General
-
Target
c9d1ef33ca6a91b13f43b764beb0fe55893d0345e6a49deefec01c8b9b9c1251
-
Size
247KB
-
Sample
220124-bfannshbfm
-
MD5
04d97184729b092f1d795778caec8927
-
SHA1
ee0a24536a64ed0803502501d6d6a1e336213063
-
SHA256
c9d1ef33ca6a91b13f43b764beb0fe55893d0345e6a49deefec01c8b9b9c1251
-
SHA512
c7cc2ec811f73c8b844281d689bfad03c89df321478e2cf2b4c3f0b46371bebf430349f1bfd8572d2588681189344b5b90e8a8b168ac3ac7c0d84521db1b23ec
Static task
static1
Behavioral task
behavioral1
Sample
c9d1ef33ca6a91b13f43b764beb0fe55893d0345e6a49deefec01c8b9b9c1251.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
c9d1ef33ca6a91b13f43b764beb0fe55893d0345e6a49deefec01c8b9b9c1251.exe
Resource
win10-en-20211208
Malware Config
Extracted
C:\96u871fz-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/349C731D2845E903
http://decryptor.cc/349C731D2845E903
Extracted
sodinokibi
$2a$10$ZGqIY89Jar0DY9/9Hnp6Ku0nKqXP6FZH6TuF1uc0S2.QEFDPiJ9LS
2866
spargel-kochen.de
bloggyboulga.net
huehnerauge-entfernen.de
ravensnesthomegoods.com
highlinesouthasc.com
delawarecorporatelaw.com
campus2day.de
gopackapp.com
lubetkinmediacompanies.com
leda-ukraine.com.ua
kaminscy.com
ecoledansemulhouse.fr
oslomf.no
southeasternacademyofprosthodontics.org
kuntokeskusrok.fi
sloverse.com
tuuliautio.fi
coffreo.biz
testcoreprohealthuk.com
ulyssemarketing.com
carolinepenn.com
kedak.de
grupocarvalhoerodrigues.com.br
agence-referencement-naturel-geneve.net
teresianmedia.org
tanciu.com
layrshift.eu
tulsawaterheaterinstallation.com
purposeadvisorsolutions.com
bingonearme.org
nakupunafoundation.org
markelbroch.com
spinheal.ru
woodleyacademy.org
fairfriends18.de
devstyle.org
shsthepapercut.com
sportsmassoren.com
smessier.com
harpershologram.wordpress.com
johnsonfamilyfarmblog.wordpress.com
maratonaclubedeportugal.com
aprepol.com
mylolis.com
visiativ-industry.fr
abogadosadomicilio.es
spylista.com
ditog.fr
wraithco.com
paulisdogshop.de
smalltownideamill.wordpress.com
samnewbyjax.com
diversiapsicologia.es
skanah.com
precisionbevel.com
liliesandbeauties.org
vihannesporssi.fi
happyeasterimages.org
micahkoleoso.de
dpo-as-a-service.com
em-gmbh.ch
i-arslan.de
bargningavesta.se
fannmedias.com
bsaship.com
falcou.fr
bayoga.co.uk
oneheartwarriors.at
ontrailsandboulevards.com
corendonhotels.com
tux-espacios.com
shiresresidential.com
restaurantesszimmer.de
hotelzentral.at
behavioralmedicinespecialists.com
mrsplans.net
wsoil.com.sg
kariokids.com
executiveairllc.com
launchhubl.com
ncid.bc.ca
tomoiyuma.com
gonzalezfornes.es
ceres.org.au
aminaboutique247.com
cafemattmeera.com
plantag.de
cursosgratuitosnainternet.com
jeanlouissibomana.com
olejack.ru
skiltogprint.no
vibethink.net
heidelbergartstudio.gallery
abl1.net
tomaso.gr
toreria.es
harveybp.com
romeguidedvisit.com
funjose.org.gt
stallbyggen.se
mdk-mediadesign.de
longislandelderlaw.com
abuelos.com
simplyblessedbykeepingitreal.com
conasmanagement.de
foretprivee.ca
wmiadmin.com
seminoc.com
people-biz.com
webcodingstudio.com
navyfederalautooverseas.com
kidbucketlist.com.au
sla-paris.com
buymedical.biz
berliner-versicherungsvergleich.de
filmvideoweb.com
hebkft.hu
12starhd.online
campusoutreach.org
sotsioloogia.ee
hoteledenpadova.it
healthyyworkout.com
actecfoundation.org
norovirus-ratgeber.de
quemargrasa.net
gadgetedges.com
ccpbroadband.com
cactusthebrand.com
muamuadolls.com
humancondition.com
alysonhoward.com
tandartspraktijkhartjegroningen.nl
waermetauscher-berechnen.de
oemands.dk
edrcreditservices.nl
satyayoga.de
slimani.net
lapmangfpt.info.vn
cleliaekiko.online
truenyc.co
quickyfunds.com
copystar.co.uk
danholzmann.com
ecopro-kanto.com
fitovitaforum.com
karacaoglu.nl
stupbratt.no
iqbalscientific.com
trackyourconstruction.com
jvanvlietdichter.nl
plv.media
calabasasdigest.com
fiscalsort.com
expandet.dk
proudground.org
kafu.ch
seitzdruck.com
id-et-d.fr
dr-pipi.de
bxdf.info
lebellevue.fr
upmrkt.co
sporthamper.com
allentownpapershow.com
edelman.jp
fundaciongregal.org
fensterbau-ziegler.de
sachnendoc.com
quizzingbee.com
parkcf.nl
asiluxury.com
insidegarage.pl
opatrovanie-ako.sk
mbxvii.com
ino-professional.ru
zonamovie21.net
lefumetdesdombes.com
antiaginghealthbenefits.com
deko4you.at
portoesdofarrobo.com
hexcreatives.co
creamery201.com
syndikat-asphaltfieber.de
fizzl.ru
miriamgrimm.de
manijaipur.com
labobit.it
ouryoungminds.wordpress.com
comarenterprises.com
ligiercenter-sachsen.de
newyou.at
paradicepacks.com
advokathuset.dk
dramagickcom.wordpress.com
mindpackstudios.com
love30-chanko.com
modamilyon.com
easytrans.com.au
blogdecachorros.com
charlottepoudroux-photographie.fr
lenreactiv-shop.ru
live-your-life.jp
boisehosting.net
insp.bi
liikelataamo.fi
victoriousfestival.co.uk
deltacleta.cat
c-a.co.in
botanicinnovations.com
rocketccw.com
interactcenter.org
theclubms.com
pogypneu.sk
zenderthelender.com
ki-lowroermond.nl
knowledgemuseumbd.com
streamerzradio1.site
hatech.io
ikads.org
mediaacademy-iraq.org
tetinfo.in
lynsayshepherd.co.uk
stoneys.ch
milanonotai.it
xn--thucmctc-13a1357egba.com
jorgobe.at
gasolspecialisten.se
gporf.fr
handi-jack-llc.com
piajeppesen.dk
aniblinova.wordpress.com
webmaster-peloton.com
naturstein-hotte.de
remcakram.com
teczowadolina.bytom.pl
denovofoodsgroup.com
kmbshipping.co.uk
binder-buerotechnik.at
todocaracoles.com
crowd-patch.co.uk
pcprofessor.com
gasbarre.com
physiofischer.de
scenepublique.net
abogadosaccidentetraficosevilla.es
surespark.org.uk
caffeinternet.it
gymnasedumanagement.com
sexandfessenjoon.wordpress.com
jobcenterkenya.com
ftlc.es
8449nohate.org
ivivo.es
csgospeltips.se
bristolaeroclub.co.uk
y-archive.com
hugoversichert.de
rota-installations.co.uk
sweering.fr
anteniti.com
theapifactory.com
philippedebroca.com
waveneyrivercentre.co.uk
123vrachi.ru
roygolden.com
iwelt.de
daklesa.de
zzyjtsgls.com
chatizel-paysage.fr
judithjansen.com
vorotauu.ru
artallnightdc.com
greenpark.ch
bouncingbonanza.com
maineemploymentlawyerblog.com
sabel-bf.com
ymca-cw.org.uk
hkr-reise.de
amerikansktgodis.se
tecnojobsnet.com
trapiantofue.it
mercantedifiori.com
personalenhancementcenter.com
vesinhnha.com.vn
cnoia.org
slwgs.org
acomprarseguidores.com
latestmodsapks.com
dlc.berlin
helikoptervluchtnewyork.nl
freie-gewerkschaften.de
hashkasolutindo.com
birnam-wood.com
kaotikkustomz.com
saxtec.com
grelot-home.com
alsace-first.com
baylegacy.com
nancy-informatique.fr
midmohandyman.com
gastsicht.de
dontpassthepepper.com
parks-nuernberg.de
themadbotter.com
no-plans.com
geisterradler.de
evangelische-pfarrgemeinde-tuniberg.de
basisschooldezonnewijzer.nl
frontierweldingllc.com
groupe-frayssinet.fr
extensionmaison.info
alhashem.net
bridgeloanslenders.com
sterlingessay.com
kingfamily.construction
2ekeus.nl
krlosdavid.com
milsing.hr
esope-formation.fr
operaslovakia.sk
tigsltd.com
smithmediastrategies.com
thomasvicino.com
naswrrg.org
madinblack.com
lusak.at
allfortheloveofyou.com
unim.su
urist-bogatyr.ru
mikeramirezcpa.com
blgr.be
narcert.com
pmc-services.de
tanzprojekt.com
socstrp.org
talentwunder.com
dnepr-beskid.com.ua
igfap.com
mrxermon.de
kampotpepper.gives
musictreehouse.net
noixdecocom.fr
kikedeoliveira.com
airconditioning-waalwijk.nl
fotoideaymedia.es
denifl-consulting.at
blewback.com
praxis-management-plus.de
teknoz.net
huissier-creteil.com
almosthomedogrescue.dog
camsadviser.com
turkcaparbariatrics.com
qlog.de
jsfg.com
pivoineetc.fr
4net.guru
run4study.com
apprendrelaudit.com
iphoneszervizbudapest.hu
crowcanyon.com
bbsmobler.se
101gowrie.com
pomodori-pizzeria.de
celeclub.org
symphonyenvironmental.com
irishmachineryauctions.com
haremnick.com
marketingsulweb.com
notsilentmd.org
ncs-graphic-studio.com
blacksirius.de
helenekowalsky.com
nsec.se
courteney-cox.net
beaconhealthsystem.org
nataschawessels.com
shadebarandgrillorlando.com
the-domain-trader.com
seproc.hn
geoffreymeuli.com
creative-waves.co.uk
gemeentehetkompas.nl
mbfagency.com
drinkseed.com
waywithwords.net
abogados-en-alicante.es
bptdmaluku.com
steampluscarpetandfloors.com
balticdentists.com
ruralarcoiris.com
ctrler.cn
christ-michael.net
drugdevice.org
zervicethai.co.th
psa-sec.de
plotlinecreative.com
homng.net
stoeberstuuv.de
koko-nora.dk
smokeysstoves.com
rksbusiness.com
myhealth.net.au
hypozentrum.com
ungsvenskarna.se
figura.team
eadsmurraypugh.com
cuppacap.com
nacktfalter.de
pasvenska.se
worldhealthbasicinfo.com
baptisttabernacle.com
faroairporttransfers.net
mrsfieldskc.com
partnertaxi.sk
bockamp.com
bradynursery.com
maureenbreezedancetheater.org
embracinghiscall.com
milltimber.aberdeen.sch.uk
associacioesportivapolitg.cat
allure-cosmetics.at
transportesycementoshidalgo.es
dinslips.se
psc.de
jbbjw.com
classycurtainsltd.co.uk
collaborativeclassroom.org
igorbarbosa.com
chavesdoareeiro.com
fitnessbazaar.com
boompinoy.com
schutting-info.nl
lapinvihreat.fi
readberserk.com
forskolorna.org
35-40konkatsu.net
sahalstore.com
slashdb.com
aunexis.ch
memaag.com
bouldercafe-wuppertal.de
bigasgrup.com
galleryartfair.com
schlafsack-test.net
space.ua
xltyu.com
eglectonk.online
dutchbrewingcoffee.com
thewellnessmimi.com
ivfminiua.com
rebeccarisher.com
ladelirante.fr
mapawood.com
controldekk.com
abogadoengijon.es
shhealthlaw.com
hairnetty.wordpress.com
artotelamsterdam.com
exenberger.at
insigniapmg.com
nachhilfe-unterricht.com
the-virtualizer.com
vitavia.lt
licor43.de
neuschelectrical.co.za
xtptrack.com
marchand-sloboda.com
cuspdental.com
poultrypartners.nl
filmstreamingvfcomplet.be
work2live.de
spectrmash.ru
platformier.com
walkingdeadnj.com
new.devon.gov.uk
plastidip.com.ar
consultaractadenacimiento.com
praxis-foerderdiagnostik.de
securityfmm.com
nicoleaeschbachorg.wordpress.com
krcove-zily.eu
theshungiteexperience.com.au
xn--fn-kka.no
microcirc.net
mountsoul.de
penco.ie
shonacox.com
aglend.com.au
caribdoctor.org
raschlosser.de
promesapuertorico.com
minipara.com
d1franchise.com
sportverein-tambach.de
songunceliptv.com
rehabilitationcentersinhouston.net
stacyloeb.com
ussmontanacommittee.us
admos-gleitlager.de
troegs.com
body-guards.it
renergysolution.com
baumkuchenexpo.jp
polzine.net
centrospgolega.com
devok.info
mrtour.site
dekkinngay.com
ihr-news.jp
dushka.ua
sevenadvertising.com
tinyagency.com
idemblogs.com
norpol-yachting.com
globedivers.wordpress.com
shiftinspiration.com
marcuswhitten.site
mdacares.com
answerstest.ru
body-armour.online
triactis.com
miraclediet.fun
stemenstilte.nl
pasivect.co.uk
craigmccabe.fun
international-sound-awards.com
4youbeautysalon.com
mardenherefordshire-pc.gov.uk
officehymy.com
drnice.de
polychromelabs.com
blumenhof-wegleitner.at
spd-ehningen.de
bigbaguettes.eu
smhydro.com.pl
retroearthstudio.com
brigitte-erler.com
echtveilig.nl
amylendscrestview.com
rollingrockcolumbia.com
urclan.net
euro-trend.pl
art2gointerieurprojecten.nl
boldcitydowntown.com
balticdermatology.lt
first-2-aid-u.com
gratispresent.se
bundabergeyeclinic.com.au
malychanieruchomoscipremium.com
xn--logopdie-leverkusen-kwb.de
rosavalamedahr.com
deepsouthclothingcompany.com
architekturbuero-wagner.net
unetica.fr
glennroberts.co.nz
alfa-stroy72.com
craftleathermnl.com
klimt2012.info
waynela.com
kissit.ca
werkkring.nl
pierrehale.com
mastertechengineering.com
croftprecision.co.uk
cyntox.com
iyengaryogacharlotte.com
kao.at
maasreusel.nl
mooshine.com
meusharklinithome.wordpress.com
huesges-gruppe.de
highimpactoutdoors.net
aodaichandung.com
homecomingstudio.com
chaotrang.com
arteservicefabbro.com
antonmack.de
wellplast.se
chefdays.de
brandl-blumen.de
promalaga.es
twohourswithlena.wordpress.com
vancouver-print.ca
webhostingsrbija.rs
igrealestate.com
lichencafe.com
citymax-cr.com
agence-chocolat-noir.com
havecamerawilltravel2017.wordpress.com
ausbeverage.com.au
systemate.dk
spsshomeworkhelp.com
tips.technology
fibrofolliculoma.info
mymoneyforex.com
tarotdeseidel.com
garage-lecompte-rouen.fr
richard-felix.co.uk
juneauopioidworkgroup.org
sagadc.com
wasmachtmeinfonds.at
ohidesign.com
tennisclubetten.nl
corola.es
anybookreader.de
mediaplayertest.net
commercialboatbuilding.com
carlosja.com
houseofplus.com
kamahouse.net
blood-sports.net
klusbeter.nl
leeuwardenstudentcity.nl
lorenacarnero.com
parebrise-tla.fr
sportiomsportfondsen.nl
bargningharnosand.se
stoeferlehalle.de
lapinlviasennus.fi
charlesreger.com
puertamatic.es
compliancesolutionsstrategies.com
rumahminangberdaya.com
ncuccr.org
smogathon.com
trystana.com
dutchcoder.nl
tophumanservicescourses.com
intecwi.com
advizewealth.com
danskretursystem.dk
hihaho.com
moveonnews.com
naturavetal.hr
x-ray.ca
cursoporcelanatoliquido.online
nativeformulas.com
delchacay.com.ar
candyhouseusa.com
luckypatcher-apkz.com
365questions.org
jacquin-maquettes.com
zewatchers.com
accountancywijchen.nl
rostoncastings.co.uk
schmalhorst.de
solhaug.tk
littlebird.salon
beyondmarcomdotcom.wordpress.com
dezatec.es
levdittliv.se
hellohope.com
naturalrapids.com
sanaia.com
foryourhealth.live
girlillamarketing.com
farhaani.com
kunze-immobilien.de
wychowanieprzedszkolne.pl
tinkoff-mobayl.ru
dsl-ip.de
flexicloud.hk
uranus.nl
live-con-arte.de
travelffeine.com
leather-factory.co.jp
toponlinecasinosuk.co.uk
thenewrejuveme.com
lbcframingelectrical.com
baustb.de
refluxreducer.com
ora-it.de
evergreen-fishing.com
marietteaernoudts.nl
seagatesthreecharters.com
dw-css.de
justinvieira.com
kadesignandbuild.co.uk
senson.fi
backstreetpub.com
i-trust.dk
punchbaby.com
presseclub-magdeburg.de
chandlerpd.com
web.ion.ag
bookspeopleplaces.com
pridoxmaterieel.nl
comparatif-lave-linge.fr
theletter.company
jenniferandersonwriter.com
tsklogistik.eu
prochain-voyage.net
kosterra.com
despedidascostablanca.es
veybachcenter.de
henricekupper.com
iwr.nl
rozemondcoaching.nl
pubweb.carnet.hr
ogdenvision.com
daniel-akermann-architektur-und-planung.ch
asgestion.com
coding-marking.com
pay4essays.net
xn--vrftet-pua.biz
pt-arnold.de
julis-lsa.de
reddysbakery.com
rhinosfootballacademy.com
slupetzky.at
vetapharma.fr
thedad.com
humanityplus.org
xn--singlebrsen-vergleich-nec.com
psnacademy.in
fotoscondron.com
polymedia.dk
tenacitytenfold.com
modelmaking.nl
selfoutlet.com
mezhdu-delom.ru
monark.com
asteriag.com
commonground-stories.com
greenko.pl
evologic-technologies.com
jandaonline.com
antenanavi.com
DupontSellsHomes.com
siluet-decor.ru
jadwalbolanet.info
nmiec.com
tradiematepro.com.au
alten-mebel63.ru
kaliber.co.jp
biapi-coaching.fr
jameskibbie.com
sobreholanda.com
merzi.info
entopic.com
westdeptfordbuyrite.com
maryloutaylor.com
conexa4papers.trade
bricotienda.com
panelsandwichmadrid.es
calxplus.eu
atozdistribution.co.uk
tastewilliamsburg.com
bildungsunderlebnis.haus
apolomarcas.com
ceid.info.tr
thailandholic.com
phantastyk.com
innote.fi
ftf.or.at
xn--rumung-bua.online
bierensgebakkramen.nl
oceanastudios.com
rimborsobancario.net
iyahayki.nl
suncrestcabinets.ca
stampagrafica.es
mepavex.nl
mountaintoptinyhomes.com
videomarketing.pro
ziegler-praezisionsteile.de
limassoldriving.com
colorofhorses.com
villa-marrakesch.de
summitmarketingstrategies.com
otsu-bon.com
ilso.net
argenblogs.com.ar
schraven.de
imperfectstore.com
crediacces.com
mir-na-iznanku.com
lillegrandpalais.com
degroenetunnel.com
hmsdanmark.dk
ledmes.ru
craigvalentineacademy.com
simpkinsedwards.co.uk
noskierrenteria.com
destinationclients.fr
supportsumba.nl
faronics.com
cimanchesterescorts.co.uk
dirittosanitario.biz
yousay.site
kamienny-dywan24.pl
danielblum.info
vdberg-autoimport.nl
elpa.se
mirkoreisser.de
jusibe.com
serce.info.pl
jobmap.at
mariposapropaneaz.com
trulynolen.co.uk
global-kids.info
analiticapublica.es
micro-automation.de
321play.com.hk
wari.com.pe
better.town
herbstfeststaefa.ch
kalkulator-oszczednosci.pl
bauertree.com
koken-voor-baby.nl
walter-lemm.de
mediaclan.info
cheminpsy.fr
1kbk.com.ua
journeybacktolife.com
jiloc.com
radaradvies.nl
verbisonline.com
smartypractice.com
solerluethi-allart.ch
zso-mannheim.de
lykkeliv.net
bodyfulls.com
aco-media.nl
nuzech.com
eaglemeetstiger.de
cortec-neuro.com
freie-baugutachterpraxis.de
oneplusresource.org
artige.com
blossombeyond50.com
tandartspraktijkheesch.nl
friendsandbrgrs.com
finde-deine-marke.de
myhostcloud.com
theadventureedge.com
mirjamholleman.nl
softsproductkey.com
pferdebiester.de
carrybrands.nl
podsosnami.ru
vox-surveys.com
aakritpatel.com
centromarysalud.com
cranleighscoutgroup.org
sinal.org
hushavefritid.dk
adultgamezone.com
hvccfloorcare.com
wien-mitte.co.at
sw1m.ru
aurum-juweliere.de
yassir.pro
lightair.com
danubecloud.com
autopfand24.de
effortlesspromo.com
d2marketing.co.uk
ai-spt.jp
sarbatkhalsafoundation.org
makeitcount.at
paymybill.guru
dublikator.com
luxurytv.jp
catholicmusicfest.com
ahouseforlease.com
stingraybeach.com
digivod.de
qualitaetstag.de
thomas-hospital.de
ilive.lt
ostheimer.at
sandd.nl
hannah-fink.de
datacenters-in-europe.com
osterberg.fi
kevinjodea.com
darnallwellbeing.org.uk
imadarchid.com
sojamindbody.com
katketytaanet.fi
otto-bollmann.de
oldschoolfun.net
extraordinaryoutdoors.com
babcockchurch.org
atmos-show.com
simpliza.com
xn--fnsterputssollentuna-39b.se
pointos.com
coding-machine.com
www1.proresult.no
jakekozmor.com
christinarebuffetcourses.com
lange.host
ilcdover.com
maxadams.london
fax-payday-loans.com
wacochamber.com
onlyresultsmarketing.com
vermoote.de
autodemontagenijmegen.nl
goodgirlrecovery.com
fatfreezingmachines.com
berlin-bamboo-bikes.org
adoptioperheet.fi
stefanpasch.me
cwsitservices.co.uk
zieglerbrothers.de
sofavietxinh.com
rafaut.com
tongdaifpthaiphong.net
bordercollie-nim.nl
levihotelspa.fi
mank.de
vanswigchemdesign.com
revezlimage.com
elimchan.com
hardinggroup.com
perbudget.com
nurturingwisdom.com
corona-handles.com
eraorastudio.com
devlaur.com
iviaggisonciliegie.it
yamalevents.com
biortaggivaldelsa.com
simulatebrain.com
bastutunnan.se
planchaavapor.net
buroludo.nl
mytechnoway.com
blog.solutionsarchitect.guru
pier40forall.org
mooglee.com
digi-talents.com
heurigen-bauer.at
qualitus.com
leoben.at
femxarxa.cat
kisplanning.com.au
lascuola.nl
coursio.com
finediningweek.pl
boulderwelt-muenchen-west.de
smale-opticiens.nl
hairstylesnow.site
nosuchthingasgovernment.com
autofolierung-lu.de
dr-tremel-rednitzhembach.de
deprobatehelp.com
liveottelut.com
rieed.de
lionware.de
darrenkeslerministries.com
coastalbridgeadvisors.com
withahmed.com
woodworkersolution.com
morawe-krueger.de
verytycs.com
starsarecircular.org
saarland-thermen-resort.com
sairaku.net
icpcnj.org
associationanalytics.com
socialonemedia.com
nvwoodwerks.com
loprus.pl
manutouchmassage.com
n1-headache.com
beautychance.se
vloeren-nu.nl
tampaallen.com
noesis.tech
gw2guilds.org
hiddencitysecrets.com.au
imaginado.de
kenhnoithatgo.com
hhcourier.com
educar.org
winrace.no
bee4win.com
besttechie.com
strategicstatements.com
profectis.de
brevitempore.net
manifestinglab.com
assurancesalextrespaille.fr
ventti.com.ar
tonelektro.nl
sauschneider.info
dr-seleznev.com
marathonerpaolo.com
seevilla-dr-sturm.at
thefixhut.com
jyzdesign.com
broseller.com
lmtprovisions.com
alvinschwartz.wordpress.com
vitalyscenter.es
carriagehousesalonvt.com
smejump.co.th
thaysa.com
ateliergamila.com
logopaedie-blomberg.de
cirugiauretra.es
roadwarrior.app
fitnessingbyjessica.com
whyinterestingly.ru
aarvorg.com
lescomtesdemean.be
familypark40.com
c2e-poitiers.com
outcomeisincome.com
bunburyfreightservices.com.au
stormwall.se
odiclinic.org
pv-design.de
argos.wityu.fund
mmgdouai.fr
thee.network
gantungankunciakrilikbandung.com
drfoyle.com
appsformacpc.com
theduke.de
simoneblum.de
spacecitysisters.org
parking.netgateway.eu
corelifenutrition.com
groupe-cets.com
bafuncs.org
bouquet-de-roses.com
erstatningsadvokaterne.dk
ausair.com.au
mooreslawngarden.com
cite4me.org
financescorecard.com
makeurvoiceheard.com
xoabigail.com
boosthybrid.com.au
deschl.net
sanyue119.com
augenta.com
employeesurveys.com
facettenreich27.de
zimmerei-fl.de
takeflat.com
galserwis.pl
baronloan.org
aselbermachen.com
enovos.de
caribbeansunpoker.com
wolf-glas-und-kunst.de
transliminaltribe.wordpress.com
onlybacklink.com
higadograsoweb.com
lloydconstruction.com
instatron.net
ra-staudte.de
porno-gringo.com
peterstrobos.com
deoudedorpskernnoordwijk.nl
celularity.com
hrabritelefon.hr
slimidealherbal.com
ampisolabergeggi.it
jolly-events.com
austinlchurch.com
bestbet.com
modestmanagement.com
nhadatcanho247.com
cerebralforce.net
rerekatu.com
mousepad-direkt.de
urmasiimariiuniri.ro
lukeshepley.wordpress.com
smart-light.co.uk
lachofikschiet.nl
myteamgenius.com
nokesvilledentistry.com
completeweddingkansas.com
homesdollar.com
uimaan.fi
gaiam.nl
importardechina.info
faizanullah.com
newstap.com.ng
tstaffing.nl
notmissingout.com
myzk.site
kojima-shihou.com
chrissieperry.com
durganews.com
firstpaymentservices.com
architecturalfiberglass.org
bimnapratica.com
real-estate-experts.com
edgewoodestates.org
makeflowers.ru
testzandbakmetmening.online
torgbodenbollnas.se
geekwork.pl
joyeriaorindia.com
id-vet.com
bhwlawfirm.com
macabaneaupaysflechois.com
itelagen.com
zimmerei-deboer.de
cityorchardhtx.com
haar-spange.com
anthonystreetrimming.com
you-bysia.com.au
eco-southafrica.com
htchorst.nl
bowengroup.com.au
centuryrs.com
verifort-capital.de
abitur-undwieweiter.de
projetlyonturin.fr
burkert-ideenreich.de
fransespiegels.nl
edv-live.de
atalent.fi
katiekerr.co.uk
lucidinvestbank.com
epwritescom.wordpress.com
pickanose.com
vickiegrayimages.com
vietlawconsultancy.com
connectedace.com
oncarrot.com
petnest.ir
all-turtles.com
gmto.fr
whittier5k.com
pcp-nc.com
nestor-swiss.ch
offroadbeasts.com
tanzschule-kieber.de
hotelsolbh.com.br
greenfieldoptimaldentalcare.com
herbayupro.com
ralister.co.uk
kindersitze-vergleich.de
clos-galant.com
desert-trails.com
dubnew.com
joseconstela.com
kirkepartner.dk
schoolofpassivewealth.com
autodujos.lt
solinegraphic.com
siliconbeach-realestate.com
resortmtn.com
izzi360.com
zweerscreatives.nl
bigler-hrconsulting.ch
allamatberedare.se
hokagestore.com
vibehouse.rw
castillobalduz.es
braffinjurylawfirm.com
ianaswanson.com
bodyforwife.com
kostenlose-webcams.com
heliomotion.com
yourobgyn.net
irinaverwer.com
brawnmediany.com
zflas.com
nandistribution.nl
americafirstcommittee.org
pmcimpact.com
triggi.de
stemplusacademy.com
lecantou-coworking.com
forestlakeuca.org.au
latribuessentielle.com
gamesboard.info
thedresserie.com
kojinsaisei.info
vannesteconstruct.be
jasonbaileystudio.com
pinkexcel.com
pelorus.group
upplandsspar.se
xlarge.at
michaelsmeriglioracing.com
wurmpower.at
schoellhammer.com
strandcampingdoonbeg.com
rushhourappliances.com
div-vertriebsforschung.de
fayrecreations.com
linnankellari.fi
milestoneshows.com
vyhino-zhulebino-24.ru
pocket-opera.de
ecpmedia.vn
parkstreetauto.net
stopilhan.com
mylovelybluesky.com
pawsuppetlovers.com
montrium.com
jerling.de
dareckleyministries.com
sipstroysochi.ru
pixelarttees.com
nijaplay.com
saka.gr
bogdanpeptine.ro
directwindowco.com
kath-kirche-gera.de
synlab.lt
andersongilmour.co.uk
1team.es
patrickfoundation.net
team-montage.dk
dubscollective.com
crosspointefellowship.church
servicegsm.net
-
net
true
-
pid
$2a$10$ZGqIY89Jar0DY9/9Hnp6Ku0nKqXP6FZH6TuF1uc0S2.QEFDPiJ9LS
-
prc
isqlplussvc
mydesktopqos
ocautoupds
thebat
dbeng50
firefox
tbirdconfig
thunderbird
synctime
powerpnt
winword
mspub
steam
sqbcoreservice
encsvc
onenote
oracle
visio
dbsnmp
agntsvc
sql
infopath
xfssvccon
msaccess
ocssd
wordpad
excel
mydesktopservice
outlook
ocomm
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
2866
-
svc
memtas
mepocs
svc$
vss
backup
sql
veeam
sophos
Extracted
C:\t0qrpg42-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/1020560E2095C69E
http://decryptor.cc/1020560E2095C69E
Targets
-
-
Target
c9d1ef33ca6a91b13f43b764beb0fe55893d0345e6a49deefec01c8b9b9c1251
-
Size
247KB
-
MD5
04d97184729b092f1d795778caec8927
-
SHA1
ee0a24536a64ed0803502501d6d6a1e336213063
-
SHA256
c9d1ef33ca6a91b13f43b764beb0fe55893d0345e6a49deefec01c8b9b9c1251
-
SHA512
c7cc2ec811f73c8b844281d689bfad03c89df321478e2cf2b4c3f0b46371bebf430349f1bfd8572d2588681189344b5b90e8a8b168ac3ac7c0d84521db1b23ec
-
Detect Neshta Payload
-
Modifies system executable filetype association
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-