Exports

    Sections

  • *.*/Microsoft.VC90.MFC.manifest
    .xml
  • *.*/Proxy.dat
  • *.*/SinBa.exe
    .exe windows:5 windows x86 arch:x86

    5ba71f6e364587f0d29736119c301aaf


    Headers

    Imports

    Sections

  • *.*/Ver.ini
  • *.*/WatchUpdate.ini
  • *.*/default.zip
    .zip
  • 1star.png
    .png
  • 2star.png
    .png
  • 3star.png
    .png
  • ListBox.xml
    .xml
  • about.xml
    .xml
  • about_logo.png
    .png
  • addr-comb-bg.png
    .png
  • addr-dropdown-d.png
    .png
  • addr-dropdown-h.png
    .png
  • addr-dropdown-n.png
    .png
  • addr-dropup-d.png
    .png
  • addr-dropup-h.png
    .png
  • addr-dropup-n.png
    .png
  • addr-label-01-d.png
    .png
  • addr-label-01-n.png
    .png
  • addr-label-02-d.png
    .png
  • addr-label-02-n.png
    .png
  • bg.jpg
    .png
  • btn-add-d.png
    .png
  • btn-add-h.png
    .png
  • btn-add-n-01.png
    .png
  • btn-add-n-02.png
    .png
  • btn-back-d.png
    .png
  • btn-back-dis.png
    .png
  • btn-back-h.png
    .png
  • btn-back-n-01.png
    .png
  • btn-back-n-02.png
    .png
  • btn-forward-d.png
    .png
  • btn-forward-dis.png
    .png
  • btn-forward-h.png
    .png
  • btn-forward-n-01.png
    .png
  • btn-forward-n-02.png
    .png
  • btn-home-d.png
    .png
  • btn-home-h.png
    .png
  • btn-home-n-01.png
    .png
  • btn-home-n-02.png
    .png
  • btn-refresh-d.png
    .png
  • btn-refresh-dis.png
    .png
  • btn-refresh-h.png
    .png
  • btn-refresh-n-01.png
    .png
  • btn-refresh-n-02.png
    .png
  • btn-tab-close-01-d.png
    .png
  • btn-tab-close-01-h.png
    .png
  • btn-tab-close-01-n.png
    .png
  • btn-tab-close-02-d.png
    .png
  • btn-tab-close-02-h.png
    .png
  • btn-tab-close-02-n.png
    .png
  • commandmenu.xml
    .xml
  • default.png
    .png
  • editwindow.xml
    .xml
  • favorite_hot.png
    .png
  • favorite_normal.png
    .png
  • favorite_push.png
    .png
  • ico-default-dis.png
    .png
  • ico-default.png
    .png
  • ico-menu-feedback-h.png
    .png
  • ico-menu-feedback-n.png
    .png
  • ico-menu-helpcenter-h.png
    .png
  • ico-menu-helpcenter-n.png
    .png
  • ico-menu-quit-h.png
    .png
  • ico-menu-quit-n.png
    .png
  • ico-pic-dis.png
    .png
  • ico-pic.png
    .png
  • ico-skin-checked.png
    .png
  • ico-skin-set.png
    .png
  • icon-closetable-hover.png
    .png
  • icon-closetable-nomal.png
    .png
  • icon-closetable-press.png
    .png
  • icon-closetable-select.png
    .png
  • icon-menu-expand-h.png
    .png
  • icon-menu-expand-n.png
    .png
  • line-h-01.png
    .png
  • line-h-02.png
    .png
  • line-v-01.png
    .png
  • line-v-02.png
    .png
  • loading.gif
    .gif
  • logo-01.png
    .png
  • logo-02-01.png
    .png
  • logo-02-02.png
    .png
  • main_dlg.xml
    .xml
  • main_menu.xml
    .xml
  • menu-bg.png
    .png
  • menu-item-bg.png
    .png
  • menu_private_hide.png
    .png
  • menu_private_show.png
    .png
  • preview.jpg
    .jpg
  • private_bkg.png
    .png
  • private_close_hot.png
    .png
  • private_close_normal.png
    .png
  • private_close_push.png
    .png
  • private_edit_bk.png
    .png
  • private_editcancel_hot.png
    .png
  • private_editcancel_normal.png
    .png
  • private_editcancel_push.png
    .png
  • private_editclose_hot.png
    .png
  • private_editclose_normal.png
    .png
  • private_editclose_push.png
    .png
  • private_editok_hot.png
    .png
  • private_editok_normal.png
    .png
  • private_editok_push.png
    .png
  • private_hot.png
    .png
  • private_more_hot.png
    .png
  • private_more_normal.png
    .png
  • private_moredown_hot.png
    .png
  • private_moredown_normal.png
    .png
  • private_moreup_hot.png
    .png
  • private_moreup_normal.png
    .png
  • private_push.png
    .png
  • privatemenu.xml
    .xml
  • safepictur.png
    .png
  • scroll-hover_press.png
    .png
  • scroll.png
    .png
  • shadow.png
    .png
  • skin.xml
    .xml
  • tab-01-h.png
    .png
  • tab-01-n.png
    .png
  • tab-02-h.png
    .png
  • tab-02-n.png
    .png
  • tab-s.png
    .png
  • winclose-d.png
    .png
  • winclose-h.png
    .png
  • winclose-n-01.png
    .png
  • winclose-n-02.png
    .png
  • winmax-d.png
    .png
  • winmax-h.png
    .png
  • winmax-n-01.png
    .png
  • winmax-n-02.png
    .png
  • winmin-d.png
    .png
  • winmin-h.png
    .png
  • winmin-n-01.png
    .png
  • winmin-n-02.png
    .png
  • winrestore-d.png
    .png
  • winrestore-h.png
    .png
  • winrestore-n-01.png
    .png
  • winrestore-n-02.png
    .png
  • winsetting-d.png
    .png
  • winsetting-h.png
    .png
  • winsetting-n-01.png
    .png
  • winsetting-n-02.png
    .png
  • winskin-d.png
    .png
  • winskin-h.png
    .png
  • winskin-n-01.png
    .png
  • winskin-n-02.png
    .png
  • *.*/local/blank/blank.html
    .html
  • *.*/local/blocklist/blocklist.dat
  • *.*/local/error/error.html
    .html
  • *.*/local/error/offcancl.html
    .html
  • *.*/local/error/reject.html
    .html .js polyglot
  • *.*/local/images/bg.png
    .png
  • *.*/local/images/infobg.png
    .png
  • *.*/local/images/logo.png
    .png
  • *.*/local/navlist/web_nav.html
    .html
  • *.*/local/styles/error.css
  • *.*/log4cxx.dll
    .dll windows:4 windows x86 arch:x86

    59538fe89c921a032c34e66771fba117


    Headers

    Imports

    Exports

    Sections

  • *.*/loginfo.properties
  • *.*/mfc90.dll
    .dll windows:5 windows x86 arch:x86

    f2d8030f2fb5ae92ea26c320740a673b


    Code Sign

    Headers

    Imports

    Sections

  • *.*/mfc90u.dll
    .dll windows:5 windows x86 arch:x86

    814d9e5c82b805568941908a38d8a5f5


    Code Sign

    Headers

    Imports

    Sections

  • *.*/mfcm90.dll
    .dll windows:5 windows x86 arch:x86

    7dabdb1d81bc318202cca27aed9c03e6


    Headers

    Imports

    Exports

    Sections

  • *.*/mfcm90u.dll
    .dll windows:5 windows x86 arch:x86

    8835e897cda95e4221fbfed49b505c04


    Headers

    Imports

    Exports

    Sections

  • *.*/msvcr100.dll
    .dll windows:5 windows x86 arch:x86

    5271d5ce8b44dd47bc92563e27585466


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • *.*/nircmd.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • *.*/profile.dat
  • *.*/pthreadVC2.dll
    .dll windows:5 windows x86 arch:x86

    d3d8c4b714214422e346e26864a896bb


    Headers

    Imports

    Exports

    Sections

  • *.*/signtool.exe
    .exe windows:6 windows x86 arch:x86

    018cef17108f0a49c10d12a42436c93f


    Headers

    Imports

    Sections

  • *.*/update.exe
    .exe windows:5 windows x86 arch:x86

    0e4a994d0c355bbae71fb384faa65e57


    Headers

    Imports

    Exports

    Sections

  • *.*/update.ini
  • *.*/wh.pfx
  • *.*/˫ǩ.bat
  • 843cd39e4f5024ef36fdc142bf2eb9d9dcc05f0b8f7f812d49ddac8a2bf83f29.exe
    .exe windows:4 windows x86 arch:x86

    ed71f42009c90bfb70bae8f702f1eb7b


    Headers

    Imports

    Sections

  • 847001fe67b260c91fdc360297f6758598c41eb78fc4aae6adc4a4e2dd813b7e.exe
    .exe windows:4 windows x86 arch:x86

    f78d9d06b9070b73486ec891ec3620c5


    Headers

    Imports

    Sections

  • 902f0cb92e46d9d3028a9e5b52975f66142648ac90007032aafa9b1e2b5263ad.exe
    .exe windows:5 windows x86 arch:x86

    8d78ed48fee744c8281869827c6dfe96


    Headers

    Imports

    Sections

  • 994d02364001319f2a3fd9318a2f760c79d7dcfddb177940e22cb60765992094.exe
    .dll regsvr32 windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • a006d20ea64758a5219d6a8833a593d99b47c2301e17be2e07593c1565de086b.exe
    .exe windows:4 windows x86 arch:x86

    a4f4c45e15e0c469158548704bbc0adf


    Headers

    Imports

    Sections

  • aaf476e09142ae0b67a0696e3c5d202cda7081c9365f352cfb82068a80e265d5.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • abb979296b15798893029044f06c97a2e98f4ec044c0c34ac27a0dd6bb0b0ff1.exe
    .dll windows:5 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .dll windows:5 windows x86 arch:x86


    Headers

    Sections

  • b630f84b4573831a769170ce7efe73a107b7cd457f499d29fbb622db5c717086.exe
    .exe windows:4 windows x86 arch:x86

    2cdb5118ade9e194fb3c02df82290ccf


    Headers

    Imports

    Sections

  • bd37f1c8f1a0b1333df616db123305e9c138eb3331c1fd66907d4e9df93a4a8e.exe
    .exe windows:4 windows x86 arch:x86

    31c19b5063840eab30ef85de8c67e770


    Headers

    Imports

    Sections

  • c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe
    .exe windows:4 windows x86 arch:x86

    c0e9aa47c61d4237c1a3f0d6c1a0cd01


    Headers

    Imports

    Sections

  • c2a620243b8c161336d68aaccbb7972f083b3e8e30e0fcfaaf9413e46bcbf1bb.exe
    .exe windows:4 windows x86 arch:x86

    4afc596e677872a5ef6d27ddd953788c


    Headers

    Imports

    Sections

  • c3705bab837f5e68ab54a026bf6d23b454f9e6273c919f4d9c43db7c9c37a43b.exe
    .exe windows:4 windows x86 arch:x86

    a4f4c45e15e0c469158548704bbc0adf


    Headers

    Imports

    Sections

  • c97d9bbc80b573bdeeda3812f4d00e5183493dd0d5805e2508728f65977dda15.exe
    .exe windows:5 windows x86 arch:x86

    ce51c671c94cce6379a0f6823fad4112


    Code Sign

    Headers

    Imports

    Sections

  • cad20feffc7b67e394cb667c56211449ccc9c474583e4feacb5c2461dd002c5d.exe
    .exe windows:4 windows x86 arch:x86

    837ece22451809763a7b774ca54613ec


    Headers

    Imports

    Sections

  • d01b92a1d7e00f34549ee537989890699c7ac34c929ea381a4289e49e2d0e4c4.exe
    .dll windows:5 windows x86 arch:x86

    c4c29c7e6a6897be412c7fedfcca8fe4


    Headers

    Imports

    Sections

  • d2a120aa4a8aeb87408828d4e7e0da615cb83e32ca5fccc79eee70bca3ea4d78.exe
    .exe windows:5 windows x86 arch:x86

    d27b8cd6211542e8ebef53d3fbc7b5a8


    Headers

    Imports

    Sections

  • d9f7e34bf8a82e137d47849c6397b51a5c127af99c4a843f8f8223687a05daf1.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • da45ff208be5e193a3da424f6025a3b257dff0c67fab84bd6a9028862fd5cb95.exe
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • dd0d00fec6564d52ad291e8f8a99e981a31ba5fbb623076e8e2864f4591e9bc8.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • e8ae1656c225e8de8e57983db87738630d70036aae6cf1c2b486084edb4aa4dc.exe
    .exe windows:5 windows x86 arch:x86

    9ab626b35fd093ec08860095e85dbc15


    Headers

    Imports

    Sections

  • ed09a020459f1b059bba72c76cd00520c119903b0f8b9fe316a83ced5d66ad0d.exe
    .exe windows:5 windows x86 arch:x86

    d7c965882b0b6b1c448a46004435d65e


    Headers

    Imports

    Sections

  • f0c292785905838d08b27bb99ab260b43fd8de580de80017fdaaab3c3d53d8a6.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • Main.pyc
  • f3771ca98b3a07606cda74128da5d4292572919418f3045196ea245ef63e9150.exe
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections