Static task
static1
Behavioral task
behavioral1
Sample
d48768e88cecdf0a5aea8862d748fb5be1a468da404a64b6a7fc9e94efd594e3.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
d48768e88cecdf0a5aea8862d748fb5be1a468da404a64b6a7fc9e94efd594e3.exe
Resource
win10-en-20211208
General
-
Target
d48768e88cecdf0a5aea8862d748fb5be1a468da404a64b6a7fc9e94efd594e3
-
Size
164KB
-
MD5
a516f397c9082f002550effe26f31628
-
SHA1
806784793ead7a2dadf85c257398d27a502e829a
-
SHA256
d48768e88cecdf0a5aea8862d748fb5be1a468da404a64b6a7fc9e94efd594e3
-
SHA512
874901ef785aaf38586633c3f1968b33522f5e79dfd542b571bd720f63b954823b39aba9d4ffb4ee11657d8befc10eed06cc297fa9e05dc0fe9ec31366eaf812
-
SSDEEP
3072:9fg0NBlu9CNTed7/kBazzFbUL8BJ+aXZufPSOh:9Y0NvuUN6F/M4qwBbwSOh
Malware Config
Extracted
sodinokibi
34
295
andreaskildegaard.dk
catchup-mag.com
lovetzuchia.com
taulunkartano.fi
animalfood-online.de
pixelhealth.net
zealcon.ae
rentingwell.com
lyricalduniya.com
precisetemp.com
rivermusic.nl
girlish.ae
guohedd.com
patassociation.com
tradenavigator.ch
vvego.com
davedavisphotos.com
krishnabrawijaya.com
mgimalta.com
the3-week-diet.net
happylublog.wordpress.com
sprintcoach.com
fann.ru
prometeyagro.com.ua
chomiksy.net
wg-heiligenstadt.de
relevantonline.eu
putzen-reinigen.com
polynine.com
mursall.de
nginx.com
o2o-academy.com
profibersan.com
brighthillgroup.com
leadforensics.com
tatyanakopieva.ru
terraflair.de
chris-anne.com
diverfiestas.com.es
altitudeboise.com
zorgboerderijravensbosch.nl
studionumerik.fr
pro-gamer.pl
teethinadaydentalimplants.com
groovedealers.ru
strauchs-wanderlust.info
comoserescritor.com
hostastay.com
innervisions-id.com
111firstdelray.com
nicksrock.com
epicjapanart.com
thehovecounsellingpractice.co.uk
hotjapaneselesbian.com
1deals.com
avis.mantova.it
monstarrsoccer.com
mariamalmahdi.com
egpu.fr
angelika-schwarz.com
colored-shelves.com
hepishopping.com
so-sage.fr
atma.nl
skoczynski.eu
morgansconsult.com
awag-blog.de
bcabattoirs.org
forextimes.ru
startuplive.org
leansupremegarcinia.net
flossmoordental.com
mayprogulka.ru
napisat-pismo-gubernatoru.ru:443
zuerich-umzug.ch
imagine-entertainment.com
fixx-repair.com
silkeight.com
bertbutter.nl
pourlabretagne.bzh
easydental.ae
carolynfriedlander.com
digitale-elite.de
xn--80addfr4ahr.dp.ua
welovecustomers.fr
global-migrate.com
bilius.dk
forumsittard.nl
sshomme.com
bodymindchallenger.com
frankgoll.com
lgiwines.com
drnelsonpediatrics.com
pubcon.com
wrinstitute.org
mikegoodfellow.co.uk
elliemaccreative.wordpress.com
chainofhopeeurope.eu
sweetz.fr
alattekniksipil.com
bmw-i-pure-impulse.com
campusescalade.com
ketomealprep.academy
arthakapitalforvaltning.dk
agenceassemble.fr
aciscomputers.com
eastgrinsteadwingchun.com
michal-s.co.il
angelsmirrorus.com
suitesartemis.gr
burg-zelem.de
dinedrinkdetroit.com
wallflowersandrakes.com
reygroup.pt
billscars.net
frimec-international.es
cesep2019.com
jakubrybak.com
jaaphoekzema.nl
denverwynkoopdentist.com
mindsparkescape.com
physio-lang.de
istantidigitali.com
delegationhub.com
successcolony.com.ng
smartercashsystem.com
hameghlim.com
lookandseen.com
rishigangoly.com
marmarabasin.com
happycatering.de
jefersonalessandro.com
bluetenreich-brilon.de
scietech.academy
stressreliefadvice.com
medicalsupportco.com
stabilisateur.fr
ced-elec.com
craftingalegacy.com
ciga-france.fr
motocrosshideout.com
lapponiasafaris.com
cxcompany.com
galaniuklaw.com
hekecrm.com
sjtpo.org
orchardbrickwork.com
leloupblanc.gr
iexpert99.com
asiaartgallery.jp
circuit-diagramz.com
kartuindonesia.com
kombi-dress.com
descargandoprogramas.com
ninjaki.com
veggienessa.com
the-cupboard.co.uk
myfbateam.com
cc-experts.de
efficiencyconsulting.es
martinipstudios.com
eos-horlogerie.com
adaduga.info
der-stempelking.de
imaginekithomes.co.nz
rino-gmbh.com
bendel-partner.de
lassocrm.com
ilveshistoria.com
transifer.fr
uci-france.fr
t3brothers.com
advancedeyecare.com
fitnessblenderstory.com
rvside.com
geitoniatonaggelon.gr
irizar.com
ziliak.com
bulyginnikitav.000webhostapp.com
landgoedspica.nl
cymru.futbol
rs-danmark.dk
devus.de
jobkiwi.com.ng
operativadigital.com
betterce.com
werkzeugtrolley.net
janasfokus.com
heimdalbygg.no
photonag.com
ilovefullcircle.com
gazelle-du-web.com
larchwoodmarketing.com
condormobile.fr
supercarhire.co.uk
nrgvalue.com
auberives-sur-vareze.fr
oscommunity.de
corporacionrr.com
askstaffing.com
hom-frisor.dk
pisofare.co
modamarfil.com
rapid5kloan.org
acibademmobil.com.tr
malzomattalar.com
pxsrl.it
insane.agency
premiumweb.com.ua:443
wineandgo.hu
elex.is
circlecitydj.com
wyreforest.net
louiedager.com
yournextshoes.com
trivselsguide.dk
mindfuelers.com
latteswithleslie.com
banksrl.co.za
singletonfinancial.com
marcandy.com
narca.net
hm-com.com
purepreprod4.com
witraz.pl
2020hindsight.info
natturestaurante.com.br
fidelitytitleoregon.com
benchbiz.com
belinda.af
nourella.com
watchsale.biz
solidhosting.nl
kryptos72.com
mollymccarthydesign.com
buerocenter-butzbach-werbemittel.de
tecleados.com
cmeow.com
tramadolhealth.com
belofloripa.be
placermonticello.com
manzel.tn
globalcompliancenews.com
specialtyhomeservicesllc.com
springfieldplumbermo.com
annenymus.com
ufovidmag.com
barbaramcfadyenjewelry.com
alene.co
paradigmlandscape.com
basindentistry.com
edrickennedymacfoy.com
optigas.com
beauty-traveller.com
stoneridgemontessori.com
blueridgeheritage.com
hnkns.com
forskolinslimeffect.net
encounter-p.net
tanatek.com
citiscapes-art.com
sarahspics.co.uk
nvisionsigns.com
mahikuchen.com
fskhjalmar.se
bonitabeachassociation.com
legundschiess.de
verbouwingsdouche.nl
k-v-f.de
jdscenter.com
focuskontur.com
tbalp.co.uk
bubbalucious.com
keyboardjournal.com
directique.com
unislaw-narty.pl
stitch-n-bitch.com
pinkxgayvideoawards.com
pharmeko-group.com
almamidwifery.com
sochi-okna23.ru
haard-totaal.nl
rubyaudiology.com
stagefxinc.com
ox-home.com
queertube.net
sachainchiuk.com
skyboundnutrition.co.uk
rolleepollee.com
golfclublandgoednieuwkerk.nl
vipcarrental.ae
sambaglow.com
paardcentraal.nl
cincinnatiphotocompany.org
motocrossplace.co.uk
haus-landliebe.de
scentedlair.com
finsahome.co.uk
centuryvisionglobal.com
awaisghauri.com
ebible.co
mariajosediazdemera.com
holocine.de
omegamarbella.com
levelseven.be
liverpoolabudhabi.ae
bratek-immobilien.de
advance-refle.com
lollachiro.com
publicompserver.de
cmascd.com
profiz.com
redpebblephotography.com
ya-elka.ru
pvandambv.nl
nexstagefinancial.com
protoplay.ca
mbuildinghomes.com
michaelfiegel.com
donau-guides.eu
leijstrom.com
ludoil.it
blucamp.com
mediogiro.com.ar
jalkapuu.net
drbenveniste.com
christianscholz.de
bluelakevision.com
crestgood.com
stathmoulis.gr
jacquesgarcianoto.com
albcleaner.fr
a-zpaperwork.eu
voice2biz.com
artvark.nl
patriotcleaning.net
xtensifi.com
reputation-medical.online
90nguyentuan.com
masecologicos.com
molinum.pt
worldproskitour.com
distrifresh.com
unexplored.gr
ijsselbeton.nl
triplettagaite.fr
baita.ac
boloria.de
onesynergyinternational.com
stringnosis.academy
metallbau-hartmann.eu
wasnederland.nl
speakaudible.com
reizenmetkinderen.be
pureelements.nl
tetameble.pl
turing.academy
endstarvation.com
grupoexin10.com
janmorgenstern.com
oncarrot.com
etgdogz.de
mslp.org
bd2fly.com
g2mediainc.com
neolaiamedispa.com
dibli.store
glas-kuck.de
tutvracks.com
martha-frets-ceramics.nl
thepixelfairy.com
rozmata.com
nutriwell.com.sg
billigeflybilletter.dk
mrkluttz.com
georgemuncey.com
graygreenbiomedservices.com
edvestors.org
universelle.fr
noda.com.ua
dierenambulancealkmaar.nl
silverbird.dk
jobscore.com
midwestschool.org
scotlandsroute66.co.uk
broccolisoep.nl
margaretmcshane.com
pankiss.ru
charlesfrancis.photos
biodentify.ai
glennverschueren.be
look.academy
druktemakersheerenveen.nl
cap29010.it
bajova.sk
hypogenforensic.com
soundseeing.net
grafikstudio-visuell.de
augen-praxisklinik-rostock.de
subyard.com
bescomedical.de
csaballoons.com
thegrinningmanmusical.com
clinic-beethovenstrasse-ag.ch
netadultere.fr
eafx.pro
jmmartinezilustrador.com
fluzfluzrewards.com
foerderverein-vatterschule.de
kelsigordon.com
utilisacteur.fr
janellrardon.com
rokthetalk.com
stanleyqualitysystems.com
jimprattmediations.com
jonnyhooley.com
clemenfoto.dk
lashandbrowenvy.com
kellengatton.com
traitware.com
breakluckrecords.com
justaroundthecornerpetsit.com
tieronechic.com
kafkacare.com
mamajenedesigns.com
alisodentalcare.com
envomask.com
perceptdecor.com
akwaba-safaris.com
mercadodelrio.com
bakingismyyoga.com
webforsites.com
subquercy.fr
maryairbnb.wordpress.com
casinodepositors.com
lagschools.ng
jeanmonti.com
cardsandloyalty.com
animation-pro.co.uk
buzzneakers.com
artcase.pl
framemyballs.com
zaczytana.com
aidanpublishing.co.uk
karmeliterviertel.com
11.in.ua
devplus.be
dmlcpa.com
direitapernambuco.com
greeneyetattoo.com
cascinarosa33.it
mieleshopping.it
invela.dk
amorbellezaysalud.com
speiserei-hannover.de
angeleyezstripclub.com
lisa-poncon.fr
primemarineengineering.com
tothebackofthemoon.com
from02pro.com
mustangmarketinggroup.com
diakonie-weitramsdorf-sesslach.de
jobstomoveamerica.org
mac-computer-support-hamburg.de
elitkeramika-shop.com.ua
banukumbak.com
scholarquotes.com
ncjc.ca
therapybusinessacademy.com
acornishstudio.co.uk
pansionatblago.ru
chorusconsulting.net
electricianul.com
eksperdanismanlik.com
nauticmarine.dk
billyoart.com
miscbo.it
atrgroup.it
stralsund-ansichten.de
tzn.nu
outstandingminialbums.com
floweringsun.org
liveyourheartout.co
zumrutkuyutemel.com
dcc-eu.com
levencovka.ru
p-ride.live
avisioninthedesert.com
fridakids.com
goddardleadership.org
iron-mine.ru
unboxtherapy.site
mesajjongeren.nl
slideevents.be
sbit.ag
christopherhannan.com
glende-pflanzenparadies.de
itheroes.dk
kompresory-opravy.com
uncensoredhentaigif.com
eatyoveges.com
afbudsrejserallinclusive.dk
parentsandkids.com
bjornvanvulpen.nl
innersurrection.com
fysiotherapierijnmond.nl
humanviruses.org
gaearoyals.com
nxtstg.org
johnkoen.com
mneti.ru
alltagsrassismus-entknoten.de
bringmehope.org
kerstliedjeszingen.nl
5thactors.com
nationnewsroom.com
photographycreativity.co.uk
hartofurniture.com
triavlete.com
schluesseldienste-hannover.de
parksideseniorliving.net
brownswoodblog.com
leatherjees.com
rarefoods.ro
5pointpt.com
wirmuessenreden.com
ikadomus.com
skinkeeper.li
domaine-des-pothiers.com
9nar.com
lovcase.com
k-zubki.ru
jag.me
smartworkplaza.com
pinthelook.com
otpusk.zp.ua
citydogslife.com
saint-malo-developpement.fr
rizplakatjaya.com
bavovrienden.nl
fla.se
aheadloftladders.co.uk
cleanroomequipment.ie
vedsegaard.dk
brinkdoepke.eu
sharonalbrightdds.com
dieetuniversiteit.nl
dantreranch.com
loparnille.se
saberconcrete.com
phoenixcrane.com
acumenconsultingcompany.com
richardmaybury.co.uk
skyscanner.ro
prodentalblue.com
alpesiberie.com
cac2040.com
log-barn.co.uk
apiarista.de
spacebel.be
enews-qca.com
loysonbryan.com
riffenmattgarage.ch
kookooo.com
mondolandscapes.com
teutoradio.de
tesisatonarim.com
promus.ca
smarttourism.academy
myplaywin3.com
ikzoekgod.be
apmollerpension.com
parisschool.ru
fotoeditores.com
goeppinger-teppichreinigung.de
dreamvoiceclub.org
lsngroupe.com
greatofficespaces.net
c-sprop.com
greenrider.nl
factoriareloj.com
wribrazil.com
kryddersnapsen.dk
anchelor.com
nykfdyrehospital.dk
jayfurnitureco.com
soncini.ch
advesa.com
atelierkomon.com
jandhpest.com
vdolg24.online
toranjtuition.org
hotelturbo.de
trainiumacademy.com
furland.ru
campusce.com
neonodi.be
thesilkroadny.com
alwaysdc.com
tweedekansenloket.nl
livedeveloper.com
sytzedevries.com
3daywebs.com
berdonllp.com
ravage-webzine.nl
hutchstyle.co.uk
piestar.com
memphishealthandwellness.com
mind2muscle.nl
luvinsburger.fr
fta-media.com
schroederschoembs.com
xn--billigafrgpatroner-stb.se
luvbec.com
suonenjoen.fi
azerbaycanas.com
oththukaruva.com
qandmmusiccenter.com
voetbalhoogeveen.nl
nalliasmali.net
littlesaints.academy
charlottelhanna.com
heuvelland-oaze.nl
amco.net.au
onlinetvgroup.com
bychowo.pl
cp-bap.de
iactechnologies.net
gbk-tp1.de
hostaletdelsindians.es
slotenmakerszwijndrecht.nl
thenalpa.com
logosindustries.com
skidpiping.de
concontactodirecto.com
olry-cloisons.fr
fire-space.com
anleggsregisteret.no
mangimirossana.it
fi-institutionalfunds.com
teamsegeln.ch
collegetennis.info
buffdaddyblog.com
cookinn.nl
newonestop.com
deduktia.fi
malevannye.ru
rename.kz
dogsunlimitedguide.com
grancanariaregional.com
zdrowieszczecin.pl
affligemsehondenschool.be
racefietsenblog.nl
arabianmice.com
topautoinsurers.net
lumturo.academy
adabible.org
designimage.ae
nbva.co.uk
fsbforsale.com
finnergo.eu
bcmets.info
shrinkingplanet.com
aslog.fr
raeoflightmusic.com
klapanvent.ru
eurethicsport.eu
factorywizuk.com
brannbornfastigheter.se
matteoruzzaofficial.com
santastoy.store
internalresults.com
claudiakilian.de
airserviceunlimited.com
dr-vita.de
gavelmasters.com
markseymourphotography.co.uk
block-optic.com
coachpreneuracademy.com
agriturismocastagneto.it
mundo-pieces-auto.fr
abulanov.com
jglconsultancy.com
shortsalemap.com
test-teleachat.fr
awaitspain.com
sveneulberg.de
cuadc.org
innovationgames-brabant.nl
akcadagofis.com
theintellect.edu.pk
advanced-removals.co.uk
bruut.online
liepertgrafikweb.at
apogeeconseils.fr
muller.nl
aktivfriskcenter.se
theboardroomafrica.com
futurenetworking.com
sololibrerie.it
craftron.com
oro.ae
letsstopsmoking.co.uk
pajagus.fr
aberdeenartwalk.org
m2graph.fr
spartamovers.com
ntinasfiloxenia.gr
dentallabor-luenen.de
dinecorp.com
randyabrown.com
mike.matthies.de
alcye.com
kamin-somnium.de
carsten.sparen-it.de
goodboyscustom.com
ronielyn.com
rossomattonecase.it
b3b.ch
proffteplo.com
expohomes.com
hvitfeldt.dk
fanuli.com.au
housesofwa.com
alabamaroofingllc.com
brisbaneosteopathic.com.au
yayasanprimaunggul.org
metriplica.academy
schlagbohrmaschinetests.com
n-newmedia.de
zinnystar.com
axisoflove.org:443
production-stills.co.uk
ramirezprono.com
drbrianhweeks.com
bagaholics.in
triplettabordeaux.fr
thiagoperez.com
adterium.com
saboboxtel.uk
nepal-pictures.com
techybash.com
mediahub.co.nz
bourchier.org
alaskaremote.com
eyedoctordallas.com
pazarspor.org.tr
hoteltantra.com
creohn.de
computer-place.de
o90.dk
perfectgrin.com
cotton-avenue.co.il
kroophold-sjaelland.dk
funworx.de
boyfriendsgoal.site
cl0nazepamblog.com
endlessrealms.net
die-immo-agentur.de
indiebizadvocates.org
weddingceremonieswithtim.com
radishallgood.com
bohrlochversicherung.info
deziplan.ru
gardenpartner.pl
laaisterplakky.nl
ownidentity.com
secrets-clubs.co.uk
go.labibini.ch
maxcube24.com.ua
the5thquestion.com
line-x.co.uk
hiddensee-buhne11.de
fotoslubna.com
inewsstar.com
keuken-prijs.nl
texanscan.org
kemtron.fr
nepressurecleaning.com
adedesign.com
airvapourbarrier.com
denhaagfoodie.nl
rhino-turf.com
fbmagazine.ru
hawthornsretirement.co.uk
dentalcircle.com
pedmanson.com
laylavalentine.com
duthler.nl
ingresosextras.online
cyberpromote.de
rhino-storage.co.uk
sellthewrightway.com
customroasts.com
eventosvirtualesexitosos.com
plbinsurance.com
andermattswisswatches.ch
mariannelemenestrel.com
xrresources.com
solutionshosting.co.uk
nuohous.com
dennisverschuur.com
thisprettyhair.com
sycamoregreenapts.com
jlgraphisme.fr
sber-biznes.com
penumbuhrambutkeiskei.com
astrographic.com
chatterchatterchatter.com
frameshift.it
selected-minds.de
richardkershawwines.co.za
sunsolutions.es
xn--80abehgab4ak0ddz.xn--p1ai
ayudaespiritualtamara.com
kiraribeaute-nani.com
baumfinancialservices.com
quitescorting.com
campinglaforetdetesse.com
ruggestar.ch
geoweb.software
explora.nl
gsconcretecoatings.com
spectamarketingdigital.com.br
bodet150ans.com
juergenblaetz.de
lunoluno.com
agencewho-aixenprovence.fr
four-ways.com
livelai.com
agendatwentytwenty.com
mjk.digital
birthplacemag.com
ronaldhendriks.nl
drvoip.com
linkbuilding.life
annida.it
hostingbangladesh.net
business-basic.de
baptistdistinctives.org
renehartman.nl
katherinealy.com
phukienbepthanhdat.com
altocontatto.net
aceroprime.com
magrinya.net
bluemarinefoundation.com
yuanshenghotel.com
globalskills.pt
yvesdoin-aquarelles.fr
parseport.com
cops4causes.org
ledyoucan.com
opticahubertruiz.com
salonlamar.nl
muni.pe
ykobbqchicken.ca
dnqa.co.uk
qwikcoach.com
bellesiniacademy.org
limounie.com
palmecophilippines.com
signamedia.de
acb-gruppe.ch
linearete.com
mrmac.com
peninggibadan.co.id
palema.gr
sppdstats.com
naukaip.ru
jollity.hu
buonabitare.com
oportowebdesign.com
hensleymarketing.com
skolaprome.eu
nevadaruralhousingstudies.org
stage-infirmier.fr
ivancacu.com
kausette.com
osn.ro
gatlinburgcottage.com
imajyuku-sozoku.com
khtrx.com
breathebettertolivebetter.com
carmel-york.com
sealgrinderpt.com
pays-saint-flour.fr
site.markkit.com.br
walterman.es
tchernia-conseil.fr
ygallerysalonsoho.com:443
richardiv.com
moira-cristescu.com
craftstone.co.nz
premier-iowa.com
kenmccallum.com
julielusktherapy.com
yourcosmicbeing.com
chinowarehousespace.com
kdbrh.com
palmenhaus-erfurt.de
bumbipdeco.site
bundan.com
baikalflot.ru
xn--ziinoapte-6ld.ro
trevi-vl.ru
kosten-vochtbestrijding.be
thestudio.academy
rtc24.com
evsynthacademy.org
beandrivingschool.com.au
whoopingcrane.com
karelinjames.com
goodherbalhealth.com
magnetvisual.com
eshop.design
daveystownhouse.com
redctei.co
ahgarage.com
handyman-silkeborg.dk
web865.com
victorvictoria.com
oexebusiness.com
hawaiisteelbuilding.com
cormanmarketing.com
agrifarm.dk
latableacrepes-meaux.fr
biblica.com
topvijesti.net
skooppi.fi
vitoriaecoturismo.com.br
brunoimmobilier.com
aquacheck.co.za
rentsportsequip.com
smartmind.net
biketruck.de
bg.szczecin.pl
blavait.fr
volta.plus
peppergreenfarmcatering.com.au
initconf.com
koncept-m.ru
testitjavertailut.net
tages-geldvergleich.de
metroton.ru
galatee-couture.com
matthieupetel.fr
tellthebell.website
husetsanitas.dk
babysitting-hk.helpergo.co
pilotgreen.com
andrealuchesi.it
nieuwsindeklas.be
hospitalitytrainingsolutions.co.uk
cainlaw-okc.com
slotspinner.com
rattanwarehouse.co.uk
fazagostar.co
jameswilliamspainting.com
simpleitsolutions.ch
allinonecampaign.com
ceocenters.com
tilldeeke.de
auto-opel.ro
limmortelyouth.com
gosouldeep.com
smartspeak.com
ultimatelifesource.com
bookingwheel.com
fascaonline.com
internestdigital.com
dentourage.com
alharsunindo.com
lexced.com
hinotruckwreckers.com.au
vitormmcosta.com
oraweb.net
professionetata.com
mediabolmong.com
kuriero.pro
metcalfe.ca
jax-interim-and-projectmanagement.com
energosbit-rp.ru
shortysspices.com
thegetawaycollective.com
gurutechnologies.net
activeterroristwarningcompany.com
avtoboss163.ru:443
arazi.eus
mensemetgesigte.co.za
onlinemarketingsurgery.co.uk
rsidesigns.com
agora-collectivites.com
autoteamlast.de
paprikapod.com
lattalvor.com
mazzaropi.com.br
amyandzac.com
switch-made.com
bayshoreelite.com
interlinkone.com
kvetymichalovce.sk
rechtenplicht.be
alnectus.com
leopoldineroux.com
theater-lueneburg.de
gratiocafeblog.wordpress.com
boomerslivinglively.com
the-beauty-guides.com
amelielecompte.wordpress.com
epsondriversforwindows.com
alexwenzel.de
catering.com
theatre-embellie.fr
mrcar.nl
cssp-mediation.org
tastevirginia.com
towelroot.co
arearugcleaningnyc.com
datatri.be
schulz-moelln.de
yourhappyevents.fr
lidkopingsnytt.nu
makingmillionaires.net
catalyseurdetransformation.com
kristianboennelykke.dk
opt4cdi.com
espaciopolitica.com
docarefoundation.org
domilivefurniture.com
azloans.com
antesacademy.it
qrs-international.com
harleystreetspineclinic.com
valiant-voice.com
zwemofficial.nl
licensed-public-adjuster.com
lifeinbreaths.com
gta-jjb.fr
ncn.nl
satoblog.org
chatberlin.de
spirello.nl
poems-for-the-soul.ch
bridalcave.com
ideamode.com
powershell.su
kickittickets.com
lesyeuxbleus.net
molade.nl
letterscan.de
omnicademy.com
entdoctor-durban.com
projektparkiet.pl
johnstonmingmanning.com
min-virksomhed.dk
dayenne-styling.nl
aoyama.ac
renderbox.ch
pokemonturkiye.com
lmmont.sk
signededenroth.dk
vapiano.fr
wademurray.com
mazift.dk
ddmgen.com
wordpress.idium.no
achetrabalhos.com
enactusnhlstenden.com
ocduiblog.com
jlwilsonbooks.com
curtsdiscountguns.com
johnsonweekly.com
-
net
true
-
pid
34
-
prc
winword
dbeng50
mspub
wordpad
outlook
dbsnmp
mydesktopqos
sqlwriter
isqlplussvc
mysqld
sqlbrowser
msftesql
sqlservr
onenote
thebat
oracle
visio
xfssvccon
sqbcoreservice
firefoxconfig
mydesktopservice
infopath
mysqld_nt
encsvc
ocomm
thunderbird
tbirdconfig
excel
msaccess
powerpnt
mysqld_opt
agntsvc
thebat64
ocssd
ocautoupds
steam
sqlagent
synctime
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
295
-
svc
sql
mepocs
backup
memtas
svc$
sophos
veeam
vss
Signatures
-
Sodinokibi family
-
Sodinokibi/Revil sample 1 IoCs
Processes:
resource yara_rule sample family_sodinokobi
Files
-
d48768e88cecdf0a5aea8862d748fb5be1a468da404a64b6a7fc9e94efd594e3.exe windows x86
c88f20b29592f2107a629e815db6afae
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetErrorMode
Sections
.text Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 57KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.wtq999 Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ