Static task
static1
Behavioral task
behavioral1
Sample
8d4ce23030414f443249c64ef0560fdc3e80502497b92d3d51a0ec370d457021.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
8d4ce23030414f443249c64ef0560fdc3e80502497b92d3d51a0ec370d457021.dll
Resource
win10-en-20211208
General
-
Target
8d4ce23030414f443249c64ef0560fdc3e80502497b92d3d51a0ec370d457021
-
Size
164KB
-
MD5
b914a72f794b8d7fb07219bbad04466f
-
SHA1
379d200d7d4d412762b84478f9a7017691363234
-
SHA256
8d4ce23030414f443249c64ef0560fdc3e80502497b92d3d51a0ec370d457021
-
SHA512
52f4cb79dce89d4a7bb5c2aeeeb9db7085a59fc73c36f92620595e17bf1b67208914a0c823d31d3f7ad428517da7d4a12b2dbd27a533d6c2067fa7dc665e03f7
-
SSDEEP
3072:gdh/MHQzMozq4ndm8jX5IXzs+M9VQHDObN+VLE:gdh/EGMgpdmwIXo+M9VQHD60K
Malware Config
Extracted
sodinokibi
28
1467
bcabattoirs.org
rubyaudiology.com
gavelmasters.com
cssp-mediation.org
cmascd.com
racefietsenblog.nl
mikegoodfellow.co.uk
charlesfrancis.photos
distrifresh.com
hostaletdelsindians.es
indiebizadvocates.org
graygreenbiomedservices.com
pourlabretagne.bzh
luvinsburger.fr
verbouwingsdouche.nl
ya-elka.ru
amelielecompte.wordpress.com
molade.nl
subquercy.fr
saberconcrete.com
avisioninthedesert.com
broccolisoep.nl
studionumerik.fr
altitudeboise.com
memphishealthandwellness.com
colored-shelves.com
pankiss.ru
curtsdiscountguns.com
opt4cdi.com
karmeliterviertel.com
naukaip.ru
volta.plus
husetsanitas.dk
brannbornfastigheter.se
futurenetworking.com
amco.net.au
ceocenters.com
oncarrot.com
leansupremegarcinia.net
scotlandsroute66.co.uk
nxtstg.org
zorgboerderijravensbosch.nl
iactechnologies.net
bodet150ans.com
k-v-f.de
arabianmice.com
daveystownhouse.com
dentourage.com
arthakapitalforvaltning.dk
traitware.com
michal-s.co.il
mjk.digital
finsahome.co.uk
chatberlin.de
sachainchiuk.com
phoenixcrane.com
stagefxinc.com
haard-totaal.nl
keuken-prijs.nl
elitkeramika-shop.com.ua
littlesaints.academy
corporacionrr.com
tesisatonarim.com
rossomattonecase.it
agenceassemble.fr
latteswithleslie.com
domaine-des-pothiers.com
ronielyn.com
metcalfe.ca
nuohous.com
agendatwentytwenty.com
kdbrh.com
hameghlim.com
der-stempelking.de
rapid5kloan.org
happycatering.de
artcase.pl
oththukaruva.com
line-x.co.uk
innersurrection.com
birthplacemag.com
bookingwheel.com
lollachiro.com
jglconsultancy.com
shortysspices.com
kosten-vochtbestrijding.be
myfbateam.com
satoblog.org
relevantonline.eu
neolaiamedispa.com
groovedealers.ru
schlagbohrmaschinetests.com
koncept-m.ru
reizenmetkinderen.be
adaduga.info
aquacheck.co.za
devplus.be
greeneyetattoo.com
thestudio.academy
o2o-academy.com
bumbipdeco.site
awag-blog.de
sppdstats.com
tanatek.com
unexplored.gr
powershell.su
bg.szczecin.pl
happylublog.wordpress.com
ebible.co
solidhosting.nl
testitjavertailut.net
mahikuchen.com
welovecustomers.fr
iron-mine.ru
girlish.ae
chomiksy.net
aciscomputers.com
hnkns.com
solutionshosting.co.uk
bilius.dk
nevadaruralhousingstudies.org
concontactodirecto.com
mustangmarketinggroup.com
greatofficespaces.net
baumfinancialservices.com
apmollerpension.com
keyboardjournal.com
nrgvalue.com
oscommunity.de
barbaramcfadyenjewelry.com
paardcentraal.nl
prodentalblue.com
dieetuniversiteit.nl
limmortelyouth.com
oraweb.net
azerbaycanas.com
marcandy.com
hawaiisteelbuilding.com
babysitting-hk.helpergo.co
hom-frisor.dk
smartmind.net
mediahub.co.nz
julielusktherapy.com
uci-france.fr
brownswoodblog.com
descargandoprogramas.com
atma.nl
blavait.fr
ziliak.com
qwikcoach.com
slideevents.be
ox-home.com
internestdigital.com
fidelitytitleoregon.com
soncini.ch
m2graph.fr
goodherbalhealth.com
cuadc.org
anchelor.com
plbinsurance.com
towelroot.co
finnergo.eu
suonenjoen.fi
dentalcircle.com
cmeow.com
b3b.ch
rizplakatjaya.com
redctei.co
bcmets.info
chinowarehousespace.com
vedsegaard.dk
espaciopolitica.com
larchwoodmarketing.com
pokemonturkiye.com
chatterchatterchatter.com
brighthillgroup.com
riffenmattgarage.ch
jakubrybak.com
watchsale.biz
lagschools.ng
secrets-clubs.co.uk
agora-collectivites.com
enactusnhlstenden.com
profiz.com
malevannye.ru
sochi-okna23.ru
spartamovers.com
berdonllp.com
cops4causes.org
baptistdistinctives.org
guohedd.com
azloans.com
boomerslivinglively.com
jeanmonti.com
xn--80abehgab4ak0ddz.xn--p1ai
so-sage.fr
bd2fly.com
galaniuklaw.com
alene.co
ketomealprep.academy
signededenroth.dk
catchup-mag.com
purepreprod4.com
delegationhub.com
donau-guides.eu
reputation-medical.online
the3-week-diet.net
acb-gruppe.ch
theater-lueneburg.de
amyandzac.com
nicksrock.com
pazarspor.org.tr
bajova.sk
hypogenforensic.com
specialtyhomeservicesllc.com
slotenmakerszwijndrecht.nl
paradigmlandscape.com
mgimalta.com
sprintcoach.com
breathebettertolivebetter.com
tellthebell.website
xrresources.com
sellthewrightway.com
cincinnatiphotocompany.org
trevi-vl.ru
mazzaropi.com.br
handyman-silkeborg.dk
perfectgrin.com
pharmeko-group.com
clinic-beethovenstrasse-ag.ch
nepal-pictures.com
alattekniksipil.com
rivermusic.nl
smarttourism.academy
focuskontur.com
boloria.de
fotoslubna.com
cascinarosa33.it
mindfuelers.com
patriotcleaning.net
yournextshoes.com
richardkershawwines.co.za
promus.ca
citiscapes-art.com
tecleados.com
renderbox.ch
g2mediainc.com
rentsportsequip.com
pubcon.com
global-migrate.com
hvitfeldt.dk
charlottelhanna.com
coachpreneuracademy.com
wallflowersandrakes.com
cp-bap.de
pansionatblago.ru
juergenblaetz.de
jdscenter.com
lunoluno.com
cxcompany.com
kvetymichalovce.sk
martha-frets-ceramics.nl
k-zubki.ru
heimdalbygg.no
silkeight.com
alwaysdc.com
atrgroup.it
kellengatton.com
sshomme.com
witraz.pl
leopoldineroux.com
a-zpaperwork.eu
ingresosextras.online
oro.ae
hospitalitytrainingsolutions.co.uk
grafikstudio-visuell.de
cyberpromote.de
blucamp.com
triplettagaite.fr
elliemaccreative.wordpress.com
goddardleadership.org
mariamalmahdi.com
mangimirossana.it
ronaldhendriks.nl
smartworkplaza.com
lifeinbreaths.com
jayfurnitureco.com
agrifarm.dk
cc-experts.de
lesyeuxbleus.net
klapanvent.ru
dcc-eu.com
nieuwsindeklas.be
enews-qca.com
geitoniatonaggelon.gr
kenmccallum.com
sjtpo.org
pro-gamer.pl
premier-iowa.com
otpusk.zp.ua
buonabitare.com
palema.gr
dr-vita.de
newonestop.com
bratek-immobilien.de
bychowo.pl
gta-jjb.fr
clemenfoto.dk
wineandgo.hu
business-basic.de
rename.kz
belinda.af
kuriero.pro
signamedia.de
strauchs-wanderlust.info
forumsittard.nl
bavovrienden.nl
prometeyagro.com.ua
factoriareloj.com
saboboxtel.uk
khtrx.com
mslp.org
invela.dk
aheadloftladders.co.uk
tatyanakopieva.ru
neonodi.be
tweedekansenloket.nl
betterce.com
eventosvirtualesexitosos.com
photographycreativity.co.uk
encounter-p.net
livelai.com
akwaba-safaris.com
liveyourheartout.co
kompresory-opravy.com
skolaprome.eu
masecologicos.com
electricianul.com
ddmgen.com
theboardroomafrica.com
nbva.co.uk
perceptdecor.com
legundschiess.de
vvego.com
arazi.eus
bagaholics.in
unislaw-narty.pl
protoplay.ca
linkbuilding.life
tradenavigator.ch
shrinkingplanet.com
magrinya.net
campinglaforetdetesse.com
alexwenzel.de
expohomes.com
lumturo.academy
orchardbrickwork.com
nalliasmali.net
afbudsrejserallinclusive.dk
datatri.be
amorbellezaysalud.com
manzel.tn
min-virksomhed.dk
the-beauty-guides.com
liverpoolabudhabi.ae
wyreforest.net
111firstdelray.com
dmlcpa.com
qrs-international.com
imaginekithomes.co.nz
metallbau-hartmann.eu
hostingbangladesh.net
oexebusiness.com
production-stills.co.uk
terraflair.de
yourhappyevents.fr
galatee-couture.com
bayshoreelite.com
glende-pflanzenparadies.de
karelinjames.com
salonlamar.nl
jobscore.com
johnkoen.com
campusescalade.com
awaisghauri.com
ideamode.com
nationnewsroom.com
kerstliedjeszingen.nl
wasnederland.nl
outstandingminialbums.com
thisprettyhair.com
docarefoundation.org
martinipstudios.com
hutchstyle.co.uk
gaearoyals.com
metroton.ru
skinkeeper.li
hepishopping.com
bonitabeachassociation.com
agriturismocastagneto.it
webforsites.com
rhino-storage.co.uk
ilveshistoria.com
buffdaddyblog.com
energosbit-rp.ru
jobkiwi.com.ng
nykfdyrehospital.dk
mediabolmong.com
scentedlair.com
andermattswisswatches.ch
techybash.com
5pointpt.com
stanleyqualitysystems.com
tchernia-conseil.fr
5thactors.com
claudiakilian.de
cotton-avenue.co.il
tothebackofthemoon.com
cap29010.it
site.markkit.com.br
billyoart.com
kroophold-sjaelland.dk
spirello.nl
gosouldeep.com
annenymus.com
carsten.sparen-it.de
holocine.de
drbenveniste.com
denhaagfoodie.nl
stringnosis.academy
asiaartgallery.jp
penumbuhrambutkeiskei.com
proffteplo.com
apogeeconseils.fr
veggienessa.com
richardiv.com
voetbalhoogeveen.nl
goodboyscustom.com
vdolg24.online
lidkopingsnytt.nu
jag.me
angelsmirrorus.com
chorusconsulting.net
jmmartinezilustrador.com
janmorgenstern.com
pisofare.co
foerderverein-vatterschule.de
sarahspics.co.uk
netadultere.fr
makingmillionaires.net
boyfriendsgoal.site
csaballoons.com
artvark.nl
lassocrm.com
fazagostar.co
optigas.com
globalcompliancenews.com
animation-pro.co.uk
inewsstar.com
pedmanson.com
palmenhaus-erfurt.de
bjornvanvulpen.nl
animalfood-online.de
biodentify.ai
casinodepositors.com
rs-danmark.dk
domilivefurniture.com
triplettabordeaux.fr
radishallgood.com
rvside.com
istantidigitali.com
deziplan.ru
lapponiasafaris.com
eastgrinsteadwingchun.com
muller.nl
singletonfinancial.com
bakingismyyoga.com
nourella.com
rhino-turf.com
placermonticello.com
go.labibini.ch
craftstone.co.nz
triavlete.com
wrinstitute.org
craftron.com
piestar.com
ownidentity.com
glas-kuck.de
circlecitydj.com
randyabrown.com
edrickennedymacfoy.com
ivancacu.com
simpleitsolutions.ch
fsbforsale.com
frameshift.it
dentallabor-luenen.de
stathmoulis.gr
jobstomoveamerica.org
agencewho-aixenprovence.fr
easydental.ae
endlessrealms.net
fitnessblenderstory.com
zumrutkuyutemel.com
parentsandkids.com
hiddensee-buhne11.de
zuerich-umzug.ch
schulz-moelln.de
diakonie-weitramsdorf-sesslach.de
bluemarinefoundation.com
blueridgeheritage.com
etgdogz.de
stabilisateur.fr
dierenambulancealkmaar.nl
drnelsonpediatrics.com
vitormmcosta.com
latableacrepes-meaux.fr
linearete.com
jlwilsonbooks.com
cesep2019.com
fanuli.com.au
look.academy
logosindustries.com
eatyoveges.com
gardenpartner.pl
housesofwa.com
comoserescritor.com
narca.net
loparnille.se
dennisverschuur.com
pxsrl.it
midwestschool.org
weddingceremonieswithtim.com
tramadolhealth.com
cl0nazepamblog.com
jacquesgarcianoto.com
supercarhire.co.uk
topvijesti.net
computer-place.de
andreaskildegaard.dk
ncn.nl
diverfiestas.com.es
qandmmusiccenter.com
hawthornsretirement.co.uk
victorvictoria.com
insane.agency
advanced-removals.co.uk
airserviceunlimited.com
bubbalucious.com
die-immo-agentur.de
pays-saint-flour.fr
fi-institutionalfunds.com
liepertgrafikweb.at
grupoexin10.com
poems-for-the-soul.ch
luvbec.com
biketruck.de
albcleaner.fr
raeoflightmusic.com
katherinealy.com
kryddersnapsen.dk
rino-gmbh.com
mamajenedesigns.com
baikalflot.ru
sytzedevries.com
wribrazil.com
yuanshenghotel.com
polynine.com
margaretmcshane.com
devus.de
mayprogulka.ru
almamidwifery.com
gatlinburgcottage.com
beauty-traveller.com
motocrossplace.co.uk
campusce.com
marmarabasin.com
zinnystar.com
quitescorting.com
leloupblanc.gr
aoyama.ac
autoteamlast.de
akcadagofis.com
osn.ro
hm-com.com
levencovka.ru
innervisions-id.com
walterman.es
ygallerysalonsoho.com:443
opticahubertruiz.com
sharonalbrightdds.com
silverbird.dk
harleystreetspineclinic.com
palmecophilippines.com
uncensoredhentaigif.com
customroasts.com
nutriwell.com.sg
ledyoucan.com
elex.is
p-ride.live
fixx-repair.com
laaisterplakky.nl
selected-minds.de
speakaudible.com
pixelhealth.net
krishnabrawijaya.com
photonag.com
tzn.nu
speiserei-hannover.de
ikadomus.com
cac2040.com
hotelturbo.de
mbuildinghomes.com
lovcase.com
eurethicsport.eu
buzzneakers.com
professionetata.com
jefersonalessandro.com
grancanariaregional.com
limounie.com
cainlaw-okc.com
kafkacare.com
activeterroristwarningcompany.com
tages-geldvergleich.de
angeleyezstripclub.com
90nguyentuan.com
iexpert99.com
allinonecampaign.com
yourcosmicbeing.com
funworx.de
abulanov.com
innovationgames-brabant.nl
fbmagazine.ru
zdrowieszczecin.pl
rsidesigns.com
sunsolutions.es
kiraribeaute-nani.com
duthler.nl
alabamaroofingllc.com
springfieldplumbermo.com
georgemuncey.com
profibersan.com
xn--ziinoapte-6ld.ro
dibli.store
trainiumacademy.com
bellesiniacademy.org
saint-malo-developpement.fr
edvestors.org
skooppi.fi
mondolandscapes.com
2020hindsight.info
ufovidmag.com
zwemofficial.nl
goeppinger-teppichreinigung.de
ncjc.ca
mensemetgesigte.co.za
fskhjalmar.se
jalkapuu.net
framemyballs.com
thiagoperez.com
internalresults.com
dinedrinkdetroit.com
the5thquestion.com
kombi-dress.com
3daywebs.com
stage-infirmier.fr
hekecrm.com
eafx.pro
skyboundnutrition.co.uk
morgansconsult.com
bringmehope.org
christianscholz.de
pinkxgayvideoawards.com
condormobile.fr
sweetz.fr
bodymindchallenger.com
texanscan.org
banukumbak.com
janellrardon.com
christopherhannan.com
jollity.hu
catalyseurdetransformation.com
voice2biz.com
turing.academy
c-sprop.com
alnectus.com
xn--billigafrgpatroner-stb.se
imajyuku-sozoku.com
billscars.net
rozmata.com
gsconcretecoatings.com
parksideseniorliving.net
globalskills.pt
deduktia.fi
annida.it
ludoil.it
stitch-n-bitch.com
circuit-diagramz.com
teethinadaydentalimplants.com
mariajosediazdemera.com
unboxtherapy.site
cormanmarketing.com
pilotgreen.com
johnsonweekly.com
dantreranch.com
alisodentalcare.com
altocontatto.net
peninggibadan.co.id
cymru.futbol
jimprattmediations.com
hoteltantra.com
miscbo.it
lovetzuchia.com
teutoradio.de
smartspeak.com
molinum.pt
ruggestar.ch
lisa-poncon.fr
operativadigital.com
louiedager.com
physio-lang.de
fluzfluzrewards.com
kryptos72.com
evsynthacademy.org
rarefoods.ro
haus-landliebe.de
successcolony.com.ng
magnetvisual.com
thegetawaycollective.com
dinecorp.com
burg-zelem.de
ykobbqchicken.ca
jonnyhooley.com
moira-cristescu.com
worldproskitour.com
mrmac.com
kausette.com
aidanpublishing.co.uk
eos-horlogerie.com
myplaywin3.com
awaitspain.com
livedeveloper.com
eyedoctordallas.com
envomask.com
mediogiro.com.ar
santastoy.store
gazelle-du-web.com
onesynergyinternational.com
xtensifi.com
eshop.design
nexstagefinancial.com
drbrianhweeks.com
achetrabalhos.com
maryairbnb.wordpress.com
rechtenplicht.be
teamsegeln.ch
scholarquotes.com
benchbiz.com
hinotruckwreckers.com.au
brunoimmobilier.com
aberdeenartwalk.org
lsngroupe.com
sycamoregreenapts.com
michaelfiegel.com
geoweb.software
wordpress.idium.no
apiarista.de
ntinasfiloxenia.gr
suitesartemis.gr
fysiotherapierijnmond.nl
sber-biznes.com
mike.matthies.de
precisetemp.com
t3brothers.com
tilldeeke.de
cookinn.nl
heuvelland-oaze.nl
leatherjees.com
carolynfriedlander.com
putzen-reinigen.com
rishigangoly.com
initconf.com
hostastay.com
crestgood.com
bridalcave.com
mieleshopping.it
wirmuessenreden.com
levelseven.be
block-optic.com
medicalsupportco.com
parisschool.ru
vapiano.fr
directique.com
dnqa.co.uk
carmel-york.com
modamarfil.com
forextimes.ru
sealgrinderpt.com
citydogslife.com
buerocenter-butzbach-werbemittel.de
o90.dk
tutvracks.com
patassociation.com
astrographic.com
beandrivingschool.com.au
designimage.ae
alpesiberie.com
biblica.com
lgiwines.com
ilovefullcircle.com
golfclublandgoednieuwkerk.nl
sveneulberg.de
ikzoekgod.be
dogsunlimitedguide.com
advancedeyecare.com
schluesseldienste-hannover.de
jandhpest.com
efficiencyconsulting.es
pvandambv.nl
alharsunindo.com
valiant-voice.com
matteoruzzaofficial.com
1deals.com
phukienbepthanhdat.com
nepressurecleaning.com
metriplica.academy
scietech.academy
xn--80addfr4ahr.dp.ua
endstarvation.com
auto-opel.ro
jameswilliamspainting.com
fann.ru
flossmoordental.com
furland.ru
antesacademy.it
mind2muscle.nl
avis.mantova.it
brisbaneosteopathic.com.au
mrcar.nl
avtoboss163.ru:443
wademurray.com
toranjtuition.org
humanviruses.org
irizar.com
johnstonmingmanning.com
omegamarbella.com
universelle.fr
lashandbrowenvy.com
lookandseen.com
rolleepollee.com
billigeflybilletter.dk
muni.pe
factorywizuk.com
ayudaespiritualtamara.com
gurutechnologies.net
breakluckrecords.com
trivselsguide.dk
thepixelfairy.com
chainofhopeeurope.eu
advance-refle.com
whoopingcrane.com
baita.ac
tieronechic.com
yayasanprimaunggul.org
mneti.ru
sbit.ag
gratiocafeblog.wordpress.com
mollymccarthydesign.com
skoczynski.eu
nvisionsigns.com
olry-cloisons.fr
entdoctor-durban.com
premiumweb.com.ua:443
tetameble.pl
fire-space.com
forskolinslimeffect.net
centuryvisionglobal.com
kristianboennelykke.dk
subyard.com
maxcube24.com.ua
theintellect.edu.pk
primemarineengineering.com
the-cupboard.co.uk
queertube.net
natturestaurante.com.br
ultimatelifesource.com
anleggsregisteret.no
parseport.com
soundseeing.net
zealcon.ae
craftingalegacy.com
auberives-sur-vareze.fr
mac-computer-support-hamburg.de
thesilkroadny.com
fta-media.com
bulyginnikitav.000webhostapp.com
bohrlochversicherung.info
rokthetalk.com
four-ways.com
projektparkiet.pl
itheroes.dk
spacebel.be
lmmont.sk
brinkdoepke.eu
peppergreenfarmcatering.com.au
bluelakevision.com
kickittickets.com
skidpiping.de
matthieupetel.fr
sololibrerie.it
richardmaybury.co.uk
acibademmobil.com.tr
fascaonline.com
sambaglow.com
kookooo.com
jax-interim-and-projectmanagement.com
chris-anne.com
ocduiblog.com
adterium.com
kartuindonesia.com
greenrider.nl
imagine-entertainment.com
ciga-france.fr
gbk-tp1.de
spectamarketingdigital.com.br
bendel-partner.de
stoneridgemontessori.com
wg-heiligenstadt.de
oportowebdesign.com
ahgarage.com
creohn.de
dreamvoiceclub.org
11.in.ua
taulunkartano.fi
letsstopsmoking.co.uk
bescomedical.de
airvapourbarrier.com
licensed-public-adjuster.com
werkzeugtrolley.net
mindsparkescape.com
rtc24.com
vitoriaecoturismo.com.br
catering.com
utilisacteur.fr
tastevirginia.com
affligemsehondenschool.be
pajagus.fr
aslog.fr
motocrosshideout.com
mazift.dk
justaroundthecornerpetsit.com
kelsigordon.com
therapybusinessacademy.com
rentingwell.com
explora.nl
lexced.com
adedesign.com
kamin-somnium.de
nginx.com
eksperdanismanlik.com
monstarrsoccer.com
alltagsrassismus-entknoten.de
basindentistry.com
topautoinsurers.net
web865.com
belofloripa.be
advesa.com
letterscan.de
interlinkone.com
theatre-embellie.fr
epsondriversforwindows.com
bluetenreich-brilon.de
redpebblephotography.com
bruut.online
omnicademy.com
acornishstudio.co.uk
ijsselbeton.nl
hotjapaneselesbian.com
ced-elec.com
davedavisphotos.com
leijstrom.com
mercadodelrio.com
arearugcleaningnyc.com
leadforensics.com
loysonbryan.com
axisoflove.org:443
adabible.org
onlinetvgroup.com
denverwynkoopdentist.com
vipcarrental.ae
laylavalentine.com
aktivfriskcenter.se
acumenconsultingcompany.com
bundan.com
publicompserver.de
skyscanner.ro
test-teleachat.fr
switch-made.com
tbalp.co.uk
stressreliefadvice.com
renehartman.nl
shortsalemap.com
andrealuchesi.it
reygroup.pt
markseymourphotography.co.uk
thehovecounsellingpractice.co.uk
startuplive.org
bourchier.org
kemtron.fr
onlinemarketingsurgery.co.uk
mursall.de
janasfokus.com
noda.com.ua
cardsandloyalty.com
napisat-pismo-gubernatoru.ru:443
jaaphoekzema.nl
fridakids.com
mrkluttz.com
9nar.com
fla.se
jlgraphisme.fr
n-newmedia.de
smartercashsystem.com
ravage-webzine.nl
bertbutter.nl
stralsund-ansichten.de
ninjaki.com
drvoip.com
angelika-schwarz.com
lyricalduniya.com
dayenne-styling.nl
frimec-international.es
pureelements.nl
ramirezprono.com
mesajjongeren.nl
slotspinner.com
thegrinningmanmusical.com
schroederschoembs.com
cleanroomequipment.ie
digitale-elite.de
askstaffing.com
log-barn.co.uk
mariannelemenestrel.com
hensleymarketing.com
bmw-i-pure-impulse.com
nauticmarine.dk
frankgoll.com
zaczytana.com
lattalvor.com
egpu.fr
rattanwarehouse.co.uk
fotoeditores.com
floweringsun.org
direitapernambuco.com
epicjapanart.com
aceroprime.com
from02pro.com
landgoedspica.nl
druktemakersheerenveen.nl
hartofurniture.com
pinthelook.com
transifer.fr
alcye.com
malzomattalar.com
thenalpa.com
glennverschueren.be
augen-praxisklinik-rostock.de
yvesdoin-aquarelles.fr
atelierkomon.com
banksrl.co.za
paprikapod.com
mundo-pieces-auto.fr
collegetennis.info
alaskaremote.com
-
net
true
-
pid
28
-
prc
mydesktopqos
visio
mspub
thunderbird
ocomm
agntsvc
ocautoupds
sqbcoreservice
winword
firefox
wordpa
msaccess
ocssd
infopath
synctime
sql
mydesktopservice
outlook
isqlplussvc
tbirdconfig
steam
powerpnt
excel
xfssvccon
thebat
encsvc
oracle
dbsnmp
dbeng50
onenote
-
ransom_oneliner
All of your files are encrypted! Find {EXT}_Wannadie.txt and follow instructions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
1467
-
svc
veeam
vss
mepocs
sophos
backup
sql
svc$
memtas
Signatures
-
Sodinokibi family
-
Sodinokibi/Revil sample 1 IoCs
Processes:
resource yara_rule sample family_sodinokobi
Files
-
8d4ce23030414f443249c64ef0560fdc3e80502497b92d3d51a0ec370d457021.dll windows x86
c4c29c7e6a6897be412c7fedfcca8fe4
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
SetErrorMode
CreateThread
Sections
.text Size: 43KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 57KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.6ai0 Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ