General
-
Target
cedcfc2954f0bef091a0db5900d0b2a13adb883d41b37d7e0db4af7234dcd862
-
Size
204KB
-
Sample
220124-bdnshshbcl
-
MD5
12d2c87f6184659aeba6189dd828e062
-
SHA1
0b1f505a6458053f5e18fc8677b748985f669926
-
SHA256
cedcfc2954f0bef091a0db5900d0b2a13adb883d41b37d7e0db4af7234dcd862
-
SHA512
9472e0fe4ecc4afad8aa33f86fbbc0aa53003d880d12921bb0b9156d77758474fb6ccb25d175b750162abe1ebc3ea18e33f6d3898fc927afef0979c64274e4e6
Static task
static1
Behavioral task
behavioral1
Sample
cedcfc2954f0bef091a0db5900d0b2a13adb883d41b37d7e0db4af7234dcd862.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
cedcfc2954f0bef091a0db5900d0b2a13adb883d41b37d7e0db4af7234dcd862.exe
Resource
win10-en-20211208
Malware Config
Extracted
C:\704555u-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/FD5299385D96D435
http://decryptor.top/FD5299385D96D435
Extracted
sodinokibi
19
99
hekecrm.com
jax-interim-and-projectmanagement.com
donau-guides.eu
ideamode.com
valiant-voice.com
thehovecounsellingpractice.co.uk
sochi-okna23.ru
frimec-international.es
osn.ro
pinkxgayvideoawards.com
banksrl.co.za
startuplive.org
asiaartgallery.jp
11.in.ua
campusescalade.com
pubcon.com
mahikuchen.com
georgemuncey.com
azerbaycanas.com
wademurray.com
aceroprime.com
nevadaruralhousingstudies.org
liepertgrafikweb.at
levelseven.be
stage-infirmier.fr
poems-for-the-soul.ch
eyedoctordallas.com
nieuwsindeklas.be
jag.me
tages-geldvergleich.de
supercarhire.co.uk
michaelfiegel.com
alharsunindo.com
teutoradio.de
ilveshistoria.com
perfectgrin.com
ciga-france.fr
mrmac.com
photonag.com
modamarfil.com
molinum.pt
bakingismyyoga.com
sealgrinderpt.com
altitudeboise.com
xn--ziinoapte-6ld.ro
mind2muscle.nl
so-sage.fr
brisbaneosteopathic.com.au
dantreranch.com
olry-cloisons.fr
eos-horlogerie.com
ownidentity.com
craftingalegacy.com
schlagbohrmaschinetests.com
explora.nl
logosindustries.com
riffenmattgarage.ch
lunoluno.com
utilisacteur.fr
nxtstg.org
profiz.com
oexebusiness.com
baptistdistinctives.org
metriplica.academy
energosbit-rp.ru
pvandambv.nl
animation-pro.co.uk
global-migrate.com
werkzeugtrolley.net
newonestop.com
nvisionsigns.com
the5thquestion.com
morgansconsult.com
muni.pe
johnstonmingmanning.com
duthler.nl
goodherbalhealth.com
atrgroup.it
arthakapitalforvaltning.dk
datatri.be
stabilisateur.fr
blueridgeheritage.com
alexwenzel.de
tesisatonarim.com
ahgarage.com
geitoniatonaggelon.gr
teethinadaydentalimplants.com
evsynthacademy.org
brannbornfastigheter.se
mangimirossana.it
avisioninthedesert.com
kausette.com
thegetawaycollective.com
bayshoreelite.com
site.markkit.com.br
log-barn.co.uk
lisa-poncon.fr
hom-frisor.dk
o90.dk
designimage.ae
mariamalmahdi.com
cymru.futbol
cxcompany.com
aberdeenartwalk.org
janmorgenstern.com
activeterroristwarningcompany.com
magnetvisual.com
littlesaints.academy
xrresources.com
cl0nazepamblog.com
anchelor.com
trainiumacademy.com
terraflair.de
mundo-pieces-auto.fr
animalfood-online.de
bagaholics.in
ijsselbeton.nl
tchernia-conseil.fr
min-virksomhed.dk
mneti.ru
distrifresh.com
solutionshosting.co.uk
stressreliefadvice.com
cmascd.com
metroton.ru
santastoy.store
trevi-vl.ru
parisschool.ru
jakubrybak.com
colored-shelves.com
quitescorting.com
auberives-sur-vareze.fr
benchbiz.com
spacebel.be
expohomes.com
galatee-couture.com
oro.ae
loparnille.se
bilius.dk
csaballoons.com
imaginekithomes.co.nz
brunoimmobilier.com
leijstrom.com
lashandbrowenvy.com
matthieupetel.fr
apiarista.de
myplaywin3.com
framemyballs.com
augen-praxisklinik-rostock.de
n-newmedia.de
ludoil.it
radishallgood.com
kristianboennelykke.dk
acibademmobil.com.tr
stralsund-ansichten.de
ufovidmag.com
luvbec.com
stathmoulis.gr
jacquesgarcianoto.com
keyboardjournal.com
amorbellezaysalud.com
astrographic.com
stringnosis.academy
jglconsultancy.com
qandmmusiccenter.com
billigeflybilletter.dk
hostastay.com
netadultere.fr
kroophold-sjaelland.dk
cascinarosa33.it
qrs-international.com
awag-blog.de
billscars.net
block-optic.com
hostingbangladesh.net
linkbuilding.life
unislaw-narty.pl
mikegoodfellow.co.uk
deziplan.ru
selected-minds.de
palema.gr
laylavalentine.com
premiumweb.com.ua:443
nalliasmali.net
martha-frets-ceramics.nl
reputation-medical.online
ronielyn.com
traitware.com
test-teleachat.fr
ayudaespiritualtamara.com
5pointpt.com
ultimatelifesource.com
miscbo.it
alisodentalcare.com
karelinjames.com
topautoinsurers.net
ebible.co
fotoslubna.com
sytzedevries.com
pharmeko-group.com
zaczytana.com
aheadloftladders.co.uk
schulz-moelln.de
jobkiwi.com.ng
enactusnhlstenden.com
texanscan.org
oraweb.net
bychowo.pl
towelroot.co
legundschiess.de
akcadagofis.com
tieronechic.com
alcye.com
awaitspain.com
pisofare.co
sjtpo.org
sambaglow.com
ingresosextras.online
thepixelfairy.com
mac-computer-support-hamburg.de
onlinetvgroup.com
angelika-schwarz.com
oportowebdesign.com
paprikapod.com
jdscenter.com
secrets-clubs.co.uk
tramadolhealth.com
charlottelhanna.com
initconf.com
neonodi.be
smartworkplaza.com
campusce.com
gosouldeep.com
paardcentraal.nl
fascaonline.com
theater-lueneburg.de
comoserescritor.com
vitoriaecoturismo.com.br
brownswoodblog.com
avtoboss163.ru:443
fluzfluzrewards.com
chatterchatterchatter.com
collegetennis.info
bodet150ans.com
klapanvent.ru
premier-iowa.com
scholarquotes.com
tzn.nu
rizplakatjaya.com
thenalpa.com
grafikstudio-visuell.de
electricianul.com
memphishealthandwellness.com
triplettagaite.fr
vedsegaard.dk
hospitalitytrainingsolutions.co.uk
redctei.co
glennverschueren.be
bringmehope.org
jobstomoveamerica.org
fridakids.com
perceptdecor.com
matteoruzzaofficial.com
voice2biz.com
etgdogz.de
jaaphoekzema.nl
1deals.com
yuanshenghotel.com
lesyeuxbleus.net
specialtyhomeservicesllc.com
cainlaw-okc.com
boyfriendsgoal.site
putzen-reinigen.com
annida.it
rossomattonecase.it
alpesiberie.com
cormanmarketing.com
pilotgreen.com
kemtron.fr
redpebblephotography.com
denhaagfoodie.nl
globalcompliancenews.com
dentalcircle.com
skyboundnutrition.co.uk
daveystownhouse.com
nginx.com
angelsmirrorus.com
sycamoregreenapts.com
baikalflot.ru
pansionatblago.ru
wyreforest.net
mustangmarketinggroup.com
motocrossplace.co.uk
cp-bap.de
verbouwingsdouche.nl
stanleyqualitysystems.com
relevantonline.eu
bundan.com
amyandzac.com
uncensoredhentaigif.com
omnicademy.com
cap29010.it
apmollerpension.com
metcalfe.ca
strauchs-wanderlust.info
scentedlair.com
adaduga.info
husetsanitas.dk
johnkoen.com
letterscan.de
onesynergyinternational.com
90nguyentuan.com
efficiencyconsulting.es
mgimalta.com
publicompserver.de
invela.dk
carmel-york.com
polynine.com
allinonecampaign.com
wallflowersandrakes.com
pourlabretagne.bzh
unexplored.gr
clemenfoto.dk
mindsparkescape.com
zdrowieszczecin.pl
stoneridgemontessori.com
speiserei-hannover.de
omegamarbella.com
oncarrot.com
pureelements.nl
biketruck.de
ncn.nl
gazelle-du-web.com
belofloripa.be
alattekniksipil.com
epsondriversforwindows.com
iron-mine.ru
hm-com.com
devplus.be
breakluckrecords.com
vipcarrental.ae
circlecitydj.com
internestdigital.com
richardkershawwines.co.za
vitormmcosta.com
natturestaurante.com.br
kvetymichalovce.sk
scotlandsroute66.co.uk
gratiocafeblog.wordpress.com
signededenroth.dk
cesep2019.com
brinkdoepke.eu
t3brothers.com
nutriwell.com.sg
descargandoprogramas.com
topvijesti.net
paradigmlandscape.com
saberconcrete.com
diakonie-weitramsdorf-sesslach.de
finnergo.eu
martinipstudios.com
kuriero.pro
eastgrinsteadwingchun.com
5thactors.com
sellthewrightway.com
lidkopingsnytt.nu
motocrosshideout.com
cmeow.com
thiagoperez.com
sweetz.fr
janasfokus.com
penumbuhrambutkeiskei.com
luvinsburger.fr
bcmets.info
onlinemarketingsurgery.co.uk
fazagostar.co
theatre-embellie.fr
biblica.com
salonlamar.nl
jayfurnitureco.com
sber-biznes.com
palmenhaus-erfurt.de
eurethicsport.eu
k-zubki.ru
tetameble.pl
masecologicos.com
yourcosmicbeing.com
leadforensics.com
atelierkomon.com
neolaiamedispa.com
johnsonweekly.com
scietech.academy
proffteplo.com
curtsdiscountguns.com
airvapourbarrier.com
bridalcave.com
worldproskitour.com
avis.mantova.it
kellengatton.com
kryddersnapsen.dk
richardmaybury.co.uk
lumturo.academy
eksperdanismanlik.com
bonitabeachassociation.com
spirello.nl
renderbox.ch
rename.kz
gaearoyals.com
adterium.com
lexced.com
dayenne-styling.nl
gta-jjb.fr
dnqa.co.uk
elex.is
groovedealers.ru
khtrx.com
craftstone.co.nz
mjk.digital
goodboyscustom.com
reizenmetkinderen.be
ced-elec.com
zuerich-umzug.ch
nuohous.com
from02pro.com
christopherhannan.com
solidhosting.nl
agriturismocastagneto.it
liverpoolabudhabi.ae
yourhappyevents.fr
blucamp.com
grupoexin10.com
barbaramcfadyenjewelry.com
landgoedspica.nl
askstaffing.com
dmlcpa.com
chris-anne.com
domilivefurniture.com
heimdalbygg.no
rsidesigns.com
studionumerik.fr
condormobile.fr
cookinn.nl
pankiss.ru
markseymourphotography.co.uk
look.academy
tothebackofthemoon.com
agendatwentytwenty.com
bruut.online
ddmgen.com
geoweb.software
crestgood.com
jobscore.com
tellthebell.website
airserviceunlimited.com
catalyseurdetransformation.com
fsbforsale.com
andermattswisswatches.ch
suitesartemis.gr
bluetenreich-brilon.de
theboardroomafrica.com
jeanmonti.com
randyabrown.com
tbalp.co.uk
triavlete.com
liveyourheartout.co
mazift.dk
katherinealy.com
mediabolmong.com
mollymccarthydesign.com
ivancacu.com
customroasts.com
julielusktherapy.com
campinglaforetdetesse.com
9nar.com
dinecorp.com
happylublog.wordpress.com
altocontatto.net
bodymindchallenger.com
business-basic.de
innersurrection.com
baumfinancialservices.com
concontactodirecto.com
silkeight.com
noda.com.ua
schroederschoembs.com
fann.ru
agrifarm.dk
yvesdoin-aquarelles.fr
rino-gmbh.com
lollachiro.com
annenymus.com
jameswilliamspainting.com
atma.nl
nationnewsroom.com
hoteltantra.com
davedavisphotos.com
webforsites.com
palmecophilippines.com
mediogiro.com.ar
haard-totaal.nl
alene.co
boloria.de
whoopingcrane.com
the3-week-diet.net
housesofwa.com
livelai.com
stitch-n-bitch.com
bmw-i-pure-impulse.com
delegationhub.com
patriotcleaning.net
k-v-f.de
wg-heiligenstadt.de
acornishstudio.co.uk
mariannelemenestrel.com
margaretmcshane.com
antesacademy.it
gavelmasters.com
diverfiestas.com.es
ceocenters.com
bluemarinefoundation.com
rattanwarehouse.co.uk
greatofficespaces.net
fi-institutionalfunds.com
gardenpartner.pl
peppergreenfarmcatering.com.au
volta.plus
mrcar.nl
nourella.com
thestudio.academy
dinedrinkdetroit.com
abulanov.com
innovationgames-brabant.nl
endlessrealms.net
jonnyhooley.com
sarahspics.co.uk
glas-kuck.de
babysitting-hk.helpergo.co
rivermusic.nl
wirmuessenreden.com
der-stempelking.de
tilldeeke.de
pedmanson.com
prometeyagro.com.ua
monstarrsoccer.com
humanviruses.org
hensleymarketing.com
holocine.de
bescomedical.de
iexpert99.com
fysiotherapierijnmond.nl
successcolony.com.ng
lmmont.sk
skolaprome.eu
afbudsrejserallinclusive.dk
digitale-elite.de
krishnabrawijaya.com
3daywebs.com
guohedd.com
piestar.com
finsahome.co.uk
autoteamlast.de
indiebizadvocates.org
subyard.com
kelsigordon.com
mayprogulka.ru
sachainchiuk.com
aktivfriskcenter.se
boomerslivinglively.com
cssp-mediation.org
vvego.com
deduktia.fi
dentallabor-luenen.de
cincinnatiphotocompany.org
glende-pflanzenparadies.de
dogsunlimitedguide.com
advance-refle.com
foerderverein-vatterschule.de
marmarabasin.com
hartofurniture.com
phukienbepthanhdat.com
optigas.com
ziliak.com
skinkeeper.li
ikzoekgod.be
eshop.design
agora-collectivites.com
jefersonalessandro.com
ninjaki.com
photographycreativity.co.uk
linearete.com
leansupremegarcinia.net
almamidwifery.com
schluesseldienste-hannover.de
a-zpaperwork.eu
pokemonturkiye.com
espaciopolitica.com
goddardleadership.org
sshomme.com
cyberpromote.de
bjornvanvulpen.nl
patassociation.com
sololibrerie.it
bratek-immobilien.de
oththukaruva.com
primemarineengineering.com
alaskaremote.com
saint-malo-developpement.fr
die-immo-agentur.de
cuadc.org
2020hindsight.info
transifer.fr
alnectus.com
bulyginnikitav.000webhostapp.com
kookooo.com
otpusk.zp.ua
rolleepollee.com
bertbutter.nl
mercadodelrio.com
ntinasfiloxenia.gr
nicksrock.com
sbit.ag
bd2fly.com
fitnessblenderstory.com
dreamvoiceclub.org
smartmind.net
beauty-traveller.com
o2o-academy.com
billyoart.com
lapponiasafaris.com
andrealuchesi.it
akwaba-safaris.com
professionetata.com
ykobbqchicken.ca
uci-france.fr
subquercy.fr
kartuindonesia.com
greeneyetattoo.com
fixx-repair.com
forextimes.ru
rozmata.com
encounter-p.net
thisprettyhair.com
parseport.com
bavovrienden.nl
marcandy.com
forumsittard.nl
drvoip.com
graygreenbiomedservices.com
hinotruckwreckers.com.au
kafkacare.com
theintellect.edu.pk
lagschools.ng
queertube.net
coachpreneuracademy.com
koncept-m.ru
direitapernambuco.com
insane.agency
mbuildinghomes.com
birthplacemag.com
buonabitare.com
jalkapuu.net
manzel.tn
cardsandloyalty.com
advanced-removals.co.uk
limounie.com
kryptos72.com
kamin-somnium.de
malevannye.ru
eventosvirtualesexitosos.com
springfieldplumbermo.com
hostaletdelsindians.es
auto-opel.ro
molade.nl
beandrivingschool.com.au
xtensifi.com
111firstdelray.com
greenrider.nl
chainofhopeeurope.eu
belinda.af
tastevirginia.com
xn--80addfr4ahr.dp.ua
vapiano.fr
victorvictoria.com
soncini.ch
maryairbnb.wordpress.com
muller.nl
charlesfrancis.photos
nepressurecleaning.com
basindentistry.com
mariajosediazdemera.com
livedeveloper.com
ilovefullcircle.com
forskolinslimeffect.net
rishigangoly.com
soundseeing.net
sharonalbrightdds.com
fta-media.com
breathebettertolivebetter.com
karmeliterviertel.com
internalresults.com
saboboxtel.uk
bendel-partner.de
racefietsenblog.nl
m2graph.fr
therapybusinessacademy.com
chatberlin.de
gurutechnologies.net
larchwoodmarketing.com
kenmccallum.com
handyman-silkeborg.dk
sveneulberg.de
dr-vita.de
berdonllp.com
slotenmakerszwijndrecht.nl
dcc-eu.com
nepal-pictures.com
goeppinger-teppichreinigung.de
istantidigitali.com
napisat-pismo-gubernatoru.ru:443
cops4causes.org
pazarspor.org.tr
hepishopping.com
anleggsregisteret.no
placermonticello.com
hotjapaneselesbian.com
heuvelland-oaze.nl
aquacheck.co.za
rokthetalk.com
wrinstitute.org
the-cupboard.co.uk
factorywizuk.com
azloans.com
citydogslife.com
richardiv.com
jlwilsonbooks.com
opticahubertruiz.com
aciscomputers.com
lattalvor.com
rentingwell.com
mondolandscapes.com
techybash.com
universelle.fr
tecleados.com
amco.net.au
dibli.store
medicalsupportco.com
carolynfriedlander.com
kiraribeaute-nani.com
smartercashsystem.com
envomask.com
aoyama.ac
broccolisoep.nl
chorusconsulting.net
wribrazil.com
welovecustomers.fr
easydental.ae
biodentify.ai
ox-home.com
signamedia.de
thesilkroadny.com
catchup-mag.com
operativadigital.com
carsten.sparen-it.de
parksideseniorliving.net
golfclublandgoednieuwkerk.nl
wineandgo.hu
pays-saint-flour.fr
craftron.com
claudiakilian.de
ruggestar.ch
buzzneakers.com
sunsolutions.es
mensemetgesigte.co.za
buffdaddyblog.com
maxcube24.com.ua
tatyanakopieva.ru
projektparkiet.pl
shortsalemap.com
mediahub.co.nz
druktemakersheerenveen.nl
narca.net
happycatering.de
elliemaccreative.wordpress.com
edvestors.org
rubyaudiology.com
elitkeramika-shop.com.ua
ya-elka.ru
circuit-diagramz.com
parentsandkids.com
docarefoundation.org
slideevents.be
arearugcleaningnyc.com
globalskills.pt
ncjc.ca
silverbird.dk
flossmoordental.com
xn--billigafrgpatroner-stb.se
imajyuku-sozoku.com
interlinkone.com
b3b.ch
thegrinningmanmusical.com
bohrlochversicherung.info
albcleaner.fr
catering.com
renehartman.nl
rvside.com
shortysspices.com
juergenblaetz.de
jollity.hu
satoblog.org
zealcon.ae
lifeinbreaths.com
turing.academy
christianscholz.de
latteswithleslie.com
michal-s.co.il
irizar.com
lyricalduniya.com
buerocenter-butzbach-werbemittel.de
licensed-public-adjuster.com
weddingceremonieswithtim.com
spartamovers.com
galaniuklaw.com
harleystreetspineclinic.com
egpu.fr
artcase.pl
hotelturbo.de
tanatek.com
protoplay.ca
drbrianhweeks.com
epicjapanart.com
unboxtherapy.site
amelielecompte.wordpress.com
trivselsguide.dk
leatherjees.com
simpleitsolutions.ch
arabianmice.com
pixelhealth.net
rhino-turf.com
wasnederland.nl
raeoflightmusic.com
factoriareloj.com
cc-experts.de
fbmagazine.ru
fotoeditores.com
zinnystar.com
aidanpublishing.co.uk
adedesign.com
peninggibadan.co.id
banukumbak.com
xn--80abehgab4ak0ddz.xn--p1ai
fanuli.com.au
rhino-storage.co.uk
edrickennedymacfoy.com
zumrutkuyutemel.com
yournextshoes.com
switch-made.com
outstandingminialbums.com
rechtenplicht.be
blavait.fr
singletonfinancial.com
pajagus.fr
ravage-webzine.nl
c-sprop.com
fire-space.com
futurenetworking.com
mike.matthies.de
oscommunity.de
ramirezprono.com
lgiwines.com
entdoctor-durban.com
kompresory-opravy.com
burg-zelem.de
achetrabalhos.com
hypogenforensic.com
qwikcoach.com
innervisions-id.com
skyscanner.ro
pinthelook.com
skooppi.fi
grancanariaregional.com
orchardbrickwork.com
denverwynkoopdentist.com
phoenixcrane.com
bcabattoirs.org
dieetuniversiteit.nl
zwemofficial.nl
ledyoucan.com
gsconcretecoatings.com
kombi-dress.com
rentsportsequip.com
chinowarehousespace.com
cleanroomequipment.ie
teamsegeln.ch
jlgraphisme.fr
smartspeak.com
latableacrepes-meaux.fr
tutvracks.com
enews-qca.com
sppdstats.com
prodentalblue.com
girlish.ae
skidpiping.de
malzomattalar.com
corporacionrr.com
lassocrm.com
jimprattmediations.com
loysonbryan.com
alabamaroofingllc.com
reygroup.pt
devus.de
nbva.co.uk
inewsstar.com
veggienessa.com
web865.com
hnkns.com
rapid5kloan.org
chomiksy.net
agenceassemble.fr
leloupblanc.gr
skoczynski.eu
axisoflove.org:443
toranjtuition.org
gbk-tp1.de
casinodepositors.com
eatyoveges.com
mamajenedesigns.com
magrinya.net
g2mediainc.com
opt4cdi.com
clinic-beethovenstrasse-ag.ch
wordpress.idium.no
lovcase.com
myfbateam.com
tweedekansenloket.nl
precisetemp.com
janellrardon.com
ronaldhendriks.nl
walterman.es
spectamarketingdigital.com.br
haus-landliebe.de
dennisverschuur.com
keuken-prijs.nl
pxsrl.it
kickittickets.com
bluelakevision.com
laaisterplakky.nl
endstarvation.com
centuryvisionglobal.com
production-stills.co.uk
iactechnologies.net
hawthornsretirement.co.uk
makingmillionaires.net
the-beauty-guides.com
bg.szczecin.pl
focuskontur.com
bellesiniacademy.org
floweringsun.org
rs-danmark.dk
itheroes.dk
fla.se
watchsale.biz
nexstagefinancial.com
voetbalhoogeveen.nl
purepreprod4.com
shrinkingplanet.com
leopoldineroux.com
letsstopsmoking.co.uk
acumenconsultingcompany.com
hawaiisteelbuilding.com
citiscapes-art.com
kosten-vochtbestrijding.be
creohn.de
frameshift.it
bumbipdeco.site
mrkluttz.com
line-x.co.uk
zorgboerderijravensbosch.nl
testitjavertailut.net
moira-cristescu.com
lookandseen.com
bajova.sk
drbenveniste.com
betterce.com
physio-lang.de
profibersan.com
mursall.de
hutchstyle.co.uk
levencovka.ru
promus.ca
ygallerysalonsoho.com:443
stagefxinc.com
kdbrh.com
aslog.fr
ketomealprep.academy
awaisghauri.com
rarefoods.ro
mindfuelers.com
go.labibini.ch
frankgoll.com
andreaskildegaard.dk
cac2040.com
lovetzuchia.com
ocduiblog.com
nykfdyrehospital.dk
louiedager.com
brighthillgroup.com
acb-gruppe.ch
limmortelyouth.com
slotspinner.com
fidelitytitleoregon.com
triplettabordeaux.fr
smarttourism.academy
advesa.com
bubbalucious.com
p-ride.live
justaroundthecornerpetsit.com
powershell.su
sprintcoach.com
dierenambulancealkmaar.nl
fskhjalmar.se
hvitfeldt.dk
funworx.de
artvark.nl
speakaudible.com
computer-place.de
eafx.pro
witraz.pl
four-ways.com
bookingwheel.com
mesajjongeren.nl
domaine-des-pothiers.com
mazzaropi.com.br
taulunkartano.fi
hameghlim.com
jmmartinezilustrador.com
advancedeyecare.com
agencewho-aixenprovence.fr
yayasanprimaunggul.org
angeleyezstripclub.com
directique.com
adabible.org
rtc24.com
arazi.eus
vdolg24.online
metallbau-hartmann.eu
hiddensee-buhne11.de
lsngroupe.com
baita.ac
kerstliedjeszingen.nl
midwestschool.org
pro-gamer.pl
mslp.org
affligemsehondenschool.be
plbinsurance.com
bourchier.org
suonenjoen.fi
tradenavigator.ch
furland.ru
naukaip.ru
gatlinburgcottage.com
nrgvalue.com
apogeeconseils.fr
nauticmarine.dk
alltagsrassismus-entknoten.de
alwaysdc.com
ikadomus.com
drnelsonpediatrics.com
dentourage.com
imagine-entertainment.com
cotton-avenue.co.il
mieleshopping.it
jandhpest.com
-
net
true
-
pid
19
-
prc
firefoxconfig
infopath
steam
sqbcoreservice
mysqld_nt
oracle
mydesktopqos
msftesql
sqlbrowser
thebat
isqlplussvc
ocssd
sqlwriter
sqlagent
thunderbird
mysqld_opt
winword
wordpad
thebat64
visio
dbsnmp
msaccess
mydesktopservice
ocautoupds
ocomm
encsvc
excel
agntsvc
mysqld
synctime
tbirdconfig
outlook
mspub
onenote
xfssvccon
dbeng50
powerpnt
sqlservr
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
99
-
svc
veeam
vss
memtas
sophos
svc$
mepocs
backup
sql
Extracted
C:\50q9sehak-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A4B0054042AC10B0
http://decryptor.top/A4B0054042AC10B0
Targets
-
-
Target
cedcfc2954f0bef091a0db5900d0b2a13adb883d41b37d7e0db4af7234dcd862
-
Size
204KB
-
MD5
12d2c87f6184659aeba6189dd828e062
-
SHA1
0b1f505a6458053f5e18fc8677b748985f669926
-
SHA256
cedcfc2954f0bef091a0db5900d0b2a13adb883d41b37d7e0db4af7234dcd862
-
SHA512
9472e0fe4ecc4afad8aa33f86fbbc0aa53003d880d12921bb0b9156d77758474fb6ccb25d175b750162abe1ebc3ea18e33f6d3898fc927afef0979c64274e4e6
-
Modifies system executable filetype association
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-