Static task
static1
Behavioral task
behavioral1
Sample
ece4c1e4c72a361db47c69df061a2aeccddb5dba17d8fb1eff6cad0a67975b2b.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
ece4c1e4c72a361db47c69df061a2aeccddb5dba17d8fb1eff6cad0a67975b2b.exe
Resource
win10-en-20211208
General
-
Target
ece4c1e4c72a361db47c69df061a2aeccddb5dba17d8fb1eff6cad0a67975b2b
-
Size
164KB
-
MD5
85edb2d3679069c14a745d32a06aadc2
-
SHA1
a940552eedff6ffc2565c10fc9445b5fc5ac2960
-
SHA256
ece4c1e4c72a361db47c69df061a2aeccddb5dba17d8fb1eff6cad0a67975b2b
-
SHA512
40dbe54a72fef2ff455a6a4a603c1134d3c178f50afa06bef3c6360117db10d30bdd3b83d85fdd216cf642991cab01ffdf16b6398bb45fd8a97d0d21f905eeae
-
SSDEEP
3072:FHixaVZFiOCDJtOicNDWEzZMgJndDOygxB:FHigLF5CCj5zZZVdyygP
Malware Config
Extracted
sodinokibi
28
1182
andrealuchesi.it
furland.ru
phukienbepthanhdat.com
randyabrown.com
foerderverein-vatterschule.de
coachpreneuracademy.com
turing.academy
otpusk.zp.ua
beauty-traveller.com
oro.ae
catalyseurdetransformation.com
spectamarketingdigital.com.br
carsten.sparen-it.de
stressreliefadvice.com
pankiss.ru
nginx.com
atelierkomon.com
augen-praxisklinik-rostock.de
lexced.com
amelielecompte.wordpress.com
yournextshoes.com
aciscomputers.com
block-optic.com
rhino-turf.com
brunoimmobilier.com
bertbutter.nl
riffenmattgarage.ch
mercadodelrio.com
der-stempelking.de
trivselsguide.dk
citydogslife.com
xn--80addfr4ahr.dp.ua
avisioninthedesert.com
edrickennedymacfoy.com
hm-com.com
rubyaudiology.com
craftron.com
supercarhire.co.uk
m2graph.fr
forskolinslimeffect.net
nvisionsigns.com
mollymccarthydesign.com
dentourage.com
licensed-public-adjuster.com
billigeflybilletter.dk
designimage.ae
internalresults.com
jollity.hu
malzomattalar.com
hensleymarketing.com
dmlcpa.com
mahikuchen.com
mensemetgesigte.co.za
redpebblephotography.com
clinic-beethovenstrasse-ag.ch
qandmmusiccenter.com
glende-pflanzenparadies.de
dinedrinkdetroit.com
kombi-dress.com
zdrowieszczecin.pl
whoopingcrane.com
condormobile.fr
mamajenedesigns.com
diverfiestas.com.es
citiscapes-art.com
elitkeramika-shop.com.ua
business-basic.de
parentsandkids.com
motocrosshideout.com
activeterroristwarningcompany.com
happycatering.de
imaginekithomes.co.nz
andreaskildegaard.dk
santastoy.store
birthplacemag.com
bjornvanvulpen.nl
hypogenforensic.com
silverbird.dk
utilisacteur.fr
mindsparkescape.com
ludoil.it
holocine.de
aktivfriskcenter.se
morgansconsult.com
rs-danmark.dk
benchbiz.com
theater-lueneburg.de
kuriero.pro
muni.pe
golfclublandgoednieuwkerk.nl
zorgboerderijravensbosch.nl
palmecophilippines.com
topvijesti.net
angelsmirrorus.com
tzn.nu
bookingwheel.com
mariamalmahdi.com
look.academy
alene.co
eafx.pro
stanleyqualitysystems.com
bundan.com
satoblog.org
limmortelyouth.com
ijsselbeton.nl
racefietsenblog.nl
fascaonline.com
iactechnologies.net
boomerslivinglively.com
nourella.com
humanviruses.org
martinipstudios.com
cssp-mediation.org
iexpert99.com
wribrazil.com
mondolandscapes.com
electricianul.com
gsconcretecoatings.com
inewsstar.com
angelika-schwarz.com
breakluckrecords.com
qrs-international.com
mieleshopping.it
fann.ru
g2mediainc.com
husetsanitas.dk
miscbo.it
rename.kz
unboxtherapy.site
broccolisoep.nl
kvetymichalovce.sk
jacquesgarcianoto.com
kemtron.fr
lollachiro.com
itheroes.dk
omegamarbella.com
adterium.com
circuit-diagramz.com
globalcompliancenews.com
putzen-reinigen.com
agriturismocastagneto.it
mbuildinghomes.com
ronaldhendriks.nl
hekecrm.com
teamsegeln.ch
sytzedevries.com
docarefoundation.org
bakingismyyoga.com
klapanvent.ru
baptistdistinctives.org
kafkacare.com
5thactors.com
trevi-vl.ru
thegrinningmanmusical.com
entdoctor-durban.com
efficiencyconsulting.es
jglconsultancy.com
eksperdanismanlik.com
craftingalegacy.com
adaduga.info
innovationgames-brabant.nl
theboardroomafrica.com
tbalp.co.uk
fysiotherapierijnmond.nl
cmascd.com
fla.se
agenceassemble.fr
saboboxtel.uk
digitale-elite.de
markseymourphotography.co.uk
directique.com
csaballoons.com
beandrivingschool.com.au
margaretmcshane.com
oththukaruva.com
physio-lang.de
edvestors.org
production-stills.co.uk
sellthewrightway.com
sprintcoach.com
onlinemarketingsurgery.co.uk
autoteamlast.de
thisprettyhair.com
osn.ro
advancedeyecare.com
ronielyn.com
glas-kuck.de
ox-home.com
rozmata.com
bajova.sk
piestar.com
veggienessa.com
tramadolhealth.com
johnkoen.com
bychowo.pl
mariajosediazdemera.com
artvark.nl
singletonfinancial.com
elliemaccreative.wordpress.com
nykfdyrehospital.dk
belinda.af
delegationhub.com
michaelfiegel.com
mrmac.com
parksideseniorliving.net
radishallgood.com
pinkxgayvideoawards.com
lumturo.academy
paprikapod.com
goddardleadership.org
anleggsregisteret.no
ingresosextras.online
vipcarrental.ae
askstaffing.com
ygallerysalonsoho.com:443
grupoexin10.com
fitnessblenderstory.com
eastgrinsteadwingchun.com
the3-week-diet.net
testitjavertailut.net
min-virksomhed.dk
stabilisateur.fr
bruut.online
dantreranch.com
leatherjees.com
lidkopingsnytt.nu
toranjtuition.org
worldproskitour.com
juergenblaetz.de
techybash.com
simpleitsolutions.ch
bridalcave.com
eos-horlogerie.com
irizar.com
brannbornfastigheter.se
hnkns.com
eventosvirtualesexitosos.com
magrinya.net
kerstliedjeszingen.nl
fazagostar.co
clemenfoto.dk
ikzoekgod.be
vvego.com
agencewho-aixenprovence.fr
linkbuilding.life
finnergo.eu
thegetawaycollective.com
sharonalbrightdds.com
kickittickets.com
initconf.com
boloria.de
wrinstitute.org
yourhappyevents.fr
scentedlair.com
rentsportsequip.com
malevannye.ru
ciga-france.fr
ivancacu.com
stathmoulis.gr
arthakapitalforvaltning.dk
opt4cdi.com
cascinarosa33.it
fotoslubna.com
achetrabalhos.com
flossmoordental.com
palema.gr
rtc24.com
brownswoodblog.com
drnelsonpediatrics.com
pisofare.co
voice2biz.com
martha-frets-ceramics.nl
insane.agency
tweedekansenloket.nl
pilotgreen.com
jandhpest.com
eatyoveges.com
louiedager.com
arabianmice.com
devplus.be
perfectgrin.com
pixelhealth.net
lapponiasafaris.com
yayasanprimaunggul.org
mneti.ru
cac2040.com
line-x.co.uk
hostastay.com
geitoniatonaggelon.gr
descargandoprogramas.com
skolaprome.eu
yuanshenghotel.com
nutriwell.com.sg
jonnyhooley.com
cesep2019.com
kookooo.com
guohedd.com
k-v-f.de
buonabitare.com
go.labibini.ch
jakubrybak.com
cp-bap.de
mustangmarketinggroup.com
ncjc.ca
successcolony.com.ng
creohn.de
modamarfil.com
specialtyhomeservicesllc.com
marcandy.com
floweringsun.org
slotenmakerszwijndrecht.nl
shortysspices.com
welovecustomers.fr
ebible.co
bulyginnikitav.000webhostapp.com
90nguyentuan.com
ultimatelifesource.com
legundschiess.de
signamedia.de
hom-frisor.dk
adabible.org
mjk.digital
sambaglow.com
aceroprime.com
plbinsurance.com
thehovecounsellingpractice.co.uk
acibademmobil.com.tr
wirmuessenreden.com
natturestaurante.com.br
baumfinancialservices.com
domilivefurniture.com
jmmartinezilustrador.com
acumenconsultingcompany.com
ilovefullcircle.com
laaisterplakky.nl
lassocrm.com
nepressurecleaning.com
ideamode.com
nxtstg.org
rarefoods.ro
moira-cristescu.com
hameghlim.com
bluemarinefoundation.com
lisa-poncon.fr
innervisions-id.com
spirello.nl
dinecorp.com
bourchier.org
deziplan.ru
circlecitydj.com
hoteltantra.com
karmeliterviertel.com
kausette.com
triplettagaite.fr
bilius.dk
pxsrl.it
arearugcleaningnyc.com
georgemuncey.com
oscommunity.de
a-zpaperwork.eu
customroasts.com
collegetennis.info
zinnystar.com
karelinjames.com
nbva.co.uk
newonestop.com
operativadigital.com
cyberpromote.de
tetameble.pl
handyman-silkeborg.dk
sycamoregreenapts.com
ziliak.com
grancanariaregional.com
metcalfe.ca
pureelements.nl
11.in.ua
dentalcircle.com
skinkeeper.li
aidanpublishing.co.uk
jalkapuu.net
hutchstyle.co.uk
lsngroupe.com
thenalpa.com
bescomedical.de
grafikstudio-visuell.de
poems-for-the-soul.ch
fi-institutionalfunds.com
gatlinburgcottage.com
matthieupetel.fr
graygreenbiomedservices.com
smartspeak.com
muller.nl
stagefxinc.com
keuken-prijs.nl
animation-pro.co.uk
hiddensee-buhne11.de
kdbrh.com
landgoedspica.nl
myfbateam.com
dreamvoiceclub.org
azerbaycanas.com
catchup-mag.com
perceptdecor.com
chris-anne.com
casinodepositors.com
rechtenplicht.be
gardenpartner.pl
dr-vita.de
agrifarm.dk
volta.plus
switch-made.com
burg-zelem.de
latableacrepes-meaux.fr
smartmind.net
deduktia.fi
amorbellezaysalud.com
frankgoll.com
richardiv.com
tutvracks.com
precisetemp.com
auto-opel.ro
neolaiamedispa.com
bodymindchallenger.com
distrifresh.com
glennverschueren.be
chainofhopeeurope.eu
alaskaremote.com
taulunkartano.fi
billscars.net
vapiano.fr
lookandseen.com
acb-gruppe.ch
zuerich-umzug.ch
towelroot.co
magnetvisual.com
mursall.de
ya-elka.ru
greatofficespaces.net
voetbalhoogeveen.nl
skoczynski.eu
cainlaw-okc.com
renderbox.ch
tothebackofthemoon.com
traitware.com
justaroundthecornerpetsit.com
corporacionrr.com
eshop.design
greeneyetattoo.com
subyard.com
xn--80abehgab4ak0ddz.xn--p1ai
endstarvation.com
walterman.es
blueridgeheritage.com
centuryvisionglobal.com
pedmanson.com
smarttourism.academy
smartworkplaza.com
albcleaner.fr
galatee-couture.com
sveneulberg.de
livedeveloper.com
espaciopolitica.com
kenmccallum.com
alabamaroofingllc.com
rentingwell.com
tastevirginia.com
vedsegaard.dk
advesa.com
pansionatblago.ru
liverpoolabudhabi.ae
mind2muscle.nl
redctei.co
the5thquestion.com
cc-experts.de
invela.dk
craftstone.co.nz
bg.szczecin.pl
auberives-sur-vareze.fr
johnstonmingmanning.com
galaniuklaw.com
angeleyezstripclub.com
jefersonalessandro.com
alwaysdc.com
tages-geldvergleich.de
endlessrealms.net
brinkdoepke.eu
akwaba-safaris.com
dogsunlimitedguide.com
astrographic.com
ikadomus.com
pays-saint-flour.fr
bratek-immobilien.de
fbmagazine.ru
mac-computer-support-hamburg.de
leansupremegarcinia.net
onesynergyinternational.com
aquacheck.co.za
aoyama.ac
dierenambulancealkmaar.nl
oportowebdesign.com
indiebizadvocates.org
leopoldineroux.com
rishigangoly.com
axisoflove.org:443
nexstagefinancial.com
purepreprod4.com
littlesaints.academy
site.markkit.com.br
renehartman.nl
blucamp.com
enactusnhlstenden.com
sarahspics.co.uk
xrresources.com
tecleados.com
expohomes.com
linearete.com
cotton-avenue.co.il
prometeyagro.com.ua
oraweb.net
arazi.eus
kiraribeaute-nani.com
gavelmasters.com
claudiakilian.de
apiarista.de
bcabattoirs.org
stralsund-ansichten.de
dieetuniversiteit.nl
belofloripa.be
speakaudible.com
trainiumacademy.com
thiagoperez.com
therapybusinessacademy.com
gratiocafeblog.wordpress.com
ayudaespiritualtamara.com
fsbforsale.com
pourlabretagne.bzh
nauticmarine.dk
jlgraphisme.fr
reputation-medical.online
publicompserver.de
jag.me
luvinsburger.fr
awaitspain.com
dibli.store
leijstrom.com
avtoboss163.ru:443
sunsolutions.es
aslog.fr
penumbuhrambutkeiskei.com
biblica.com
datatri.be
opticahubertruiz.com
shortsalemap.com
buerocenter-butzbach-werbemittel.de
promus.ca
ceocenters.com
ledyoucan.com
encounter-p.net
mikegoodfellow.co.uk
chatterchatterchatter.com
cormanmarketing.com
colored-shelves.com
rivermusic.nl
kartuindonesia.com
pharmeko-group.com
letsstopsmoking.co.uk
marmarabasin.com
studionumerik.fr
suonenjoen.fi
hepishopping.com
c-sprop.com
shrinkingplanet.com
carolynfriedlander.com
gazelle-du-web.com
richardkershawwines.co.za
stringnosis.academy
curtsdiscountguns.com
the-cupboard.co.uk
sshomme.com
mundo-pieces-auto.fr
bubbalucious.com
bonitabeachassociation.com
breathebettertolivebetter.com
queertube.net
loparnille.se
o2o-academy.com
advanced-removals.co.uk
sochi-okna23.ru
buffdaddyblog.com
frameshift.it
sololibrerie.it
cap29010.it
tilldeeke.de
solutionshosting.co.uk
9nar.com
jdscenter.com
webforsites.com
parisschool.ru
hawaiisteelbuilding.com
manzel.tn
soundseeing.net
duthler.nl
julielusktherapy.com
bellesiniacademy.org
cmeow.com
greenrider.nl
startuplive.org
livelai.com
yourcosmicbeing.com
n-newmedia.de
log-barn.co.uk
schlagbohrmaschinetests.com
happylublog.wordpress.com
levencovka.ru
subquercy.fr
banukumbak.com
5pointpt.com
pvandambv.nl
werkzeugtrolley.net
smartercashsystem.com
reygroup.pt
dentallabor-luenen.de
rhino-storage.co.uk
computer-place.de
drbrianhweeks.com
stage-infirmier.fr
cymru.futbol
raeoflightmusic.com
ncn.nl
janmorgenstern.com
jobstomoveamerica.org
kryddersnapsen.dk
internestdigital.com
spartamovers.com
avis.mantova.it
mgimalta.com
lunoluno.com
keyboardjournal.com
kompresory-opravy.com
suitesartemis.gr
gbk-tp1.de
dennisverschuur.com
fskhjalmar.se
tatyanakopieva.ru
bd2fly.com
davedavisphotos.com
transifer.fr
campusescalade.com
forextimes.ru
paardcentraal.nl
cardsandloyalty.com
narca.net
evsynthacademy.org
hotjapaneselesbian.com
azloans.com
biodentify.ai
charlottelhanna.com
liveyourheartout.co
mindfuelers.com
heuvelland-oaze.nl
ramirezprono.com
leadforensics.com
dcc-eu.com
orchardbrickwork.com
palmenhaus-erfurt.de
charlesfrancis.photos
wasnederland.nl
fta-media.com
fanuli.com.au
elex.is
jimprattmediations.com
goodherbalhealth.com
michal-s.co.il
betterce.com
tesisatonarim.com
lattalvor.com
billyoart.com
thestudio.academy
denverwynkoopdentist.com
professionetata.com
pubcon.com
akcadagofis.com
mazzaropi.com.br
die-immo-agentur.de
ravage-webzine.nl
zealcon.ae
profibersan.com
thesilkroadny.com
interlinkone.com
so-sage.fr
altitudeboise.com
prodentalblue.com
1deals.com
outstandingminialbums.com
teethinadaydentalimplants.com
zumrutkuyutemel.com
tanatek.com
altocontatto.net
epsondriversforwindows.com
bayshoreelite.com
antesacademy.it
crestgood.com
speiserei-hannover.de
larchwoodmarketing.com
relevantonline.eu
bohrlochversicherung.info
adedesign.com
ykobbqchicken.ca
thepixelfairy.com
biketruck.de
berdonllp.com
ketomealprep.academy
easydental.ae
noda.com.ua
limounie.com
fidelitytitleoregon.com
catering.com
lovcase.com
bodet150ans.com
quitescorting.com
cops4causes.org
skidpiping.de
banksrl.co.za
kristianboennelykke.dk
verbouwingsdouche.nl
xn--ziinoapte-6ld.ro
premier-iowa.com
tellthebell.website
jaaphoekzema.nl
phoenixcrane.com
sppdstats.com
agendatwentytwenty.com
nuohous.com
cookinn.nl
airserviceunlimited.com
fridakids.com
bendel-partner.de
signededenroth.dk
johnsonweekly.com
onlinetvgroup.com
ruggestar.ch
apogeeconseils.fr
acornishstudio.co.uk
ntinasfiloxenia.gr
letterscan.de
sachainchiuk.com
cl0nazepamblog.com
gurutechnologies.net
concontactodirecto.com
medicalsupportco.com
gta-jjb.fr
dayenne-styling.nl
test-teleachat.fr
leloupblanc.gr
yvesdoin-aquarelles.fr
devus.de
hotelturbo.de
babysitting-hk.helpergo.co
rsidesigns.com
baikalflot.ru
jeanmonti.com
koncept-m.ru
laylavalentine.com
bmw-i-pure-impulse.com
ddmgen.com
luvbec.com
goeppinger-teppichreinigung.de
schluesseldienste-hannover.de
topautoinsurers.net
gosouldeep.com
bumbipdeco.site
campusce.com
alpesiberie.com
hawthornsretirement.co.uk
pajagus.fr
haus-landliebe.de
loysonbryan.com
netadultere.fr
amco.net.au
lagschools.ng
photonag.com
bluetenreich-brilon.de
comoserescritor.com
chorusconsulting.net
agora-collectivites.com
alexwenzel.de
alnectus.com
eyedoctordallas.com
khtrx.com
metallbau-hartmann.eu
spacebel.be
pazarspor.org.tr
housesofwa.com
krishnabrawijaya.com
wordpress.idium.no
envomask.com
atrgroup.it
springfieldplumbermo.com
kryptos72.com
alcye.com
rokthetalk.com
brisbaneosteopathic.com.au
universelle.fr
latteswithleslie.com
ced-elec.com
annenymus.com
matteoruzzaofficial.com
k-zubki.ru
omnicademy.com
primemarineengineering.com
global-migrate.com
reizenmetkinderen.be
baita.ac
sjtpo.org
midwestschool.org
energosbit-rp.ru
salonlamar.nl
globalskills.pt
afbudsrejserallinclusive.dk
kellengatton.com
heimdalbygg.no
tieronechic.com
iron-mine.ru
triavlete.com
istantidigitali.com
annida.it
zaczytana.com
almamidwifery.com
imajyuku-sozoku.com
metroton.ru
chomiksy.net
goodboyscustom.com
napisat-pismo-gubernatoru.ru:443
parseport.com
factoriareloj.com
liepertgrafikweb.at
myplaywin3.com
jayfurnitureco.com
lesyeuxbleus.net
mazift.dk
alattekniksipil.com
frimec-international.es
vitormmcosta.com
patassociation.com
mike.matthies.de
ocduiblog.com
premiumweb.com.ua:443
polynine.com
kamin-somnium.de
mesajjongeren.nl
vitoriaecoturismo.com.br
alltagsrassismus-entknoten.de
lashandbrowenvy.com
wallflowersandrakes.com
paradigmlandscape.com
alisodentalcare.com
terraflair.de
sbit.ag
nieuwsindeklas.be
daveystownhouse.com
stoneridgemontessori.com
nicksrock.com
patriotcleaning.net
uci-france.fr
111firstdelray.com
affligemsehondenschool.be
fire-space.com
p-ride.live
apmollerpension.com
nalliasmali.net
strauchs-wanderlust.info
factorywizuk.com
basindentistry.com
mediahub.co.nz
levelseven.be
vdolg24.online
ufovidmag.com
katherinealy.com
artcase.pl
christianscholz.de
abulanov.com
funworx.de
uncensoredhentaigif.com
lovetzuchia.com
zwemofficial.nl
janellrardon.com
cleanroomequipment.ie
wademurray.com
aheadloftladders.co.uk
harleystreetspineclinic.com
carmel-york.com
chatberlin.de
optigas.com
wyreforest.net
barbaramcfadyenjewelry.com
from02pro.com
bcmets.info
forumsittard.nl
imagine-entertainment.com
boyfriendsgoal.site
ahgarage.com
pinthelook.com
wineandgo.hu
neonodi.be
motocrossplace.co.uk
domaine-des-pothiers.com
logosindustries.com
cxcompany.com
3daywebs.com
skyscanner.ro
scotlandsroute66.co.uk
fluzfluzrewards.com
eurethicsport.eu
mayprogulka.ru
peppergreenfarmcatering.com.au
bavovrienden.nl
denhaagfoodie.nl
kelsigordon.com
o90.dk
projektparkiet.pl
jameswilliamspainting.com
donau-guides.eu
hostingbangladesh.net
allinonecampaign.com
unexplored.gr
focuskontur.com
metriplica.academy
hospitalitytrainingsolutions.co.uk
chinowarehousespace.com
unislaw-narty.pl
kroophold-sjaelland.dk
haard-totaal.nl
placermonticello.com
nevadaruralhousingstudies.org
mediabolmong.com
peninggibadan.co.id
naukaip.ru
campinglaforetdetesse.com
amyandzac.com
mariannelemenestrel.com
animalfood-online.de
geoweb.software
fixx-repair.com
hostaletdelsindians.es
advance-refle.com
lgiwines.com
schulz-moelln.de
makingmillionaires.net
saberconcrete.com
girlish.ae
bagaholics.in
molade.nl
mslp.org
lmmont.sk
rolleepollee.com
proffteplo.com
masecologicos.com
tradenavigator.ch
t3brothers.com
pro-gamer.pl
jax-interim-and-projectmanagement.com
lyricalduniya.com
kosten-vochtbestrijding.be
brighthillgroup.com
skyboundnutrition.co.uk
saint-malo-developpement.fr
witraz.pl
explora.nl
nationnewsroom.com
bluelakevision.com
monstarrsoccer.com
alharsunindo.com
jobscore.com
direitapernambuco.com
framemyballs.com
diakonie-weitramsdorf-sesslach.de
powershell.su
etgdogz.de
protoplay.ca
stitch-n-bitch.com
tchernia-conseil.fr
fotoeditores.com
richardmaybury.co.uk
gaearoyals.com
rattanwarehouse.co.uk
ownidentity.com
maryairbnb.wordpress.com
rizplakatjaya.com
valiant-voice.com
slotspinner.com
xn--billigafrgpatroner-stb.se
profiz.com
mrkluttz.com
watchsale.biz
cincinnatiphotocompany.org
victorvictoria.com
secrets-clubs.co.uk
mediogiro.com.ar
weddingceremonieswithtim.com
sweetz.fr
web865.com
pokemonturkiye.com
texanscan.org
2020hindsight.info
asiaartgallery.jp
andermattswisswatches.ch
christopherhannan.com
epicjapanart.com
schroederschoembs.com
mangimirossana.it
atma.nl
molinum.pt
qwikcoach.com
triplettabordeaux.fr
airvapourbarrier.com
groovedealers.ru
scietech.academy
lifeinbreaths.com
anchelor.com
solidhosting.nl
drbenveniste.com
sber-biznes.com
aberdeenartwalk.org
janasfokus.com
dnqa.co.uk
skooppi.fi
sealgrinderpt.com
olry-cloisons.fr
maxcube24.com.ua
slideevents.be
enews-qca.com
selected-minds.de
cuadc.org
buzzneakers.com
wg-heiligenstadt.de
photographycreativity.co.uk
hvitfeldt.dk
oexebusiness.com
nepal-pictures.com
the-beauty-guides.com
four-ways.com
memphishealthandwellness.com
teutoradio.de
oncarrot.com
theatre-embellie.fr
innersurrection.com
soncini.ch
awag-blog.de
drvoip.com
jlwilsonbooks.com
awaisghauri.com
blavait.fr
nrgvalue.com
ilveshistoria.com
egpu.fr
rino-gmbh.com
futurenetworking.com
hartofurniture.com
theintellect.edu.pk
silkeight.com
scholarquotes.com
finsahome.co.uk
druktemakersheerenveen.nl
xtensifi.com
bringmehope.org
mrcar.nl
rossomattonecase.it
ninjaki.com
b3b.ch
hinotruckwreckers.com.au
rvside.com
jobkiwi.com.ng
rapid5kloan.org
-
net
true
-
pid
28
-
prc
ocomm
steam
ocautoupds
onenote
sql
wordpa
mspub
mydesktopservice
synctime
excel
outlook
dbeng50
thunderbird
sqbcoreservice
powerpnt
mydesktopqos
oracle
tbirdconfig
xfssvccon
msaccess
isqlplussvc
firefox
visio
ocssd
thebat
dbsnmp
winword
infopath
encsvc
agntsvc
-
ransom_oneliner
All of your files are encrypted! Find {EXT}_Wannadie.txt and follow instructions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
1182
-
svc
svc$
veeam
mepocs
memtas
sql
sophos
backup
vss
Signatures
-
Sodinokibi family
-
Sodinokibi/Revil sample 1 IoCs
Processes:
resource yara_rule sample family_sodinokobi
Files
-
ece4c1e4c72a361db47c69df061a2aeccddb5dba17d8fb1eff6cad0a67975b2b.exe windows x86
c88f20b29592f2107a629e815db6afae
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetErrorMode
Sections
.text Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 57KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.g6z Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ