General

  • Target

    222.7z

  • Size

    3.3MB

  • MD5

    c19d8c566494f5414ccaa717ae98d17b

  • SHA1

    2abe430ad6ff8e274d612f642345e0f7ff5ea394

  • SHA256

    e566ee2189f830504af1cb787279111b7b2f3817a61a85bad8d9810701dd4877

  • SHA512

    76c3daeba66a7ac87081d289d23e98caa86d8c65f860141741435578d55f27a65f8a4785f8d40441e8da9c486253933bf7176731b9e8d32f2936b7e2355ea847

  • SSDEEP

    98304:2DDsqKIhamEzIdlesj2f8UUTyFSI5h6NdOaHd5/Yizrl+jT/:yD5KIMpIdlB2f8bTyFjhaHHd5wisX/

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$xdRGohAYigx9tD2UUlFVu./KzqHpE6XtxVJxJi5bkv/BRYCNLN7i6

Campaign

3472

Decoy

simpliza.com

quickyfunds.com

gasbarre.com

fiscalsort.com

analiticapublica.es

global-kids.info

irinaverwer.com

dw-css.de

pier40forall.org

crowd-patch.co.uk

psnacademy.in

triggi.de

narcert.com

hkr-reise.de

gastsicht.de

xn--fnsterputssollentuna-39b.se

mardenherefordshire-pc.gov.uk

bauertree.com

selfoutlet.com

antiaginghealthbenefits.com

Attributes
  • net

    true

  • pid

    $2a$10$xdRGohAYigx9tD2UUlFVu./KzqHpE6XtxVJxJi5bkv/BRYCNLN7i6

  • prc

    dbeng50

    onenote

    firefox

    tbirdconfig

    synctime

    infopath

    thebat

    sqbcoreservice

    outlook

    powerpnt

    isqlplussvc

    mydesktopservice

    msaccess

    oracle

    steam

    mspub

    winword

    ocautoupds

    ocomm

    agntsvc

    thunderbird

    excel

    dbsnmp

    ocssd

    visio

    wordpad

    mydesktopqos

    encsvc

    xfssvccon

    sql

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    3472

  • svc

    backup

    sophos

    memtas

    svc$

    mepocs

    vss

    sql

    veeam

Extracted

Family

sodinokibi

Botnet

$2a$10$mKbuAybjn4W3ipQCt6E7ROYxmL5SSZgUbPuA7PKUsPqJU10KB4bma

Campaign

7114

Decoy

withahmed.com

scenepublique.net

aglend.com.au

jyzdesign.com

nsec.se

cirugiauretra.es

gopackapp.com

tinyagency.com

crediacces.com

xn--rumung-bua.online

bowengroup.com.au

mastertechengineering.com

kmbshipping.co.uk

homng.net

fitnessingbyjessica.com

oldschoolfun.net

roygolden.com

sotsioloogia.ee

real-estate-experts.com

mir-na-iznanku.com

Attributes
  • net

    false

  • pid

    $2a$10$mKbuAybjn4W3ipQCt6E7ROYxmL5SSZgUbPuA7PKUsPqJU10KB4bma

  • prc

    oracle

    klnagent

    mydesktopqos

    infopath

    BackupExtender

    powerpnt

    outlook

    BackupAgent

    Smc

    sql

    ccSvcHst

    BackupUpdater

    Rtvscan

    winword

    kavfsscs

    ocssd

    isqlplussvc

    visio

    ShadowProtectSvc

    tbirdconfig

    TSSchBkpService

    dbeng50

    ccSetMgr

    agntsvc

    Sage.NA.AT_AU.SysTray

    dbsnmp

    thebat

    onenote

    AmitiAvSrv

    wordpad

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). =========Attention!!!========= Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. ============================== [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    7114

  • svc

    Telemetryserver

    "Sophos AutoUpdate Service"

    sophos

    Altaro.Agent.exe

    mysqld

    MSSQL$MSGPMR

    "SophosFIM"

    "Sophos Web Control Service"

    SQLWriter

    svcGenericHost

    AltiBack

    "SQLServer Analysis Services (MSSQLSERVER)"

    BackupExecAgentAccelerator

    "StorageCraft ImageReady"

    SQLTELEMETRY

    AzureADConnectAuthenticationAgent

    ntrtscan

    ds_notifier

    TeamViewer

    "StorageCraft Raw Agent"

    "StorageCraft Shadow Copy Provider"

    SQLTELEMETRY$SQLEXPRESS

    VeeamHvIntegrationSvc

    AltiCTProxy

    MsDtsServer130

    ViprePPLSvc

    McAfeeFramework

    MSSQL$QM

    "swi_service"

    "ThreadLocker"

Extracted

Family

sodinokibi

Botnet

$2a$12$prOX/4eKl8zrpGSC5lnHPecevs5NOckOUW5r3s4JJYDnZZSghvBkq

Campaign

8254

Decoy

boisehosting.net

fotoideaymedia.es

dubnew.com

stallbyggen.se

koken-voor-baby.nl

juneauopioidworkgroup.org

vancouver-print.ca

zewatchers.com

bouquet-de-roses.com

seevilla-dr-sturm.at

olejack.ru

i-trust.dk

wasmachtmeinfonds.at

appsformacpc.com

friendsandbrgrs.com

thenewrejuveme.com

xn--singlebrsen-vergleich-nec.com

sabel-bf.com

seminoc.com

ceres.org.au

Attributes
  • net

    false

  • pid

    $2a$12$prOX/4eKl8zrpGSC5lnHPecevs5NOckOUW5r3s4JJYDnZZSghvBkq

  • prc

    encsvc

    powerpnt

    ocssd

    steam

    isqlplussvc

    outlook

    sql

    ocomm

    agntsvc

    mspub

    onenote

    winword

    thebat

    excel

    mydesktopqos

    ocautoupds

    thunderbird

    synctime

    infopath

    mydesktopservice

    firefox

    oracle

    sqbcoreservice

    dbeng50

    tbirdconfig

    msaccess

    visio

    dbsnmp

    wordpad

    xfssvccon

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [-] Whats HapPen? [-] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    8254

  • svc

    veeam

    memtas

    sql

    backup

    vss

    sophos

    svc$

    mepocs

Extracted

Family

sodinokibi

Botnet

$2a$10$PRliCdjvILpWha0dXt26COEfG3S.LFJG/H9fqsY0uepzhaO43cC36

Campaign

3665

Decoy

1kbk.com.ua

kalkulator-oszczednosci.pl

creative-waves.co.uk

mirkoreisser.de

fotoideaymedia.es

abogados-en-alicante.es

liikelataamo.fi

klusbeter.nl

jameskibbie.com

marathonerpaolo.com

milestoneshows.com

live-con-arte.de

tinyagency.com

beautychance.se

slwgs.org

midmohandyman.com

herbayupro.com

panelsandwichmadrid.es

baronloan.org

izzi360.com

Attributes
  • net

    false

  • pid

    $2a$10$PRliCdjvILpWha0dXt26COEfG3S.LFJG/H9fqsY0uepzhaO43cC36

  • prc

    visio

    CagService

    VeeamTransportSvc

    dbsnmp

    msaccess

    bedbh

    DellSystemDetect

    encsvc

    VeeamDeploymentSvc

    steam

    mydesktopqos

    sqbcoreservice

    dbeng50

    mydesktopservice

    firefox

    outlook

    tbirdconfig

    raw_agent_svc

    ocomm

    pvlsvr

    isqlplussvc

    sql

    ocautoupds

    thunderbird

    excel

    synctime

    EnterpriseClient

    wordpad

    bengien

    vsnapvss

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome Massive Prints. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    3665

  • svc

    MSSQL

    VeeamTransportSvc

    CAARCUpdateSvc

    AcrSch2Svc

    bedbg

    stc_raw_agent

    sophos

    BackupExecDiveciMediaService

    BackupExecVSSProvider

    VeeamNFSSvc

    CASAD2DWebSvc

    BackupExecAgentAccelerator

    veeam

    vss

    MSSQL$

    MSExchange

    sql

    PDVFSService

    VSNAPVSS

    MVarmor64

    AcronisAgent

    ARSM

    BackupExecRPCService

    VeeamDeploymentService

    svc$

    BackupExecAgentBrowser

    MVArmor

    MSExchange$

    BackupExecJobEngine

    mepocs

Signatures

  • Chaos Ransomware 3 IoCs
  • Chaos family
  • Detected Djvu ransomware 1 IoCs
  • Djvu family
  • GandCrab payload 1 IoCs
  • Gandcrab family
  • Lockbit family
  • MedusaLocker payload 1 IoCs
  • Medusalocker family
  • ModiLoader Second Stage 6 IoCs
  • Modiloader family
  • Rule to detect Lockbit 3.0 ransomware Windows payload 3 IoCs
  • Sodinokibi family
  • Unsigned PE 31 IoCs

    Checks for missing Authenticode signature.

Files

  • 222.7z
    .7z
  • 0715240d1af82c1cea262cde2a286b8b400805dc1f35f49422c7ee39e00f93ce.exe
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • 07fec2205cbbf2900ede2f6a1d9a5c428ef314c1dda559c632833a9c1d121542.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 10dc6e128c7e5e7088f487ba9b22c1a836f50a552bc93fcce748d7e1c8f76fc0.exe
    .exe windows:5 windows x86 arch:x86

    7848011b763d00cd02658995847dd30b


    Headers

    Imports

    Sections

  • 133bf8be0cf7003b83b03579970997d408a930e58ec2726715140520900c06de.exe
    .exe windows:5 windows x86 arch:x86

    7ecacfc6f1d64067e0047425ad885408


    Headers

    Imports

    Sections

  • 139a8bb2c5537190e747d2f651b423147018fd9a9a21bb36281d4ce1c61727c1.exe
    .exe windows:5 windows x86 arch:x86

    f5346a7d2508fd5976d3449f3afc971d


    Headers

    Imports

    Sections

  • 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe
    .exe windows:5 windows x86 arch:x86

    216df81b1ef7bc2aa8ec52bbeef137c9


    Headers

    Imports

    Sections

  • 2896b38ec3f5f196a9d127dbda3f44c7c29c844f53ae5f209229d56fd6f2a59c.exe
    .exe windows:5 windows x86 arch:x86

    031931d2f2d921a9d906454d42f21be0


    Headers

    Imports

    Sections

  • 2d301697ff72986171c0b2ccc979ab8e93671d640de6abad57de7d4e146b70f4.exe
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • 3337576503c3e2d8876f50191ae8995b04a4536f816025c543d0e20250598fd8.exe
    .exe windows:1 windows x86 arch:x86


    Headers

    Sections

  • 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe
    .exe windows:5 windows x86 arch:x86

    41fb8cb2943df6de998b35a9d28668e8


    Code Sign

    Headers

    Imports

    Sections

  • 3e6fbc358e0204cb67a41b05771fac74f1b49737c7ab7138e415c7e9628ef545.exe
    .exe windows:5 windows x86 arch:x86

    f3d46e2f8717ced6d4b220e65d6ad18a


    Headers

    Imports

    Sections

  • 3f7458e658401c15b675db78a2e9871ca3eeff3c6e299c4545515e56b66466df.exe
    .exe windows:1 windows x86 arch:x86


    Headers

    Sections

  • 434ea9832e6d11d614905e3eb31c333289429095b76573f1ceb38fd10608bc27.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 47792144c9b440b3d2fbd422f68a23a8a8dfc16466d2a7430fc283a9d382826f.exe
    .exe windows:1 windows x86 arch:x86


    Headers

    Sections

  • 5114aae6e86c7eedfbf181110e4fddfad88fe296ec590390705e00272121e48c.exe
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • 537a2fd4d214a212df06fb73b19ba945672eaf18d64cc30d8e99ab6a0d7cb9ba.exe
    .exe windows:4 windows x86 arch:x86

    32c5de998b5f069b26c94c8143b13c06


    Headers

    Imports

    Sections

  • 55754358ddd26b3c56ca27780dcc408711f8a9fc42b1c9d305d1045146f40f1c.exe
    .exe windows:1 windows x86 arch:x86


    Headers

    Sections

  • 5b1caa9bec8d7d7833b0e25f3e4256975c38a22c2901f8e4d99fb164dfde13c1.exe
    .exe windows:1 windows x86 arch:x86


    Headers

    Sections

  • 60c24a4c6b54b1f4baeaee585e5e2486bbd3ab4733de36bb28da1fdb20596e21.exe
    .exe windows:6 windows x86 arch:x86

    ca33a8184e94a42bd80f3c63b367c41f


    Headers

    Imports

    Sections

  • 63396a28b79a7eaa60c384bcb02699398cd3b2b0c14fe9cfaf52b2ffa57798cc.exe
    .exe windows:5 windows x86 arch:x86

    b62822ee3c186ba00a459602c16cff0e


    Headers

    Imports

    Sections

  • 78d4fce0c253356bf72cf72f260f27a3f0f3cf0a904a3618f3011cbe0b4e882e.exe
    .exe windows:5 windows x86 arch:x86

    50e1f8f4ffaf0027d5b9f05d6a625798


    Headers

    Imports

    Sections

  • 7c27b9fef6e94e99092fb628716ae9114385d4d5753f72bff1221bad2eb54933.exe
    .exe windows:5 windows x86 arch:x86

    84bbc9e4e9988ea3458fbbc685710182


    Headers

    Imports

    Sections

  • 81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
    .exe windows:5 windows x86 arch:x86

    be7a6c7245cc62652777c427fdb24506


    Headers

    Imports

    Sections

  • 995a91e668b85a992c8a71aed191fa0fafa3b1606bf205bef93a2457786de555.exe
    .exe windows:5 windows x86 arch:x86

    f527e8080fac9432953c548a4f7317af


    Headers

    Imports

    Sections

  • 9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
    .exe windows:5 windows x86 arch:x86

    f527e8080fac9432953c548a4f7317af


    Headers

    Imports

    Sections

  • a597d34bc2464c3ace48ac04f6653f65ac4822ea8e4a5717ba9e4909b8c62240.exe
    .exe windows:1 windows x86 arch:x86


    Headers

    Sections

  • a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe
    .exe windows:5 windows x86 arch:x86

    89b43582b27abefb2b74684ab12a2f8e


    Headers

    Imports

    Sections

  • add2850732c42683ee92ba555bbffb88bf5a4eee7c51e24f15a898f2d5aff66b.exe
    .exe windows:6 windows x86 arch:x86

    f2a8a842c869f344b4d75729bc60feed


    Headers

    Imports

    Sections

  • b098486c49a73591ca003f20276f1ca33605618a7167407d9f3f096bc7ec930d.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • b923f1d2ece074dabe58bb6a603ed5d49e8d62044a1293a37e8afbcac029dded.exe
    .exe windows:5 windows x86 arch:x86

    41fb8cb2943df6de998b35a9d28668e8


    Headers

    Imports

    Sections

  • bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe
    .exe windows:6 windows x86 arch:x86

    b4d5733390854900e9a765684837c828


    Headers

    Imports

    Sections

  • c3fb821138d38ef9a2b0c77a4a3572ca38499b2dac3530c4a5faf2f789d57fc1.exe
    .exe windows:6 windows x86 arch:x86

    41e04b00ee73b43d4045563a97c09f68


    Headers

    Imports

    Sections