Static task
static1
Behavioral task
behavioral1
Sample
c78bf17e6adb1c671242c0f6d15378d7b54392faffff17599b133ad4c91a3b84.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
c78bf17e6adb1c671242c0f6d15378d7b54392faffff17599b133ad4c91a3b84.exe
Resource
win10-en-20211208
General
-
Target
c78bf17e6adb1c671242c0f6d15378d7b54392faffff17599b133ad4c91a3b84
-
Size
179KB
-
MD5
1ec001b8f7f06b12358b153839fd5303
-
SHA1
1e9898f53a9d1deeb32efa2f90436e08243053f3
-
SHA256
c78bf17e6adb1c671242c0f6d15378d7b54392faffff17599b133ad4c91a3b84
-
SHA512
31b301f66dcf59ea49bf07db02da2320b8721f53bbd994677fde9d56d52846de4789457f060dfb9d8f702072601372ca2a00382612a2bfcd45df073777fe0ba0
-
SSDEEP
3072:LNKQ4JTBg0Q8F63VETed7/kBazzFbULqxipQxy:LNn4FQS63VE6F/M4q+jy
Malware Config
Extracted
sodinokibi
19
99
deduktia.fi
oraweb.net
agrifarm.dk
grupoexin10.com
beandrivingschool.com.au
primemarineengineering.com
ketomealprep.academy
smartworkplaza.com
mneti.ru
zaczytana.com
nepressurecleaning.com
sololibrerie.it
globalcompliancenews.com
physio-lang.de
leadforensics.com
internestdigital.com
innervisions-id.com
drnelsonpediatrics.com
neonodi.be
askstaffing.com
polynine.com
boomerslivinglively.com
cyberpromote.de
acornishstudio.co.uk
craftron.com
daveystownhouse.com
orchardbrickwork.com
logosindustries.com
kuriero.pro
heimdalbygg.no
eurethicsport.eu
theater-lueneburg.de
myfbateam.com
ilveshistoria.com
onlinetvgroup.com
bridalcave.com
altitudeboise.com
mursall.de
greeneyetattoo.com
ox-home.com
banksrl.co.za
studionumerik.fr
ultimatelifesource.com
site.markkit.com.br
cmeow.com
catalyseurdetransformation.com
cp-bap.de
kombi-dress.com
lifeinbreaths.com
boyfriendsgoal.site
boloria.de
kryptos72.com
foerderverein-vatterschule.de
arthakapitalforvaltning.dk
ownidentity.com
kafkacare.com
fitnessblenderstory.com
verbouwingsdouche.nl
aoyama.ac
the3-week-diet.net
ya-elka.ru
utilisacteur.fr
mikegoodfellow.co.uk
domaine-des-pothiers.com
newonestop.com
reygroup.pt
matteoruzzaofficial.com
graygreenbiomedservices.com
cormanmarketing.com
bluetenreich-brilon.de
clemenfoto.dk
cleanroomequipment.ie
janmorgenstern.com
nalliasmali.net
poems-for-the-soul.ch
avtoboss163.ru:443
radishallgood.com
ludoil.it
georgemuncey.com
rtc24.com
duthler.nl
burg-zelem.de
jacquesgarcianoto.com
secrets-clubs.co.uk
plbinsurance.com
operativadigital.com
tetameble.pl
uci-france.fr
heuvelland-oaze.nl
jeanmonti.com
mediogiro.com.ar
line-x.co.uk
arabianmice.com
lassocrm.com
o2o-academy.com
kompresory-opravy.com
gurutechnologies.net
andrealuchesi.it
adedesign.com
acumenconsultingcompany.com
aslog.fr
gbk-tp1.de
finnergo.eu
bilius.dk
thiagoperez.com
nuohous.com
ncjc.ca
imaginekithomes.co.nz
motocrossplace.co.uk
pxsrl.it
expohomes.com
protoplay.ca
jglconsultancy.com
mike.matthies.de
drbrianhweeks.com
mollymccarthydesign.com
ahgarage.com
teethinadaydentalimplants.com
fixx-repair.com
gavelmasters.com
jayfurnitureco.com
andermattswisswatches.ch
leopoldineroux.com
rechtenplicht.be
karelinjames.com
catchup-mag.com
beauty-traveller.com
barbaramcfadyenjewelry.com
rokthetalk.com
ayudaespiritualtamara.com
cookinn.nl
topautoinsurers.net
scietech.academy
cuadc.org
baumfinancialservices.com
chomiksy.net
richardmaybury.co.uk
patassociation.com
thenalpa.com
lsngroupe.com
nepal-pictures.com
kartuindonesia.com
berdonllp.com
levelseven.be
nvisionsigns.com
taulunkartano.fi
putzen-reinigen.com
tanatek.com
mercadodelrio.com
iexpert99.com
quitescorting.com
cardsandloyalty.com
muller.nl
martinipstudios.com
webforsites.com
fazagostar.co
astrographic.com
stoneridgemontessori.com
prodentalblue.com
gratiocafeblog.wordpress.com
volta.plus
natturestaurante.com.br
rarefoods.ro
unboxtherapy.site
selected-minds.de
ddmgen.com
turing.academy
lashandbrowenvy.com
hekecrm.com
mariannelemenestrel.com
glennverschueren.be
lisa-poncon.fr
saberconcrete.com
hartofurniture.com
encounter-p.net
scentedlair.com
billscars.net
sber-biznes.com
oscommunity.de
frameshift.it
littlesaints.academy
slotspinner.com
rattanwarehouse.co.uk
bulyginnikitav.000webhostapp.com
cmascd.com
deziplan.ru
specialtyhomeservicesllc.com
jonnyhooley.com
sjtpo.org
business-basic.de
pansionatblago.ru
hm-com.com
tilldeeke.de
activeterroristwarningcompany.com
brisbaneosteopathic.com.au
alaskaremote.com
baikalflot.ru
magrinya.net
brunoimmobilier.com
t3brothers.com
so-sage.fr
speakaudible.com
koncept-m.ru
outstandingminialbums.com
domilivefurniture.com
jobscore.com
liverpoolabudhabi.ae
triplettabordeaux.fr
shrinkingplanet.com
weddingceremonieswithtim.com
keyboardjournal.com
azerbaycanas.com
skinkeeper.li
frimec-international.es
trainiumacademy.com
jmmartinezilustrador.com
xtensifi.com
biodentify.ai
jlgraphisme.fr
xn--80addfr4ahr.dp.ua
digitale-elite.de
speiserei-hannover.de
perfectgrin.com
alene.co
carolynfriedlander.com
bodymindchallenger.com
yuanshenghotel.com
fsbforsale.com
yournextshoes.com
ninjaki.com
oexebusiness.com
switch-made.com
jimprattmediations.com
netadultere.fr
sachainchiuk.com
leatherjees.com
ziliak.com
singletonfinancial.com
gta-jjb.fr
eventosvirtualesexitosos.com
nieuwsindeklas.be
wribrazil.com
motocrosshideout.com
valiant-voice.com
advance-refle.com
galatee-couture.com
cssp-mediation.org
hawthornsretirement.co.uk
vedsegaard.dk
akwaba-safaris.com
awaisghauri.com
worldproskitour.com
trivselsguide.dk
toranjtuition.org
nbva.co.uk
precisetemp.com
hnkns.com
strauchs-wanderlust.info
tzn.nu
renderbox.ch
lagschools.ng
cl0nazepamblog.com
baita.ac
watchsale.biz
dentourage.com
soundseeing.net
peninggibadan.co.id
lesyeuxbleus.net
kryddersnapsen.dk
energosbit-rp.ru
loparnille.se
rhino-turf.com
edvestors.org
dnqa.co.uk
billigeflybilletter.dk
hepishopping.com
kristianboennelykke.dk
basindentistry.com
circlecitydj.com
galaniuklaw.com
opticahubertruiz.com
triplettagaite.fr
redpebblephotography.com
mariamalmahdi.com
spacebel.be
jlwilsonbooks.com
laaisterplakky.nl
forextimes.ru
medicalsupportco.com
modamarfil.com
jollity.hu
afbudsrejserallinclusive.dk
bringmehope.org
racefietsenblog.nl
rubyaudiology.com
espaciopolitica.com
alpesiberie.com
2020hindsight.info
hensleymarketing.com
santastoy.store
alltagsrassismus-entknoten.de
forumsittard.nl
jalkapuu.net
anchelor.com
campinglaforetdetesse.com
bubbalucious.com
bavovrienden.nl
k-v-f.de
n-newmedia.de
nxtstg.org
goddardleadership.org
napisat-pismo-gubernatoru.ru:443
goodboyscustom.com
augen-praxisklinik-rostock.de
geitoniatonaggelon.gr
rapid5kloan.org
wallflowersandrakes.com
clinic-beethovenstrasse-ag.ch
kausette.com
annida.it
alnectus.com
saboboxtel.uk
broccolisoep.nl
wasnederland.nl
liepertgrafikweb.at
livedeveloper.com
brinkdoepke.eu
soncini.ch
pilotgreen.com
suonenjoen.fi
benchbiz.com
funworx.de
azloans.com
ledyoucan.com
optigas.com
mieleshopping.it
nykfdyrehospital.dk
mindfuelers.com
sytzedevries.com
suitesartemis.gr
patriotcleaning.net
limmortelyouth.com
alwaysdc.com
schlagbohrmaschinetests.com
whoopingcrane.com
ruggestar.ch
morgansconsult.com
sveneulberg.de
pixelhealth.net
eksperdanismanlik.com
agora-collectivites.com
signamedia.de
klapanvent.ru
thepixelfairy.com
belofloripa.be
pubcon.com
thestudio.academy
kerstliedjeszingen.nl
wirmuessenreden.com
amorbellezaysalud.com
michaelfiegel.com
mariajosediazdemera.com
skyscanner.ro
hom-frisor.dk
crestgood.com
ilovefullcircle.com
professionetata.com
sellthewrightway.com
zinnystar.com
rsidesigns.com
buffdaddyblog.com
linkbuilding.life
pays-saint-flour.fr
carsten.sparen-it.de
yourcosmicbeing.com
kdbrh.com
directique.com
hostastay.com
grafikstudio-visuell.de
ronielyn.com
futurenetworking.com
promus.ca
breathebettertolivebetter.com
alcye.com
therapybusinessacademy.com
mazift.dk
arearugcleaningnyc.com
omnicademy.com
premiumweb.com.ua:443
reizenmetkinderen.be
pureelements.nl
tothebackofthemoon.com
kellengatton.com
wineandgo.hu
liveyourheartout.co
mjk.digital
mind2muscle.nl
neolaiamedispa.com
springfieldplumbermo.com
jaaphoekzema.nl
kookooo.com
cc-experts.de
veggienessa.com
stralsund-ansichten.de
factorywizuk.com
rossomattonecase.it
magnetvisual.com
piestar.com
janellrardon.com
smarttourism.academy
raeoflightmusic.com
dentalcircle.com
epicjapanart.com
aktivfriskcenter.se
brownswoodblog.com
creohn.de
look.academy
advancedeyecare.com
naukaip.ru
campusce.com
aidanpublishing.co.uk
startuplive.org
wyreforest.net
haard-totaal.nl
limounie.com
blavait.fr
sarahspics.co.uk
yayasanprimaunggul.org
denverwynkoopdentist.com
adterium.com
haus-landliebe.de
mayprogulka.ru
lgiwines.com
leansupremegarcinia.net
kickittickets.com
achetrabalhos.com
smartspeak.com
centuryvisionglobal.com
awag-blog.de
zdrowieszczecin.pl
spirello.nl
maryairbnb.wordpress.com
chris-anne.com
redctei.co
lumturo.academy
diakonie-weitramsdorf-sesslach.de
internalresults.com
colored-shelves.com
ijsselbeton.nl
fann.ru
tellthebell.website
min-virksomhed.dk
testitjavertailut.net
skidpiping.de
relevantonline.eu
ykobbqchicken.ca
vapiano.fr
mamajenedesigns.com
bundan.com
indiebizadvocates.org
amelielecompte.wordpress.com
witraz.pl
nginx.com
ntinasfiloxenia.gr
flossmoordental.com
four-ways.com
gazelle-du-web.com
rizplakatjaya.com
licensed-public-adjuster.com
bd2fly.com
allinonecampaign.com
oro.ae
endstarvation.com
levencovka.ru
christianscholz.de
lookandseen.com
blueridgeheritage.com
alattekniksipil.com
5thactors.com
advanced-removals.co.uk
initconf.com
richardiv.com
pokemonturkiye.com
sealgrinderpt.com
guohedd.com
rozmata.com
bychowo.pl
zealcon.ae
thehovecounsellingpractice.co.uk
projektparkiet.pl
computer-place.de
bonitabeachassociation.com
citydogslife.com
dogsunlimitedguide.com
buerocenter-butzbach-werbemittel.de
5pointpt.com
iactechnologies.net
muni.pe
fire-space.com
alharsunindo.com
birthplacemag.com
vdolg24.online
scotlandsroute66.co.uk
qrs-international.com
agriturismocastagneto.it
satoblog.org
alisodentalcare.com
9nar.com
catering.com
pro-gamer.pl
stathmoulis.gr
aquacheck.co.za
pedmanson.com
bruut.online
trevi-vl.ru
tatyanakopieva.ru
yvesdoin-aquarelles.fr
maxcube24.com.ua
90nguyentuan.com
katherinealy.com
kelsigordon.com
die-immo-agentur.de
buzzneakers.com
awaitspain.com
epsondriversforwindows.com
charlesfrancis.photos
hospitalitytrainingsolutions.co.uk
luvinsburger.fr
innovationgames-brabant.nl
mediabolmong.com
photonag.com
devus.de
charlottelhanna.com
jag.me
penumbuhrambutkeiskei.com
justaroundthecornerpetsit.com
donau-guides.eu
wordpress.idium.no
martha-frets-ceramics.nl
qandmmusiccenter.com
animation-pro.co.uk
larchwoodmarketing.com
istantidigitali.com
itheroes.dk
agencewho-aixenprovence.fr
lattalvor.com
theatre-embellie.fr
kenmccallum.com
production-stills.co.uk
avis.mantova.it
pajagus.fr
bmw-i-pure-impulse.com
terraflair.de
cincinnatiphotocompany.org
yourhappyevents.fr
johnsonweekly.com
simpleitsolutions.ch
forskolinslimeffect.net
efficiencyconsulting.es
landgoedspica.nl
asiaartgallery.jp
acb-gruppe.ch
stabilisateur.fr
corporacionrr.com
bookingwheel.com
leijstrom.com
ocduiblog.com
hoteltantra.com
opt4cdi.com
nicksrock.com
rentingwell.com
successcolony.com.ng
kiraribeaute-nani.com
ingresosextras.online
miscbo.it
legundschiess.de
cascinarosa33.it
innersurrection.com
avisioninthedesert.com
saint-malo-developpement.fr
bluelakevision.com
rentsportsequip.com
zorgboerderijravensbosch.nl
designimage.ae
mslp.org
mgimalta.com
brighthillgroup.com
otpusk.zp.ua
schroederschoembs.com
golfclublandgoednieuwkerk.nl
apiarista.de
log-barn.co.uk
dcc-eu.com
chainofhopeeurope.eu
zwemofficial.nl
mac-computer-support-hamburg.de
1deals.com
invela.dk
sunsolutions.es
arazi.eus
smartercashsystem.com
babysitting-hk.helpergo.co
sshomme.com
paprikapod.com
lmmont.sk
advesa.com
condormobile.fr
olry-cloisons.fr
kosten-vochtbestrijding.be
lapponiasafaris.com
markseymourphotography.co.uk
annenymus.com
wademurray.com
hutchstyle.co.uk
hvitfeldt.dk
victorvictoria.com
the-cupboard.co.uk
dieetuniversiteit.nl
tesisatonarim.com
customroasts.com
latableacrepes-meaux.fr
angeleyezstripclub.com
m2graph.fr
oncarrot.com
cotton-avenue.co.il
alexwenzel.de
eafx.pro
bluemarinefoundation.com
luvbec.com
krishnabrawijaya.com
k-zubki.ru
mangimirossana.it
ebible.co
buonabitare.com
parksideseniorliving.net
xrresources.com
dinedrinkdetroit.com
kamin-somnium.de
sprintcoach.com
bertbutter.nl
lunoluno.com
bohrlochversicherung.info
p-ride.live
ivancacu.com
theintellect.edu.pk
ideamode.com
renehartman.nl
mahikuchen.com
thesilkroadny.com
mbuildinghomes.com
andreaskildegaard.dk
edrickennedymacfoy.com
xn--billigafrgpatroner-stb.se
amyandzac.com
globalskills.pt
auto-opel.ro
jakubrybak.com
sycamoregreenapts.com
skoczynski.eu
ravage-webzine.nl
dibli.store
subyard.com
casinodepositors.com
dennisverschuur.com
cesep2019.com
bayshoreelite.com
hypogenforensic.com
biblica.com
palmenhaus-erfurt.de
hawaiisteelbuilding.com
alabamaroofingllc.com
elliemaccreative.wordpress.com
thisprettyhair.com
bakingismyyoga.com
happycatering.de
angelika-schwarz.com
rename.kz
akcadagofis.com
brannbornfastigheter.se
teamsegeln.ch
noda.com.ua
nevadaruralhousingstudies.org
biketruck.de
egpu.fr
baptistdistinctives.org
humanviruses.org
traitware.com
finsahome.co.uk
gatlinburgcottage.com
lollachiro.com
midwestschool.org
voice2biz.com
dentallabor-luenen.de
b3b.ch
sambaglow.com
lovcase.com
profibersan.com
sharonalbrightdds.com
greenrider.nl
pinthelook.com
delegationhub.com
craftingalegacy.com
the-beauty-guides.com
entdoctor-durban.com
perceptdecor.com
janasfokus.com
sweetz.fr
floweringsun.org
julielusktherapy.com
autoteamlast.de
letterscan.de
molinum.pt
cac2040.com
fluzfluzrewards.com
artvark.nl
bjornvanvulpen.nl
abulanov.com
gardenpartner.pl
bagaholics.in
premier-iowa.com
techybash.com
dierenambulancealkmaar.nl
a-zpaperwork.eu
ced-elec.com
vvego.com
tbalp.co.uk
fidelitytitleoregon.com
matthieupetel.fr
cymru.futbol
druktemakersheerenveen.nl
lovetzuchia.com
ciga-france.fr
mensemetgesigte.co.za
nutriwell.com.sg
mrkluttz.com
malevannye.ru
easydental.ae
parisschool.ru
denhaagfoodie.nl
keuken-prijs.nl
claudiakilian.de
lexced.com
greatofficespaces.net
topvijesti.net
agenceassemble.fr
handyman-silkeborg.dk
stringnosis.academy
airserviceunlimited.com
nauticmarine.dk
dinecorp.com
ufovidmag.com
dreamvoiceclub.org
zumrutkuyutemel.com
dmlcpa.com
solidhosting.nl
albcleaner.fr
iron-mine.ru
salonlamar.nl
breakluckrecords.com
affligemsehondenschool.be
hinotruckwreckers.com.au
uncensoredhentaigif.com
khtrx.com
web865.com
paardcentraal.nl
stitch-n-bitch.com
proffteplo.com
dr-vita.de
enactusnhlstenden.com
sbit.ag
direitapernambuco.com
aceroprime.com
metallbau-hartmann.eu
imagine-entertainment.com
slideevents.be
adabible.org
fascaonline.com
betterce.com
fbmagazine.ru
airvapourbarrier.com
chatterchatterchatter.com
makingmillionaires.net
mediahub.co.nz
chorusconsulting.net
spartamovers.com
pinkxgayvideoawards.com
bourchier.org
the5thquestion.com
dantreranch.com
envomask.com
mrcar.nl
aheadloftladders.co.uk
skolaprome.eu
kvetymichalovce.sk
test-teleachat.fr
masecologicos.com
csaballoons.com
unislaw-narty.pl
aberdeenartwalk.org
tchernia-conseil.fr
rishigangoly.com
acibademmobil.com.tr
explora.nl
triavlete.com
g2mediainc.com
linearete.com
atelierkomon.com
silkeight.com
profiz.com
shortysspices.com
mustangmarketinggroup.com
comoserescritor.com
hostingbangladesh.net
purepreprod4.com
transifer.fr
mondolandscapes.com
zuerich-umzug.ch
metroton.ru
metcalfe.ca
marcandy.com
sppdstats.com
adaduga.info
thegrinningmanmusical.com
randyabrown.com
chatberlin.de
schluesseldienste-hannover.de
11.in.ua
livelai.com
cops4causes.org
gosouldeep.com
jameswilliamspainting.com
davedavisphotos.com
xn--80abehgab4ak0ddz.xn--p1ai
billyoart.com
johnstonmingmanning.com
goodherbalhealth.com
bg.szczecin.pl
pourlabretagne.bzh
hotelturbo.de
laylavalentine.com
welovecustomers.fr
global-migrate.com
elex.is
almamidwifery.com
rs-danmark.dk
metriplica.academy
jobstomoveamerica.org
placermonticello.com
unexplored.gr
mundo-pieces-auto.fr
jax-interim-and-projectmanagement.com
slotenmakerszwijndrecht.nl
glende-pflanzenparadies.de
housesofwa.com
nrgvalue.com
stressreliefadvice.com
girlish.ae
coachpreneuracademy.com
memphishealthandwellness.com
cap29010.it
ygallerysalonsoho.com:443
campusescalade.com
fanuli.com.au
c-sprop.com
theboardroomafrica.com
eyedoctordallas.com
curtsdiscountguns.com
nourella.com
bellesiniacademy.org
photographycreativity.co.uk
bendel-partner.de
queertube.net
lidkopingsnytt.nu
riffenmattgarage.ch
angelsmirrorus.com
bescomedical.de
factoriareloj.com
focuskontur.com
leloupblanc.gr
fysiotherapierijnmond.nl
citiscapes-art.com
banukumbak.com
pazarspor.org.tr
frankgoll.com
eos-horlogerie.com
collegetennis.info
pisofare.co
jobkiwi.com.ng
gaearoyals.com
dayenne-styling.nl
supercarhire.co.uk
rvside.com
ronaldhendriks.nl
gsconcretecoatings.com
oportowebdesign.com
rivermusic.nl
nexstagefinancial.com
palmecophilippines.com
artcase.pl
rino-gmbh.com
universelle.fr
3daywebs.com
rolleepollee.com
axisoflove.org:443
altocontatto.net
subquercy.fr
fi-institutionalfunds.com
margaretmcshane.com
cxcompany.com
blucamp.com
latteswithleslie.com
pvandambv.nl
molade.nl
go.labibini.ch
eshop.design
apogeeconseils.fr
antesacademy.it
groovedealers.ru
goeppinger-teppichreinigung.de
parseport.com
geoweb.software
distrifresh.com
atrgroup.it
xn--ziinoapte-6ld.ro
monstarrsoccer.com
tweedekansenloket.nl
craftstone.co.nz
happylublog.wordpress.com
devplus.be
signededenroth.dk
stagefxinc.com
fotoeditores.com
bajova.sk
hameghlim.com
rhino-storage.co.uk
silverbird.dk
circuit-diagramz.com
stanleyqualitysystems.com
bcabattoirs.org
etgdogz.de
towelroot.co
fta-media.com
smartmind.net
endlessrealms.net
nationnewsroom.com
insane.agency
narca.net
voetbalhoogeveen.nl
fskhjalmar.se
vitormmcosta.com
lyricalduniya.com
carmel-york.com
descargandoprogramas.com
mazzaropi.com.br
mrmac.com
imajyuku-sozoku.com
ceocenters.com
christopherhannan.com
wrinstitute.org
belinda.af
prometeyagro.com.ua
phoenixcrane.com
johnkoen.com
eatyoveges.com
onesynergyinternational.com
publicompserver.de
powershell.su
tradenavigator.ch
drbenveniste.com
marmarabasin.com
scholarquotes.com
onlinemarketingsurgery.co.uk
moira-cristescu.com
anleggsregisteret.no
bodet150ans.com
skooppi.fi
omegamarbella.com
block-optic.com
o90.dk
skyboundnutrition.co.uk
jdscenter.com
karmeliterviertel.com
glas-kuck.de
electricianul.com
grancanariaregional.com
letsstopsmoking.co.uk
tastevirginia.com
palema.gr
bcmets.info
interlinkone.com
manzel.tn
concontactodirecto.com
docarefoundation.org
framemyballs.com
reputation-medical.online
hiddensee-buhne11.de
evsynthacademy.org
wg-heiligenstadt.de
tieronechic.com
paradigmlandscape.com
furland.ru
fla.se
walterman.es
kemtron.fr
oththukaruva.com
tages-geldvergleich.de
auberives-sur-vareze.fr
vipcarrental.ae
elitkeramika-shop.com.ua
bratek-immobilien.de
sochi-okna23.ru
hostaletdelsindians.es
cainlaw-okc.com
enews-qca.com
amco.net.au
ikzoekgod.be
shortsalemap.com
chinowarehousespace.com
parentsandkids.com
datatri.be
agendatwentytwenty.com
animalfood-online.de
hotjapaneselesbian.com
tramadolhealth.com
pharmeko-group.com
tecleados.com
texanscan.org
bumbipdeco.site
from02pro.com
holocine.de
osn.ro
phukienbepthanhdat.com
tutvracks.com
solutionshosting.co.uk
myplaywin3.com
fotoslubna.com
loysonbryan.com
kroophold-sjaelland.dk
irizar.com
stage-infirmier.fr
ikadomus.com
jefersonalessandro.com
atma.nl
schulz-moelln.de
harleystreetspineclinic.com
jandhpest.com
mesajjongeren.nl
drvoip.com
eastgrinsteadwingchun.com
diverfiestas.com.es
spectamarketingdigital.com.br
mindsparkescape.com
der-stempelking.de
ramirezprono.com
aciscomputers.com
apmollerpension.com
fridakids.com
pankiss.ru
111firstdelray.com
peppergreenfarmcatering.com.au
richardkershawwines.co.za
malzomattalar.com
inewsstar.com
vitoriaecoturismo.com.br
thegetawaycollective.com
michal-s.co.il
ncn.nl
qwikcoach.com
louiedager.com
juergenblaetz.de
husetsanitas.dk
werkzeugtrolley.net
teutoradio.de
-
net
true
-
pid
19
-
prc
onenote
ocomm
mydesktopqos
ocautoupds
synctime
dbsnmp
thunderbird
steam
sqlbrowser
sqlwriter
ocssd
oracle
powerpnt
infopath
xfssvccon
firefoxconfig
sqlagent
mysqld
dbeng50
agntsvc
thebat
msaccess
sqbcoreservice
msftesql
tbirdconfig
mysqld_opt
thebat64
wordpad
encsvc
sqlservr
excel
mspub
visio
mysqld_nt
outlook
winword
isqlplussvc
mydesktopservice
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
99
-
svc
memtas
sql
svc$
vss
sophos
veeam
mepocs
backup
Signatures
-
Sodinokibi family
-
Sodinokibi/Revil sample 1 IoCs
Processes:
resource yara_rule sample family_sodinokobi
Files
-
c78bf17e6adb1c671242c0f6d15378d7b54392faffff17599b133ad4c91a3b84.exe windows x86
9014e39262404e977fd8e4e75cce30e6
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
EnterCriticalSection
LeaveCriticalSection
SetErrorMode
GetStdHandle
CreateFileW
WriteFile
OutputDebugStringW
QueryPerformanceCounter
QueryPerformanceFrequency
HeapAlloc
HeapFree
GetProcessHeap
InitializeCriticalSection
DeleteCriticalSection
ExitProcess
GetCurrentThread
GetProcAddress
SetThreadAffinityMask
lstrlenW
LoadLibraryA
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
WriteConsoleW
IsProcessorFeaturePresent
Sections
.text Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 57KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.kmh Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ