sodinokibi | b6e27e49d83f82f0feaa1b41d7b8906b9237e08968bb2cd5ae6f4f97b4c9f5c8

General

Target

ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
Size

160KB
MD5

ee2ffb5c60f9963a1551871a392ed0d0
SHA1

97ac4115665ee440bdf4f6f171337cc4bc3e07d3
SHA256

b6e27e49d83f82f0feaa1b41d7b8906b9237e08968bb2cd5ae6f4f97b4c9f5c8
SHA512

0eed7a60c0322f19bff85489a972f1a15cacf43391d2f497f0a161bdda0c42ac4e86fe4468ee396079db90414e2aa39c8c6758fabca4d856fe935c88c0f10133
SSDEEP

3072:Kt38mD9P3ILbi4eTMlwDCnumJ+2JzmJTfmWL:KdNBPAbnWJmcfmWL

Score

10^/10

sodinokibi defense_evasion discovery execution impact ransomware

Malware Config

Extracted

Path

C:\Users\h0f28a66k-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion h0f28a66k. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/1596C868AA21A8DA 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/1596C868AA21A8DA Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: ptPbijaeFGqk9WXRpxAjZeP6t5xH9wa2J8dVMb6u1rZxVlvZSUWCLcrI4+hhiWWs FTWYP6LxUDPkBPGyEq8+qoPJ1oqwg8o8Q2I4nGLZre0fboQMXSEHlGcAWui8GlPu JyGCWXlpV+377Uvqm+G7mK/6pM4Otuu32Uu2uaHxosvWeYR88/iehFEPCJpyjPP8 MozpgPaQD8RkxWWhOTy0SREw4ErBC3RJSeqKhsXC5paMIR41VdiqR+Gz522sN/Da OzYki8cJeydhoZHW53/AaBFXp7/Rulm7WsY3OnD1zTqozAf11KYJoSFdWIDmcy2C c3xXdwtuNOBqvwChPRGLOmTjwJ4FEZ1fcq3EtNyG7HG7TBpaKi6zTZAQgjG4GOBb +mP/Vy66k09M3ipdVXuBvVafKqbbS++TCH6Zsjsu66RxBbosvBZzwUB/NjvKGGJ5 AHiUOvZVK+hkaAldGLLf2ku7ys7tCGMjHnGwu77s779SItQrPl2ADO19WUxR5AoA e/TJP23BzLfrJt+dnw7U0L1i/W4r0MsS2JRFbTtD3zrZCMyaTyN1LMkb7GeYBIRI jJrAvnTcDLaj4wp4MX3hMVd8NJLNWTo7EhwbuU2AWg3YRU962XrL62Jca6OrVuNF Q41v5/6kDqAd6QkPCDXb2J4uE1wUV4Ub3RlAbHwjmPDTG2QDQ27so1VXLZnSZzwF D6OCkmBRWjieMZsrf3ilbgQG9FPfIroJE7v3ofvULqHa+dUM2gsPoPSBi2QhFpzz 6YUlxVlOBztYz9Xj4sr9vkEj3oNjAbuf793XZFI1GapMc0xqdgDMkOxPTiW8jzoy d47LhdQwCnvPaYuEyJQLPChE5AXzyvxA9sjent274oXt+sH9VQir1XcONiK4JBbg p9bFNgtm33yHxtFUuaTsnW2p0QkwzewTkSxhDJsbyiP6cfQVeAU/gcmzvkf2ZYpG 6m3DZeaer8cFijPkf74ZoXhP9tF054YHJatRr76AGwOtCYs5QdUansYKfzVoOdAp jmXObFcVZ2VZrPwd/mI9PBVtcPX4ExQG+Y5HIGQ+9V3hae91lBfRmZF20IvvyouJ uY/5WyIRRinV4seMHYY5QzQC4BF55bTlfjypGo1TQiQhR04c6YaLYH94DsF9Dl+W bWN0UAhrFc2NiSjdOCsgiV6FhTwAGuhtH07HN3pu3bK2pSglruTQDDM9cXWDvUvv OgzVBhd4X3yndcXxRNk= Extension name: h0f28a66k ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/1596C868AA21A8DA

http://decryptor.top/1596C868AA21A8DA

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened (read-only)	\??\V:	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened (read-only)	\??\J:	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened (read-only)	\??\D:	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened (read-only)	\??\F:	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened (read-only)	\??\L:	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened (read-only)	\??\Y:	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened (read-only)	\??\S:	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened (read-only)	\??\U:	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened (read-only)	\??\W:	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened (read-only)	\??\N:	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened (read-only)	\??\A:	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened (read-only)	\??\E:	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened (read-only)	\??\I:	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened (read-only)	\??\M:	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened (read-only)	\??\T:	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened (read-only)	\??\Z:	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened (read-only)	\??\B:	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened (read-only)	\??\G:	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened (read-only)	\??\H:	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened (read-only)	\??\O:	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened (read-only)	\??\P:	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened (read-only)	\??\R:	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened (read-only)	\??\Q:	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened (read-only)	\??\X:	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1m9.bmp"	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe

Drops file in Program Files directory 28 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\EditSearch.m1v	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened for modification	\??\c:\program files\NewStep.js	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\h0f28a66k-readme.txt	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\h0f28a66k-readme.txt	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ResumeConvertFrom.tiff	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File created	\??\c:\program files\h0f28a66k-readme.txt	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File created	\??\c:\program files (x86)\8a8ddc23.lock	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened for modification	\??\c:\program files\DebugGet.ogg	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened for modification	\??\c:\program files\RemoveNew.wmf	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened for modification	\??\c:\program files\CompressConfirm.wmx	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened for modification	\??\c:\program files\LockCheckpoint.jfif	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened for modification	\??\c:\program files\RedoFormat.jpeg	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened for modification	\??\c:\program files\SendConvertTo.WTV	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened for modification	\??\c:\program files\HideSearch.dxf	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened for modification	\??\c:\program files\InstallStep.ods	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\8a8ddc23.lock	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\8a8ddc23.lock	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ApproveAssert.M2T	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened for modification	\??\c:\program files\InstallConvertFrom.tmp	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File created	\??\c:\program files (x86)\h0f28a66k-readme.txt	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened for modification	\??\c:\program files\MeasureUse.pptx	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened for modification	\??\c:\program files\OpenMove.m1v	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened for modification	\??\c:\program files\StartExport.3gp2	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ImportDisable.rar	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File opened for modification	\??\c:\program files\StopInitialize.mpp	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\8a8ddc23.lock	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File created	\??\c:\program files\8a8ddc23.lock	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\h0f28a66k-readme.txt	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
2856	vssadmin.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1504	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	1420	vssvc.exe
Token: SeRestorePrivilege	1420	vssvc.exe
Token: SeAuditPrivilege	1420	vssvc.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 2404	1504	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe	31
PID 1504 wrote to memory of 2404	1504	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe	31
PID 1504 wrote to memory of 2404	1504	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe	31
PID 1504 wrote to memory of 2404	1504	ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe	31
PID 2404 wrote to memory of 2856	2404	cmd.exe	33
PID 2404 wrote to memory of 2856	2404	cmd.exe	33
PID 2404 wrote to memory of 2856	2404	cmd.exe	33
PID 2404 wrote to memory of 2856	2404	cmd.exe	33

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe"
1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2404
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - System Location Discovery: System Language Discovery
    - Interacts with shadow copies
    PID:2856

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

1

T1047

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

1

T1006

Indicator Removal

2

T1070

File Deletion

Modify Registry

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CabFA96.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\h0f28a66k-readme.txt

Filesize
6KB

MD5
b3972a38d38ec975ce2f17c638288c41

SHA1
3e09881520466a4ff911733df259f4deff513d55

SHA256
1428232297cb2b1296c1bd32b252d20e9debfa791e4e7e8ec94be00a882a01cf

SHA512
9ec4dbb18b41738c9dcf9b57a94ea90176d8b3a4a17d130c7592bac8fcea3e7e136be511b5b06f95b0d2cf58e4265c5e003704bc12a44881f849bd268cad4ab7

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads