Static task
static1
Behavioral task
behavioral1
Sample
fa52e9a0f3ea72b98d34fd2ebb6f6cf57944e3e5e535add59213f0fc2cb612b9.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
fa52e9a0f3ea72b98d34fd2ebb6f6cf57944e3e5e535add59213f0fc2cb612b9.dll
Resource
win10-en-20211208
General
-
Target
fa52e9a0f3ea72b98d34fd2ebb6f6cf57944e3e5e535add59213f0fc2cb612b9
-
Size
164KB
-
MD5
2fa5c892e8c030dc128a2c94e67a69e3
-
SHA1
8fc5d2fc29fc1a7d0824bbf300f98b26741e7156
-
SHA256
fa52e9a0f3ea72b98d34fd2ebb6f6cf57944e3e5e535add59213f0fc2cb612b9
-
SHA512
70b2287921c7bf5f024c5ec01c0ea2e9464f31241e186b85fed74bf8c67ec7a50738b2e1ab7b019b8b7433e09ed3a071420a86e29294aa0dae30ffd16406b3bb
-
SSDEEP
3072:FWeI5JXJRGpUhFiWjmfb+HP+rnRfUmwlzZ2upAK:FWe29/GuzjmfCHWtULD2
Malware Config
Extracted
sodinokibi
25
1300
cp-bap.de
prometeyagro.com.ua
stabilisateur.fr
watchsale.biz
adabible.org
aquacheck.co.za
yournextshoes.com
onlinemarketingsurgery.co.uk
creohn.de
zwemofficial.nl
bilius.dk
aoyama.ac
bychowo.pl
haus-landliebe.de
wademurray.com
worldproskitour.com
c-sprop.com
poems-for-the-soul.ch
brisbaneosteopathic.com.au
renehartman.nl
egpu.fr
5thactors.com
angelsmirrorus.com
brinkdoepke.eu
alnectus.com
energosbit-rp.ru
qrs-international.com
nieuwsindeklas.be
fsbforsale.com
fskhjalmar.se
ox-home.com
kenmccallum.com
blavait.fr
sjtpo.org
humanviruses.org
dinecorp.com
daveystownhouse.com
iexpert99.com
piestar.com
the5thquestion.com
laylavalentine.com
banksrl.co.za
gosouldeep.com
sochi-okna23.ru
bajova.sk
magnetvisual.com
klapanvent.ru
racefietsenblog.nl
indiebizadvocates.org
concontactodirecto.com
noda.com.ua
grancanariaregional.com
aktivfriskcenter.se
pays-saint-flour.fr
lyricalduniya.com
burg-zelem.de
mikegoodfellow.co.uk
geitoniatonaggelon.gr
9nar.com
alabamaroofingllc.com
circlecitydj.com
glas-kuck.de
christianscholz.de
hotelturbo.de
karelinjames.com
aslog.fr
agendatwentytwenty.com
nepressurecleaning.com
metroton.ru
eventosvirtualesexitosos.com
leloupblanc.gr
mneti.ru
karmeliterviertel.com
etgdogz.de
universelle.fr
adterium.com
die-immo-agentur.de
aidanpublishing.co.uk
solutionshosting.co.uk
jayfurnitureco.com
1deals.com
web865.com
jakubrybak.com
jobkiwi.com.ng
n-newmedia.de
mike.matthies.de
ronielyn.com
yvesdoin-aquarelles.fr
julielusktherapy.com
bumbipdeco.site
casinodepositors.com
triplettabordeaux.fr
edrickennedymacfoy.com
enactusnhlstenden.com
amelielecompte.wordpress.com
smarttourism.academy
purepreprod4.com
fitnessblenderstory.com
xn--billigafrgpatroner-stb.se
mollymccarthydesign.com
catering.com
profibersan.com
magrinya.net
zorgboerderijravensbosch.nl
centuryvisionglobal.com
citiscapes-art.com
pourlabretagne.bzh
mrcar.nl
sveneulberg.de
atma.nl
frameshift.it
bcabattoirs.org
furland.ru
customroasts.com
andermattswisswatches.ch
wribrazil.com
pxsrl.it
charlesfrancis.photos
masecologicos.com
animation-pro.co.uk
webforsites.com
explora.nl
housesofwa.com
ykobbqchicken.ca
putzen-reinigen.com
otpusk.zp.ua
fotoeditores.com
mgimalta.com
aberdeenartwalk.org
muller.nl
cleanroomequipment.ie
towelroot.co
matthieupetel.fr
theboardroomafrica.com
bakingismyyoga.com
colored-shelves.com
therapybusinessacademy.com
santastoy.store
bundan.com
reizenmetkinderen.be
dennisverschuur.com
tanatek.com
cardsandloyalty.com
artcase.pl
gaearoyals.com
maxcube24.com.ua
theintellect.edu.pk
rubyaudiology.com
trainiumacademy.com
tbalp.co.uk
irizar.com
handyman-silkeborg.dk
zdrowieszczecin.pl
craftron.com
anleggsregisteret.no
citydogslife.com
ziliak.com
grafikstudio-visuell.de
parksideseniorliving.net
dcc-eu.com
skyscanner.ro
photonag.com
tramadolhealth.com
jobstomoveamerica.org
computer-place.de
wirmuessenreden.com
bjornvanvulpen.nl
schlagbohrmaschinetests.com
tastevirginia.com
awaitspain.com
apiarista.de
nepal-pictures.com
o90.dk
brighthillgroup.com
alwaysdc.com
keyboardjournal.com
campusce.com
johnstonmingmanning.com
goodboyscustom.com
kickittickets.com
oththukaruva.com
heimdalbygg.no
georgemuncey.com
datatri.be
boyfriendsgoal.site
mrkluttz.com
penumbuhrambutkeiskei.com
rs-danmark.dk
techybash.com
nginx.com
pedmanson.com
motocrossplace.co.uk
advanced-removals.co.uk
ludoil.it
lunoluno.com
duthler.nl
acumenconsultingcompany.com
leatherjees.com
billyoart.com
deduktia.fi
charlottelhanna.com
unboxtherapy.site
stringnosis.academy
liveyourheartout.co
sweetz.fr
dierenambulancealkmaar.nl
cap29010.it
mediabolmong.com
finnergo.eu
direitapernambuco.com
smartmind.net
physio-lang.de
coachpreneuracademy.com
invela.dk
ikadomus.com
leadforensics.com
narca.net
drbenveniste.com
smartspeak.com
publicompserver.de
hawthornsretirement.co.uk
michal-s.co.il
elliemaccreative.wordpress.com
zumrutkuyutemel.com
nauticmarine.dk
catalyseurdetransformation.com
cookinn.nl
latableacrepes-meaux.fr
legundschiess.de
simpleitsolutions.ch
hypogenforensic.com
easydental.ae
almamidwifery.com
soncini.ch
carsten.sparen-it.de
fanuli.com.au
mundo-pieces-auto.fr
cincinnatiphotocompany.org
comoserescritor.com
jax-interim-and-projectmanagement.com
kombi-dress.com
druktemakersheerenveen.nl
mindfuelers.com
jollity.hu
liepertgrafikweb.at
csaballoons.com
stanleyqualitysystems.com
denhaagfoodie.nl
rechtenplicht.be
corporacionrr.com
carolynfriedlander.com
skinkeeper.li
mondolandscapes.com
lidkopingsnytt.nu
mesajjongeren.nl
delegationhub.com
nalliasmali.net
nourella.com
morgansconsult.com
pvandambv.nl
chris-anne.com
spacebel.be
miscbo.it
krishnabrawijaya.com
descargandoprogramas.com
diverfiestas.com.es
epicjapanart.com
tetameble.pl
xn--80abehgab4ak0ddz.xn--p1ai
nicksrock.com
singletonfinancial.com
nbva.co.uk
scotlandsroute66.co.uk
hinotruckwreckers.com.au
rivermusic.nl
sshomme.com
trivselsguide.dk
devus.de
altitudeboise.com
phoenixcrane.com
jalkapuu.net
skyboundnutrition.co.uk
randyabrown.com
nrgvalue.com
jobscore.com
site.markkit.com.br
cesep2019.com
biketruck.de
fire-space.com
janmorgenstern.com
belofloripa.be
wallflowersandrakes.com
fann.ru
ronaldhendriks.nl
paradigmlandscape.com
ya-elka.ru
pokemonturkiye.com
shortysspices.com
ingresosextras.online
dentalcircle.com
topvijesti.net
polynine.com
baumfinancialservices.com
banukumbak.com
utilisacteur.fr
walterman.es
hutchstyle.co.uk
napisat-pismo-gubernatoru.ru:443
hnkns.com
marcandy.com
dantreranch.com
iactechnologies.net
martinipstudios.com
wyreforest.net
xrresources.com
lapponiasafaris.com
azloans.com
kamin-somnium.de
entdoctor-durban.com
qwikcoach.com
gurutechnologies.net
uci-france.fr
vitoriaecoturismo.com.br
happycatering.de
powershell.su
kuriero.pro
baikalflot.ru
hostastay.com
thisprettyhair.com
chatberlin.de
mariajosediazdemera.com
advancedeyecare.com
vedsegaard.dk
sellthewrightway.com
ceocenters.com
mac-computer-support-hamburg.de
louiedager.com
eastgrinsteadwingchun.com
pansionatblago.ru
osn.ro
markseymourphotography.co.uk
ruggestar.ch
guohedd.com
molade.nl
acibademmobil.com.tr
crestgood.com
mangimirossana.it
groovedealers.ru
jglconsultancy.com
lsngroupe.com
jag.me
insane.agency
abulanov.com
11.in.ua
bookingwheel.com
wordpress.idium.no
werkzeugtrolley.net
antesacademy.it
finsahome.co.uk
airserviceunlimited.com
bulyginnikitav.000webhostapp.com
greeneyetattoo.com
iron-mine.ru
sprintcoach.com
oncarrot.com
scholarquotes.com
turing.academy
tzn.nu
holocine.de
whoopingcrane.com
manzel.tn
digitale-elite.de
mariannelemenestrel.com
encounter-p.net
sber-biznes.com
lexced.com
activeterroristwarningcompany.com
kerstliedjeszingen.nl
imaginekithomes.co.nz
go.labibini.ch
tellthebell.website
rsidesigns.com
pisofare.co
transifer.fr
designimage.ae
skidpiping.de
slotenmakerszwijndrecht.nl
jdscenter.com
arthakapitalforvaltning.dk
lagschools.ng
so-sage.fr
oraweb.net
circuit-diagramz.com
projektparkiet.pl
patassociation.com
donau-guides.eu
sealgrinderpt.com
promus.ca
jlgraphisme.fr
initconf.com
akwaba-safaris.com
domilivefurniture.com
gatlinburgcottage.com
janellrardon.com
greatofficespaces.net
sololibrerie.it
ramirezprono.com
aheadloftladders.co.uk
3daywebs.com
augen-praxisklinik-rostock.de
clemenfoto.dk
kafkacare.com
muni.pe
bodymindchallenger.com
bavovrienden.nl
cc-experts.de
rizplakatjaya.com
metallbau-hartmann.eu
teethinadaydentalimplants.com
albcleaner.fr
strauchs-wanderlust.info
ownidentity.com
nuohous.com
texanscan.org
min-virksomhed.dk
jacquesgarcianoto.com
acornishstudio.co.uk
alexwenzel.de
itheroes.dk
pharmeko-group.com
weddingceremonieswithtim.com
thiagoperez.com
parentsandkids.com
efficiencyconsulting.es
billigeflybilletter.dk
cmeow.com
avtoboss163.ru:443
forumsittard.nl
adedesign.com
tieronechic.com
rhino-storage.co.uk
rhino-turf.com
envomask.com
fixx-repair.com
luvinsburger.fr
afbudsrejserallinclusive.dk
biblica.com
breathebettertolivebetter.com
avis.mantova.it
thestudio.academy
distrifresh.com
bodet150ans.com
rossomattonecase.it
yourhappyevents.fr
galaniuklaw.com
fbmagazine.ru
frimec-international.es
richardiv.com
triplettagaite.fr
ciga-france.fr
axisoflove.org:443
shortsalemap.com
chatterchatterchatter.com
tesisatonarim.com
sharonalbrightdds.com
operativadigital.com
soundseeing.net
saberconcrete.com
mahikuchen.com
raeoflightmusic.com
shrinkingplanet.com
epsondriversforwindows.com
oscommunity.de
jonnyhooley.com
look.academy
perceptdecor.com
global-migrate.com
wasnederland.nl
apmollerpension.com
cormanmarketing.com
slideevents.be
opt4cdi.com
davedavisphotos.com
levencovka.ru
girlish.ae
glende-pflanzenparadies.de
ayudaespiritualtamara.com
myplaywin3.com
directique.com
justaroundthecornerpetsit.com
hawaiisteelbuilding.com
welovecustomers.fr
campinglaforetdetesse.com
keuken-prijs.nl
ahgarage.com
alattekniksipil.com
tweedekansenloket.nl
ilovefullcircle.com
voetbalhoogeveen.nl
alltagsrassismus-entknoten.de
pureelements.nl
ncn.nl
midwestschool.org
johnkoen.com
motocrosshideout.com
condormobile.fr
arazi.eus
ledyoucan.com
rozmata.com
sppdstats.com
naukaip.ru
hvitfeldt.dk
mustangmarketinggroup.com
edvestors.org
gavelmasters.com
endstarvation.com
juergenblaetz.de
bg.szczecin.pl
kryptos72.com
fta-media.com
linearete.com
111firstdelray.com
rarefoods.ro
agora-collectivites.com
queertube.net
pixelhealth.net
bluelakevision.com
fazagostar.co
rishigangoly.com
dibli.store
askstaffing.com
innovationgames-brabant.nl
5pointpt.com
hensleymarketing.com
monstarrsoccer.com
gta-jjb.fr
kvetymichalovce.sk
ninjaki.com
suitesartemis.gr
thehovecounsellingpractice.co.uk
rolleepollee.com
rtc24.com
auberives-sur-vareze.fr
hoteltantra.com
jimprattmediations.com
denverwynkoopdentist.com
golfclublandgoednieuwkerk.nl
precisetemp.com
fluzfluzrewards.com
k-zubki.ru
asiaartgallery.jp
barbaramcfadyenjewelry.com
brunoimmobilier.com
glennverschueren.be
k-v-f.de
ncjc.ca
alisodentalcare.com
leijstrom.com
rino-gmbh.com
parisschool.ru
focuskontur.com
livedeveloper.com
springfieldplumbermo.com
ikzoekgod.be
b3b.ch
jameswilliamspainting.com
bendel-partner.de
suonenjoen.fi
billscars.net
apogeeconseils.fr
bourchier.org
birthplacemag.com
primemarineengineering.com
four-ways.com
startuplive.org
xn--ziinoapte-6ld.ro
prodentalblue.com
riffenmattgarage.ch
christopherhannan.com
licensed-public-adjuster.com
floweringsun.org
tutvracks.com
mazzaropi.com.br
outstandingminialbums.com
buonabitare.com
ebible.co
clinic-beethovenstrasse-ag.ch
bellesiniacademy.org
rentsportsequip.com
bmw-i-pure-impulse.com
innervisions-id.com
mrmac.com
omnicademy.com
bescomedical.de
gbk-tp1.de
amorbellezaysalud.com
catchup-mag.com
yuanshenghotel.com
thegrinningmanmusical.com
craftingalegacy.com
hepishopping.com
natturestaurante.com.br
medicalsupportco.com
scietech.academy
proffteplo.com
berdonllp.com
uncensoredhentaigif.com
kiraribeaute-nani.com
palmecophilippines.com
peninggibadan.co.id
neolaiamedispa.com
dentourage.com
kosten-vochtbestrijding.be
sbit.ag
memphishealthandwellness.com
matteoruzzaofficial.com
p-ride.live
eshop.design
fotoslubna.com
ijsselbeton.nl
cymru.futbol
amyandzac.com
alpesiberie.com
drbrianhweeks.com
mslp.org
lumturo.academy
stitch-n-bitch.com
hom-frisor.dk
lollachiro.com
husetsanitas.dk
hiddensee-buhne11.de
martha-frets-ceramics.nl
t3brothers.com
lovcase.com
landgoedspica.nl
mercadodelrio.com
successcolony.com.ng
sarahspics.co.uk
trevi-vl.ru
stressreliefadvice.com
parseport.com
lashandbrowenvy.com
fi-institutionalfunds.com
thepixelfairy.com
peppergreenfarmcatering.com.au
premier-iowa.com
signededenroth.dk
agencewho-aixenprovence.fr
brownswoodblog.com
specialtyhomeservicesllc.com
boomerslivinglively.com
line-x.co.uk
stralsund-ansichten.de
cotton-avenue.co.il
g2mediainc.com
jefersonalessandro.com
bohrlochversicherung.info
internestdigital.com
secrets-clubs.co.uk
atelierkomon.com
nevadaruralhousingstudies.org
bluetenreich-brilon.de
perfectgrin.com
qandmmusiccenter.com
bd2fly.com
imagine-entertainment.com
goddardleadership.org
signamedia.de
foerderverein-vatterschule.de
bubbalucious.com
factoriareloj.com
vapiano.fr
broccolisoep.nl
goodherbalhealth.com
ddmgen.com
brannbornfastigheter.se
redctei.co
lassocrm.com
bringmehope.org
gratiocafeblog.wordpress.com
bratek-immobilien.de
xn--80addfr4ahr.dp.ua
affligemsehondenschool.be
buffdaddyblog.com
electricianul.com
agriturismocastagneto.it
elex.is
liverpoolabudhabi.ae
dr-vita.de
scentedlair.com
letterscan.de
fla.se
arabianmice.com
astrographic.com
hotjapaneselesbian.com
baptistdistinctives.org
thegetawaycollective.com
adaduga.info
globalskills.pt
nykfdyrehospital.dk
lisa-poncon.fr
dmlcpa.com
haard-totaal.nl
optigas.com
awag-blog.de
alharsunindo.com
leansupremegarcinia.net
patriotcleaning.net
bonitabeachassociation.com
internalresults.com
kemtron.fr
eurethicsport.eu
annenymus.com
topautoinsurers.net
oportowebdesign.com
subyard.com
jmmartinezilustrador.com
ultimatelifesource.com
lattalvor.com
azerbaycanas.com
livelai.com
logosindustries.com
annida.it
stage-infirmier.fr
margaretmcshane.com
pajagus.fr
sambaglow.com
dreamvoiceclub.org
johnsonweekly.com
teutoradio.de
loysonbryan.com
lmmont.sk
speakaudible.com
benchbiz.com
zuerich-umzug.ch
yourcosmicbeing.com
bluemarinefoundation.com
geoweb.software
kausette.com
larchwoodmarketing.com
smartercashsystem.com
bagaholics.in
hostingbangladesh.net
ideamode.com
makingmillionaires.net
linkbuilding.life
babysitting-hk.helpergo.co
alcye.com
traitware.com
rentingwell.com
modamarfil.com
mazift.dk
nvisionsigns.com
collegetennis.info
tothebackofthemoon.com
slotspinner.com
koncept-m.ru
cmascd.com
moira-cristescu.com
sachainchiuk.com
goeppinger-teppichreinigung.de
sycamoregreenapts.com
interlinkone.com
rename.kz
tchernia-conseil.fr
rattanwarehouse.co.uk
vdolg24.online
cxcompany.com
claudiakilian.de
the-cupboard.co.uk
betterce.com
bcmets.info
fidelitytitleoregon.com
solidhosting.nl
skoczynski.eu
wg-heiligenstadt.de
craftstone.co.nz
rapid5kloan.org
malzomattalar.com
jandhpest.com
michaelfiegel.com
biodentify.ai
kompresory-opravy.com
orchardbrickwork.com
90nguyentuan.com
business-basic.de
quitescorting.com
professionetata.com
bridalcave.com
onesynergyinternational.com
yayasanprimaunggul.org
smartworkplaza.com
wrinstitute.org
dinedrinkdetroit.com
cac2040.com
rvside.com
drnelsonpediatrics.com
zaczytana.com
alaskaremote.com
thesilkroadny.com
mayprogulka.ru
cainlaw-okc.com
metcalfe.ca
advesa.com
vvego.com
netadultere.fr
istantidigitali.com
pinthelook.com
verbouwingsdouche.nl
marmarabasin.com
fascaonline.com
jlwilsonbooks.com
block-optic.com
levelseven.be
amco.net.au
malevannye.ru
achetrabalhos.com
janasfokus.com
katherinealy.com
nxtstg.org
happylublog.wordpress.com
bruut.online
paardcentraal.nl
bayshoreelite.com
rokthetalk.com
the-beauty-guides.com
dnqa.co.uk
lgiwines.com
cuadc.org
eksperdanismanlik.com
gazelle-du-web.com
maryairbnb.wordpress.com
leopoldineroux.com
artvark.nl
flossmoordental.com
eatyoveges.com
mjk.digital
greenrider.nl
tatyanakopieva.ru
mind2muscle.nl
harleystreetspineclinic.com
mensemetgesigte.co.za
elitkeramika-shop.com.ua
arearugcleaningnyc.com
unislaw-narty.pl
triavlete.com
profiz.com
blucamp.com
avisioninthedesert.com
tradenavigator.ch
opticahubertruiz.com
devplus.be
saboboxtel.uk
beandrivingschool.com.au
domaine-des-pothiers.com
onlinetvgroup.com
akcadagofis.com
latteswithleslie.com
ocduiblog.com
advance-refle.com
kroophold-sjaelland.dk
pro-gamer.pl
globalcompliancenews.com
pubcon.com
jaaphoekzema.nl
anchelor.com
enews-qca.com
log-barn.co.uk
der-stempelking.de
atrgroup.it
andreaskildegaard.dk
production-stills.co.uk
o2o-academy.com
pankiss.ru
ketomealprep.academy
drvoip.com
dayenne-styling.nl
teamsegeln.ch
graygreenbiomedservices.com
framemyballs.com
veggienessa.com
ced-elec.com
hekecrm.com
aciscomputers.com
mediahub.co.nz
myfbateam.com
curtsdiscountguns.com
animalfood-online.de
oexebusiness.com
theater-lueneburg.de
spirello.nl
mindsparkescape.com
kdbrh.com
sytzedevries.com
studionumerik.fr
salonlamar.nl
limmortelyouth.com
fysiotherapierijnmond.nl
mursall.de
allinonecampaign.com
selected-minds.de
airvapourbarrier.com
ilveshistoria.com
nationnewsroom.com
nutriwell.com.sg
vipcarrental.ae
agenceassemble.fr
witraz.pl
loparnille.se
from02pro.com
wineandgo.hu
volta.plus
newonestop.com
evsynthacademy.org
grupoexin10.com
a-zpaperwork.eu
ufovidmag.com
littlesaints.academy
terraflair.de
alene.co
hm-com.com
luvbec.com
espaciopolitica.com
schroederschoembs.com
relevantonline.eu
funworx.de
cl0nazepamblog.com
fridakids.com
vitormmcosta.com
photographycreativity.co.uk
cops4causes.org
supercarhire.co.uk
diakonie-weitramsdorf-sesslach.de
kookooo.com
plbinsurance.com
schluesseldienste-hannover.de
spectamarketingdigital.com.br
pinkxgayvideoawards.com
gardenpartner.pl
neonodi.be
carmel-york.com
jeanmonti.com
ygallerysalonsoho.com:443
pilotgreen.com
endlessrealms.net
chomiksy.net
mediogiro.com.ar
m2graph.fr
the3-week-diet.net
autoteamlast.de
omegamarbella.com
blueridgeheritage.com
saint-malo-developpement.fr
radishallgood.com
tages-geldvergleich.de
cssp-mediation.org
testitjavertailut.net
acb-gruppe.ch
agrifarm.dk
tilldeeke.de
eafx.pro
zinnystar.com
angelika-schwarz.com
breakluckrecords.com
richardkershawwines.co.za
innersurrection.com
skolaprome.eu
docarefoundation.org
chinowarehousespace.com
cyberpromote.de
test-teleachat.fr
palema.gr
redpebblephotography.com
mieleshopping.it
eyedoctordallas.com
spartamovers.com
silverbird.dk
angeleyezstripclub.com
galatee-couture.com
victorvictoria.com
buzzneakers.com
theatre-embellie.fr
voice2biz.com
toranjtuition.org
placermonticello.com
awaisghauri.com
auto-opel.ro
kelsigordon.com
hameghlim.com
oro.ae
zealcon.ae
reygroup.pt
stoneridgemontessori.com
reputation-medical.online
buerocenter-butzbach-werbemittel.de
mamajenedesigns.com
satoblog.org
xtensifi.com
altocontatto.net
heuvelland-oaze.nl
lesyeuxbleus.net
lifeinbreaths.com
deziplan.ru
boloria.de
ivancacu.com
stagefxinc.com
phukienbepthanhdat.com
dogsunlimitedguide.com
thenalpa.com
protoplay.ca
ntinasfiloxenia.gr
cascinarosa33.it
speiserei-hannover.de
2020hindsight.info
hostaletdelsindians.es
futurenetworking.com
ravage-webzine.nl
lookandseen.com
metriplica.academy
palmenhaus-erfurt.de
baita.ac
richardmaybury.co.uk
molinum.pt
eos-horlogerie.com
chorusconsulting.net
imajyuku-sozoku.com
premiumweb.com.ua:443
valiant-voice.com
gsconcretecoatings.com
schulz-moelln.de
andrealuchesi.it
dieetuniversiteit.nl
taulunkartano.fi
expohomes.com
beauty-traveller.com
aceroprime.com
belinda.af
skooppi.fi
silkeight.com
limounie.com
kellengatton.com
forextimes.ru
kryddersnapsen.dk
frankgoll.com
campusescalade.com
kristianboennelykke.dk
hospitalitytrainingsolutions.co.uk
switch-made.com
lovetzuchia.com
sunsolutions.es
stathmoulis.gr
forskolinslimeffect.net
pazarspor.org.tr
mbuildinghomes.com
nexstagefinancial.com
kartuindonesia.com
paprikapod.com
hartofurniture.com
olry-cloisons.fr
letsstopsmoking.co.uk
factorywizuk.com
laaisterplakky.nl
tecleados.com
subquercy.fr
unexplored.gr
inewsstar.com
khtrx.com
chainofhopeeurope.eu
mariamalmahdi.com
basindentistry.com
renderbox.ch
dentallabor-luenen.de
bertbutter.nl
-
net
true
-
pid
25
-
prc
dbeng50
encsvc
thebat
mspub
onenote
outlook
xfssvccon
winword
ocautoupds
agntsvc
oracle
firefox
dbsnmp
isqlplussvc
ocomm
powerpnt
sqbcoreservice
wordpa
synctime
sql
visio
tbirdconfig
excel
thunderbird
mydesktopservice
msaccess
steam
ocssd
mydesktopqos
infopath
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
1300
-
svc
veeam
sql
mepocs
sophos
svc$
memtas
backup
vss
Signatures
-
Sodinokibi family
-
Sodinokibi/Revil sample 1 IoCs
Processes:
resource yara_rule sample family_sodinokobi
Files
-
fa52e9a0f3ea72b98d34fd2ebb6f6cf57944e3e5e535add59213f0fc2cb612b9.dll windows x86
c4c29c7e6a6897be412c7fedfcca8fe4
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
SetErrorMode
CreateThread
Sections
.text Size: 43KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 57KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.e4sm3 Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ