Static task
static1
Behavioral task
behavioral1
Sample
dbbf5cb28882a49639167ce3cc498561df715e3e8693023c774c30285f22c489.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
dbbf5cb28882a49639167ce3cc498561df715e3e8693023c774c30285f22c489.dll
Resource
win10-en-20211208
General
-
Target
dbbf5cb28882a49639167ce3cc498561df715e3e8693023c774c30285f22c489
-
Size
164KB
-
MD5
883016ee41722016a11ecb3e82b8e1f0
-
SHA1
e7049ac498df9241d6753807ed8236a42c9b47df
-
SHA256
dbbf5cb28882a49639167ce3cc498561df715e3e8693023c774c30285f22c489
-
SHA512
da799bf070da2a70ed4cffa5976deca1dde103e2ca9e6b3242cdae0782c9e23198ae515aa93e6e3414e2bc722740c01146def9bebe09e6ea3f2c775068a3d0f7
-
SSDEEP
3072:gdh/MHQzMozq4ndm8jX5IXzs+M9VQHDO3V2VnL0HuV:gdh/EGMgpdmwIXo+M9VQHD4Vowa
Malware Config
Extracted
sodinokibi
28
1433
vdolg24.online
alaskaremote.com
narca.net
radishallgood.com
jimprattmediations.com
ced-elec.com
nalliasmali.net
test-teleachat.fr
finsahome.co.uk
gosouldeep.com
endstarvation.com
patriotcleaning.net
piestar.com
jlwilsonbooks.com
die-immo-agentur.de
agrifarm.dk
smartercashsystem.com
ziliak.com
profiz.com
rattanwarehouse.co.uk
ikadomus.com
kompresory-opravy.com
leloupblanc.gr
sytzedevries.com
thehovecounsellingpractice.co.uk
fascaonline.com
slotenmakerszwijndrecht.nl
bychowo.pl
logosindustries.com
terraflair.de
site.markkit.com.br
arearugcleaningnyc.com
primemarineengineering.com
bjornvanvulpen.nl
universelle.fr
morgansconsult.com
stanleyqualitysystems.com
auberives-sur-vareze.fr
pharmeko-group.com
birthplacemag.com
yuanshenghotel.com
kickittickets.com
goodboyscustom.com
volta.plus
endlessrealms.net
cesep2019.com
loparnille.se
andermattswisswatches.ch
alabamaroofingllc.com
chorusconsulting.net
biketruck.de
beauty-traveller.com
egpu.fr
successcolony.com.ng
trevi-vl.ru
buerocenter-butzbach-werbemittel.de
mjk.digital
distrifresh.com
metallbau-hartmann.eu
bluelakevision.com
jlgraphisme.fr
innersurrection.com
optigas.com
5pointpt.com
gbk-tp1.de
eos-horlogerie.com
hiddensee-buhne11.de
nepal-pictures.com
perceptdecor.com
ox-home.com
satoblog.org
clinic-beethovenstrasse-ag.ch
molade.nl
mondolandscapes.com
powershell.su
eksperdanismanlik.com
craftron.com
alltagsrassismus-entknoten.de
manzel.tn
mediogiro.com.ar
limounie.com
atrgroup.it
nationnewsroom.com
jag.me
elitkeramika-shop.com.ua
ludoil.it
redctei.co
the-beauty-guides.com
linkbuilding.life
marcandy.com
dmlcpa.com
angelsmirrorus.com
coachpreneuracademy.com
jacquesgarcianoto.com
circuit-diagramz.com
billyoart.com
tramadolhealth.com
kuriero.pro
kombi-dress.com
janellrardon.com
leijstrom.com
trivselsguide.dk
richardiv.com
premiumweb.com.ua:443
palema.gr
hawaiisteelbuilding.com
agora-collectivites.com
oththukaruva.com
grupoexin10.com
diakonie-weitramsdorf-sesslach.de
uncensoredhentaigif.com
guohedd.com
sharonalbrightdds.com
wineandgo.hu
dinedrinkdetroit.com
adaduga.info
catering.com
kenmccallum.com
lagschools.ng
golfclublandgoednieuwkerk.nl
lapponiasafaris.com
berdonllp.com
chatterchatterchatter.com
justaroundthecornerpetsit.com
moira-cristescu.com
holocine.de
cardsandloyalty.com
salonlamar.nl
saint-malo-developpement.fr
verbouwingsdouche.nl
atma.nl
globalcompliancenews.com
bulyginnikitav.000webhostapp.com
qrs-international.com
9nar.com
dieetuniversiteit.nl
ownidentity.com
sycamoregreenapts.com
reputation-medical.online
furland.ru
alexwenzel.de
outstandingminialbums.com
mustangmarketinggroup.com
galaniuklaw.com
brisbaneosteopathic.com.au
phoenixcrane.com
agendatwentytwenty.com
chomiksy.net
bertbutter.nl
loysonbryan.com
taulunkartano.fi
mollymccarthydesign.com
brinkdoepke.eu
miscbo.it
ncn.nl
parseport.com
cormanmarketing.com
drbrianhweeks.com
ramirezprono.com
innervisions-id.com
c-sprop.com
qwikcoach.com
magrinya.net
opt4cdi.com
affligemsehondenschool.be
reygroup.pt
buffdaddyblog.com
wirmuessenreden.com
innovationgames-brabant.nl
tastevirginia.com
nauticmarine.dk
chinowarehousespace.com
lovcase.com
dentallabor-luenen.de
thisprettyhair.com
luvinsburger.fr
quitescorting.com
annenymus.com
galatee-couture.com
rvside.com
adedesign.com
sppdstats.com
laaisterplakky.nl
suitesartemis.gr
cl0nazepamblog.com
jakubrybak.com
noda.com.ua
markseymourphotography.co.uk
mursall.de
dennisverschuur.com
druktemakersheerenveen.nl
ocduiblog.com
basindentistry.com
boloria.de
heuvelland-oaze.nl
rsidesigns.com
direitapernambuco.com
goodherbalhealth.com
irizar.com
soundseeing.net
hotelturbo.de
dinecorp.com
relevantonline.eu
claudiakilian.de
happycatering.de
lookandseen.com
transifer.fr
uci-france.fr
kiraribeaute-nani.com
rechtenplicht.be
jobkiwi.com.ng
soncini.ch
tellthebell.website
thegetawaycollective.com
foerderverein-vatterschule.de
avis.mantova.it
afbudsrejserallinclusive.dk
cleanroomequipment.ie
ketomealprep.academy
qandmmusiccenter.com
nevadaruralhousingstudies.org
profibersan.com
janmorgenstern.com
ddmgen.com
teamsegeln.ch
efficiencyconsulting.es
chris-anne.com
sjtpo.org
thestudio.academy
arabianmice.com
baikalflot.ru
bundan.com
oncarrot.com
otpusk.zp.ua
parisschool.ru
angeleyezstripclub.com
simpleitsolutions.ch
pajagus.fr
liveyourheartout.co
rhino-storage.co.uk
voetbalhoogeveen.nl
pisofare.co
richardkershawwines.co.za
phukienbepthanhdat.com
scholarquotes.com
newonestop.com
directique.com
vitormmcosta.com
der-stempelking.de
citydogslife.com
beandrivingschool.com.au
jameswilliamspainting.com
vvego.com
fitnessblenderstory.com
aheadloftladders.co.uk
xn--billigafrgpatroner-stb.se
tilldeeke.de
bcabattoirs.org
shrinkingplanet.com
randyabrown.com
ultimatelifesource.com
rozmata.com
lovetzuchia.com
n-newmedia.de
jmmartinezilustrador.com
magnetvisual.com
michaelfiegel.com
iexpert99.com
wrinstitute.org
webforsites.com
bumbipdeco.site
skidpiping.de
invela.dk
carmel-york.com
acibademmobil.com.tr
belofloripa.be
blueridgeheritage.com
cap29010.it
lgiwines.com
peninggibadan.co.id
mrkluttz.com
towelroot.co
shortsalemap.com
g2mediainc.com
texanscan.org
etgdogz.de
centuryvisionglobal.com
slideevents.be
bd2fly.com
sber-biznes.com
cymru.futbol
trainiumacademy.com
pixelhealth.net
dayenne-styling.nl
sshomme.com
sprintcoach.com
mahikuchen.com
scotlandsroute66.co.uk
diverfiestas.com.es
domilivefurniture.com
gaearoyals.com
operativadigital.com
paprikapod.com
k-zubki.ru
alisodentalcare.com
renderbox.ch
andreaskildegaard.dk
kryptos72.com
rarefoods.ro
xn--80abehgab4ak0ddz.xn--p1ai
tanatek.com
liverpoolabudhabi.ae
funworx.de
floweringsun.org
rino-gmbh.com
billigeflybilletter.dk
cuadc.org
girlish.ae
imaginekithomes.co.nz
fi-institutionalfunds.com
hypogenforensic.com
ledyoucan.com
lashandbrowenvy.com
duthler.nl
gsconcretecoatings.com
prodentalblue.com
thegrinningmanmusical.com
baita.ac
wribrazil.com
indiebizadvocates.org
switch-made.com
geitoniatonaggelon.gr
zumrutkuyutemel.com
framemyballs.com
sunsolutions.es
promus.ca
belinda.af
perfectgrin.com
biblica.com
rubyaudiology.com
parksideseniorliving.net
bohrlochversicherung.info
csaballoons.com
ygallerysalonsoho.com:443
arazi.eus
kerstliedjeszingen.nl
solutionshosting.co.uk
dogsunlimitedguide.com
nepressurecleaning.com
spartamovers.com
leatherjees.com
pansionatblago.ru
thiagoperez.com
bayshoreelite.com
groovedealers.ru
fire-space.com
goeppinger-teppichreinigung.de
zorgboerderijravensbosch.nl
aidanpublishing.co.uk
gratiocafeblog.wordpress.com
mariajosediazdemera.com
bg.szczecin.pl
apiarista.de
silkeight.com
advesa.com
khtrx.com
avtoboss163.ru:443
maryairbnb.wordpress.com
lisa-poncon.fr
cc-experts.de
broccolisoep.nl
stage-infirmier.fr
rapid5kloan.org
werkzeugtrolley.net
netadultere.fr
xtensifi.com
tetameble.pl
hnkns.com
elliemaccreative.wordpress.com
ninjaki.com
acumenconsultingcompany.com
glennverschueren.be
ilveshistoria.com
karelinjames.com
banukumbak.com
agriturismocastagneto.it
malevannye.ru
imajyuku-sozoku.com
nvisionsigns.com
from02pro.com
mazift.dk
focuskontur.com
pro-gamer.pl
hekecrm.com
metcalfe.ca
barbaramcfadyenjewelry.com
dreamvoiceclub.org
techybash.com
pedmanson.com
artcase.pl
advanced-removals.co.uk
levelseven.be
aktivfriskcenter.se
queertube.net
peppergreenfarmcatering.com.au
walterman.es
ebible.co
mariamalmahdi.com
111firstdelray.com
raeoflightmusic.com
bavovrienden.nl
burg-zelem.de
customroasts.com
dcc-eu.com
bringmehope.org
elex.is
pokemonturkiye.com
eafx.pro
bratek-immobilien.de
fidelitytitleoregon.com
docarefoundation.org
azerbaycanas.com
nourella.com
strauchs-wanderlust.info
ikzoekgod.be
so-sage.fr
redpebblephotography.com
skyboundnutrition.co.uk
rizplakatjaya.com
animation-pro.co.uk
mensemetgesigte.co.za
rossomattonecase.it
denverwynkoopdentist.com
rename.kz
m2graph.fr
schlagbohrmaschinetests.com
skooppi.fi
fbmagazine.ru
fysiotherapierijnmond.nl
cotton-avenue.co.il
nykfdyrehospital.dk
prometeyagro.com.ua
mbuildinghomes.com
hospitalitytrainingsolutions.co.uk
rentingwell.com
mayprogulka.ru
smarttourism.academy
lifeinbreaths.com
skyscanner.ro
selected-minds.de
graygreenbiomedservices.com
mindsparkescape.com
alnectus.com
fotoslubna.com
mundo-pieces-auto.fr
ideamode.com
springfieldplumbermo.com
mediahub.co.nz
bluetenreich-brilon.de
saberconcrete.com
bajova.sk
lumturo.academy
tzn.nu
skoczynski.eu
fridakids.com
bilius.dk
startuplive.org
mike.matthies.de
pays-saint-flour.fr
mneti.ru
muni.pe
tweedekansenloket.nl
ronaldhendriks.nl
pazarspor.org.tr
dibli.store
victorvictoria.com
ilovefullcircle.com
dantreranch.com
shortysspices.com
nrgvalue.com
mariannelemenestrel.com
amco.net.au
itheroes.dk
tutvracks.com
hoteltantra.com
specialtyhomeservicesllc.com
riffenmattgarage.ch
cainlaw-okc.com
leadforensics.com
mrcar.nl
karmeliterviertel.com
marmarabasin.com
stagefxinc.com
laylavalentine.com
rivermusic.nl
glende-pflanzenparadies.de
agenceassemble.fr
utilisacteur.fr
stralsund-ansichten.de
hom-frisor.dk
zinnystar.com
bmw-i-pure-impulse.com
eshop.design
jalkapuu.net
the3-week-diet.net
eventosvirtualesexitosos.com
alwaysdc.com
astrographic.com
nexstagefinancial.com
hotjapaneselesbian.com
sealgrinderpt.com
projektparkiet.pl
rhino-turf.com
cmascd.com
frameshift.it
onlinetvgroup.com
orchardbrickwork.com
purepreprod4.com
acornishstudio.co.uk
angelika-schwarz.com
internalresults.com
wordpress.idium.no
cp-bap.de
enews-qca.com
edrickennedymacfoy.com
vedsegaard.dk
stabilisateur.fr
mazzaropi.com.br
cascinarosa33.it
ahgarage.com
factorywizuk.com
pankiss.ru
cincinnatiphotocompany.org
banksrl.co.za
louiedager.com
hm-com.com
topvijesti.net
haard-totaal.nl
donau-guides.eu
yourcosmicbeing.com
oro.ae
motocrossplace.co.uk
jglconsultancy.com
michal-s.co.il
alene.co
grafikstudio-visuell.de
hensleymarketing.com
bridalcave.com
rs-danmark.dk
lexced.com
housesofwa.com
creohn.de
rolleepollee.com
matteoruzzaofficial.com
wasnederland.nl
legundschiess.de
letsstopsmoking.co.uk
spirello.nl
eatyoveges.com
topautoinsurers.net
veggienessa.com
mslp.org
forextimes.ru
energosbit-rp.ru
bubbalucious.com
globalskills.pt
edvestors.org
descargandoprogramas.com
kellengatton.com
askstaffing.com
kausette.com
georgemuncey.com
catalyseurdetransformation.com
martinipstudios.com
supercarhire.co.uk
dentalcircle.com
limmortelyouth.com
neolaiamedispa.com
racefietsenblog.nl
johnkoen.com
flossmoordental.com
polynine.com
jax-interim-and-projectmanagement.com
scentedlair.com
hostingbangladesh.net
kdbrh.com
oraweb.net
nutriwell.com.sg
craftingalegacy.com
sveneulberg.de
easydental.ae
tchernia-conseil.fr
ruggestar.ch
nxtstg.org
crestgood.com
brannbornfastigheter.se
kristianboennelykke.dk
ykobbqchicken.ca
zaczytana.com
aberdeenartwalk.org
welovecustomers.fr
levencovka.ru
apmollerpension.com
julielusktherapy.com
sweetz.fr
bendel-partner.de
jaaphoekzema.nl
rtc24.com
bescomedical.de
mgimalta.com
aslog.fr
daveystownhouse.com
lattalvor.com
entdoctor-durban.com
krishnabrawijaya.com
tesisatonarim.com
onlinemarketingsurgery.co.uk
fta-media.com
altitudeboise.com
stathmoulis.gr
avisioninthedesert.com
lesyeuxbleus.net
augen-praxisklinik-rostock.de
voice2biz.com
sellthewrightway.com
hameghlim.com
mieleshopping.it
hvitfeldt.dk
toranjtuition.org
nbva.co.uk
almamidwifery.com
pvandambv.nl
fixx-repair.com
oexebusiness.com
ciga-france.fr
brownswoodblog.com
deduktia.fi
alharsunindo.com
kvetymichalovce.sk
betterce.com
charlesfrancis.photos
anchelor.com
memphishealthandwellness.com
futurenetworking.com
p-ride.live
expohomes.com
computer-place.de
therapybusinessacademy.com
greatofficespaces.net
log-barn.co.uk
k-v-f.de
eastgrinsteadwingchun.com
wg-heiligenstadt.de
cssp-mediation.org
pinthelook.com
lsngroupe.com
margaretmcshane.com
skinkeeper.li
fazagostar.co
buonabitare.com
thenalpa.com
molinum.pt
lassocrm.com
nieuwsindeklas.be
cops4causes.org
3daywebs.com
mindfuelers.com
masecologicos.com
paardcentraal.nl
xrresources.com
encounter-p.net
weddingceremonieswithtim.com
handyman-silkeborg.dk
linearete.com
denhaagfoodie.nl
blavait.fr
katherinealy.com
awaisghauri.com
speiserei-hannover.de
bcmets.info
sbit.ag
precisetemp.com
solidhosting.nl
gardenpartner.pl
hostastay.com
theboardroomafrica.com
kroophold-sjaelland.dk
jonnyhooley.com
hostaletdelsindians.es
adabible.org
thepixelfairy.com
motocrosshideout.com
tages-geldvergleich.de
mangimirossana.it
humanviruses.org
opticahubertruiz.com
letterscan.de
delegationhub.com
teutoradio.de
vitoriaecoturismo.com.br
valiant-voice.com
cyberpromote.de
alcye.com
o90.dk
istantidigitali.com
enactusnhlstenden.com
advance-refle.com
bellesiniacademy.org
theatre-embellie.fr
keuken-prijs.nl
teethinadaydentalimplants.com
landgoedspica.nl
benchbiz.com
proffteplo.com
stitch-n-bitch.com
auto-opel.ro
rishigangoly.com
ceocenters.com
epicjapanart.com
neonodi.be
suonenjoen.fi
latteswithleslie.com
signamedia.de
makingmillionaires.net
reizenmetkinderen.be
mesajjongeren.nl
jdscenter.com
drvoip.com
airvapourbarrier.com
studionumerik.fr
oportowebdesign.com
anleggsregisteret.no
bodymindchallenger.com
unexplored.gr
gurutechnologies.net
slotspinner.com
johnstonmingmanning.com
hutchstyle.co.uk
asiaartgallery.jp
richardmaybury.co.uk
sambaglow.com
breathebettertolivebetter.com
greeneyetattoo.com
palmenhaus-erfurt.de
albcleaner.fr
fsbforsale.com
photographycreativity.co.uk
speakaudible.com
grancanariaregional.com
fla.se
stringnosis.academy
nuohous.com
olry-cloisons.fr
worldproskitour.com
jobscore.com
medicalsupportco.com
renehartman.nl
baumfinancialservices.com
secrets-clubs.co.uk
geoweb.software
mamajenedesigns.com
onesynergyinternational.com
christianscholz.de
kookooo.com
kartuindonesia.com
dnqa.co.uk
yvesdoin-aquarelles.fr
putzen-reinigen.com
5thactors.com
schulz-moelln.de
condormobile.fr
sachainchiuk.com
kryddersnapsen.dk
ivancacu.com
haus-landliebe.de
2020hindsight.info
aciscomputers.com
mrmac.com
singletonfinancial.com
keyboardjournal.com
acb-gruppe.ch
parentsandkids.com
advancedeyecare.com
vipcarrental.ae
jandhpest.com
ufovidmag.com
lollachiro.com
jobstomoveamerica.org
production-stills.co.uk
campinglaforetdetesse.com
unislaw-narty.pl
90nguyentuan.com
designimage.ae
epsondriversforwindows.com
hawthornsretirement.co.uk
johnsonweekly.com
christopherhannan.com
jayfurnitureco.com
jefersonalessandro.com
malzomattalar.com
akcadagofis.com
wallflowersandrakes.com
adterium.com
akwaba-safaris.com
stressreliefadvice.com
spacebel.be
bookingwheel.com
lunoluno.com
schroederschoembs.com
maxcube24.com.ua
juergenblaetz.de
fanuli.com.au
tothebackofthemoon.com
ingresosextras.online
lyricalduniya.com
block-optic.com
traitware.com
the-cupboard.co.uk
blucamp.com
factoriareloj.com
boyfriendsgoal.site
premier-iowa.com
bourchier.org
omegamarbella.com
husetsanitas.dk
theintellect.edu.pk
lidkopingsnytt.nu
leopoldineroux.com
natturestaurante.com.br
spectamarketingdigital.com.br
smartspeak.com
napisat-pismo-gubernatoru.ru:443
publicompserver.de
tecleados.com
santastoy.store
campusce.com
ya-elka.ru
triplettagaite.fr
naukaip.ru
glas-kuck.de
gta-jjb.fr
baptistdistinctives.org
penumbuhrambutkeiskei.com
buzzneakers.com
hepishopping.com
rokthetalk.com
gazelle-du-web.com
cxcompany.com
corporacionrr.com
triplettabordeaux.fr
iron-mine.ru
collegetennis.info
devus.de
azloans.com
look.academy
brunoimmobilier.com
klapanvent.ru
biodentify.ai
fann.ru
bonitabeachassociation.com
mind2muscle.nl
nicksrock.com
abulanov.com
craftstone.co.nz
1deals.com
pxsrl.it
livedeveloper.com
physio-lang.de
witraz.pl
casinodepositors.com
airserviceunlimited.com
harleystreetspineclinic.com
sochi-okna23.ru
bagaholics.in
myfbateam.com
andrealuchesi.it
gatlinburgcottage.com
saboboxtel.uk
alpesiberie.com
poems-for-the-soul.ch
animalfood-online.de
muller.nl
forskolinslimeffect.net
protoplay.ca
dentourage.com
modamarfil.com
scietech.academy
t3brothers.com
subquercy.fr
plbinsurance.com
myplaywin3.com
aquacheck.co.za
concontactodirecto.com
monstarrsoccer.com
aoyama.ac
osn.ro
eurethicsport.eu
metroton.ru
patassociation.com
inewsstar.com
mikegoodfellow.co.uk
leansupremegarcinia.net
arthakapitalforvaltning.dk
lmmont.sk
business-basic.de
campusescalade.com
zuerich-umzug.ch
greenrider.nl
metriplica.academy
liepertgrafikweb.at
photonag.com
deziplan.ru
turing.academy
nginx.com
carsten.sparen-it.de
zdrowieszczecin.pl
pureelements.nl
mercadodelrio.com
subyard.com
ntinasfiloxenia.gr
bakingismyyoga.com
frankgoll.com
testitjavertailut.net
ijsselbeton.nl
eyedoctordallas.com
insane.agency
licensed-public-adjuster.com
kelsigordon.com
electricianul.com
rentsportsequip.com
janasfokus.com
zealcon.ae
yournextshoes.com
espaciopolitica.com
sololibrerie.it
koncept-m.ru
atelierkomon.com
whoopingcrane.com
iactechnologies.net
yayasanprimaunggul.org
martha-frets-ceramics.nl
matthieupetel.fr
skolaprome.eu
annida.it
altocontatto.net
interlinkone.com
wyreforest.net
latableacrepes-meaux.fr
initconf.com
envomask.com
babysitting-hk.helpergo.co
forumsittard.nl
carolynfriedlander.com
vapiano.fr
kosten-vochtbestrijding.be
evsynthacademy.org
clemenfoto.dk
apogeeconseils.fr
four-ways.com
explora.nl
charlottelhanna.com
cac2040.com
kamin-somnium.de
thesilkroadny.com
antesacademy.it
schluesseldienste-hannover.de
xn--ziinoapte-6ld.ro
circlecitydj.com
theater-lueneburg.de
achetrabalhos.com
domaine-des-pothiers.com
brighthillgroup.com
xn--80addfr4ahr.dp.ua
zwemofficial.nl
happylublog.wordpress.com
stoneridgemontessori.com
tradenavigator.ch
aceroprime.com
paradigmlandscape.com
drnelsonpediatrics.com
amyandzac.com
fskhjalmar.se
omnicademy.com
jollity.hu
amorbellezaysalud.com
chatberlin.de
dierenambulancealkmaar.nl
bruut.online
mediabolmong.com
line-x.co.uk
ayudaespiritualtamara.com
go.labibini.ch
the5thquestion.com
dr-vita.de
unboxtherapy.site
chainofhopeeurope.eu
sarahspics.co.uk
kafkacare.com
wademurray.com
artvark.nl
goddardleadership.org
fotoeditores.com
midwestschool.org
devplus.be
alattekniksipil.com
internestdigital.com
b3b.ch
ravage-webzine.nl
tbalp.co.uk
frimec-international.es
pubcon.com
amelielecompte.wordpress.com
ronielyn.com
citiscapes-art.com
o2o-academy.com
bluemarinefoundation.com
axisoflove.org:443
smartworkplaza.com
global-migrate.com
tieronechic.com
awag-blog.de
fluzfluzrewards.com
cmeow.com
heimdalbygg.no
drbenveniste.com
catchup-mag.com
billscars.net
breakluckrecords.com
yourhappyevents.fr
livelai.com
colored-shelves.com
min-virksomhed.dk
ncjc.ca
gavelmasters.com
luvbec.com
oscommunity.de
a-zpaperwork.eu
web865.com
bodet150ans.com
digitale-elite.de
agencewho-aixenprovence.fr
mac-computer-support-hamburg.de
curtsdiscountguns.com
11.in.ua
triavlete.com
smartmind.net
pinkxgayvideoawards.com
jeanmonti.com
tatyanakopieva.ru
imagine-entertainment.com
pilotgreen.com
autoteamlast.de
awaitspain.com
littlesaints.academy
davedavisphotos.com
boomerslivinglively.com
larchwoodmarketing.com
allinonecampaign.com
cookinn.nl
finnergo.eu
professionetata.com
hartofurniture.com
silverbird.dk
hinotruckwreckers.com.au
datatri.be
pourlabretagne.bzh
palmecophilippines.com
activeterroristwarningcompany.com
placermonticello.com
comoserescritor.com
kemtron.fr
watchsale.biz
signededenroth.dk
-
net
true
-
pid
28
-
prc
ocautoupds
outlook
firefox
thebat
sqbcoreservice
synctime
wordpa
mydesktopservice
agntsvc
infopath
sql
winword
mydesktopqos
oracle
msaccess
dbsnmp
visio
powerpnt
encsvc
thunderbird
mspub
tbirdconfig
xfssvccon
excel
steam
ocssd
ocomm
onenote
dbeng50
isqlplussvc
-
ransom_oneliner
All of your files are encrypted! Find {EXT}_Wannadie.txt and follow instructions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
1433
-
svc
veeam
sql
backup
vss
memtas
sophos
svc$
mepocs
Signatures
-
Sodinokibi family
-
Sodinokibi/Revil sample 1 IoCs
Processes:
resource yara_rule sample family_sodinokobi
Files
-
dbbf5cb28882a49639167ce3cc498561df715e3e8693023c774c30285f22c489.dll windows x86
c4c29c7e6a6897be412c7fedfcca8fe4
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
SetErrorMode
CreateThread
Sections
.text Size: 43KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 57KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.6ai0 Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ