Static task
static1
Behavioral task
behavioral1
Sample
c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe
Resource
win10-en-20211208
General
-
Target
c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757
-
Size
158KB
-
MD5
21409a615234a47e7799d1d9a7b3aa56
-
SHA1
cafee6c61566fa05e6f4caf53e8ddbd4d604a7c9
-
SHA256
c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757
-
SHA512
32468ccc092fc9222984c912dc8f0f997d13d0754530ad0b03cefaf76381c3be66cbf1fceb8b8e6f3814b665d9078d5efddc7e9b2e38514bff3d9727d634411d
-
SSDEEP
3072:gnItsOCo4mHLbi4eTMlwDCnutcjKhVhRrv2YRet7k:WIyOCvUbnWJtxhVhRrv25t7k
Malware Config
Extracted
sodinokibi
21
65
lovcase.com
michal-s.co.il
kenmccallum.com
nbva.co.uk
bendel-partner.de
cmeow.com
elliemaccreative.wordpress.com
fridakids.com
ludoil.it
wasnederland.nl
natturestaurante.com.br
plbinsurance.com
advancedeyecare.com
dayenne-styling.nl
sealgrinderpt.com
sweetz.fr
acibademmobil.com.tr
tutvracks.com
schlagbohrmaschinetests.com
stanleyqualitysystems.com
nxtstg.org
pharmeko-group.com
animation-pro.co.uk
hostastay.com
subquercy.fr
katherinealy.com
jonnyhooley.com
tetameble.pl
secrets-clubs.co.uk
hiddensee-buhne11.de
quitescorting.com
watchsale.biz
fbmagazine.ru
eurethicsport.eu
from02pro.com
reizenmetkinderen.be
etgdogz.de
iactechnologies.net
catalyseurdetransformation.com
boloria.de
mariajosediazdemera.com
jlwilsonbooks.com
texanscan.org
bakingismyyoga.com
mercadodelrio.com
zealcon.ae
mediogiro.com.ar
naukaip.ru
transifer.fr
bohrlochversicherung.info
bellesiniacademy.org
omnicademy.com
stathmoulis.gr
netadultere.fr
pankiss.ru
rhino-turf.com
aheadloftladders.co.uk
bertbutter.nl
amco.net.au
johnstonmingmanning.com
bruut.online
makingmillionaires.net
sppdstats.com
pubcon.com
pajagus.fr
riffenmattgarage.ch
masecologicos.com
olry-cloisons.fr
atelierkomon.com
fazagostar.co
selected-minds.de
limmortelyouth.com
atrgroup.it
palmenhaus-erfurt.de
cssp-mediation.org
spirello.nl
napisat-pismo-gubernatoru.ru:443
parseport.com
baptistdistinctives.org
wyreforest.net
hutchstyle.co.uk
littlesaints.academy
advance-refle.com
irizar.com
the-beauty-guides.com
benchbiz.com
energosbit-rp.ru
stressreliefadvice.com
mariannelemenestrel.com
charlesfrancis.photos
adaduga.info
veggienessa.com
maryairbnb.wordpress.com
markseymourphotography.co.uk
girlish.ae
kausette.com
margaretmcshane.com
skoczynski.eu
mundo-pieces-auto.fr
o2o-academy.com
unislaw-narty.pl
newonestop.com
espaciopolitica.com
afbudsrejserallinclusive.dk
ocduiblog.com
baita.ac
citiscapes-art.com
focuskontur.com
insane.agency
bcmets.info
nepressurecleaning.com
kookooo.com
santastoy.store
teethinadaydentalimplants.com
deduktia.fi
smartworkplaza.com
bodet150ans.com
drnelsonpediatrics.com
production-stills.co.uk
paradigmlandscape.com
primemarineengineering.com
oscommunity.de
circuit-diagramz.com
neonodi.be
worldproskitour.com
trainiumacademy.com
sololibrerie.it
pisofare.co
welovecustomers.fr
greenrider.nl
belinda.af
eastgrinsteadwingchun.com
johnsonweekly.com
bychowo.pl
campusescalade.com
georgemuncey.com
amorbellezaysalud.com
galatee-couture.com
kuriero.pro
theatre-embellie.fr
bd2fly.com
customroasts.com
myfbateam.com
neolaiamedispa.com
dogsunlimitedguide.com
ebible.co
anchelor.com
tages-geldvergleich.de
lesyeuxbleus.net
zorgboerderijravensbosch.nl
slotenmakerszwijndrecht.nl
9nar.com
rivermusic.nl
holocine.de
fanuli.com.au
satoblog.org
vitormmcosta.com
mslp.org
omegamarbella.com
amyandzac.com
curtsdiscountguns.com
kelsigordon.com
cotton-avenue.co.il
endlessrealms.net
hospitalitytrainingsolutions.co.uk
gavelmasters.com
111firstdelray.com
airserviceunlimited.com
mensemetgesigte.co.za
apiarista.de
profiz.com
johnkoen.com
wg-heiligenstadt.de
innovationgames-brabant.nl
xtensifi.com
patriotcleaning.net
arthakapitalforvaltning.dk
ygallerysalonsoho.com:443
belofloripa.be
nuohous.com
dr-vita.de
cleanroomequipment.ie
mamajenedesigns.com
rhino-storage.co.uk
docarefoundation.org
alaskaremote.com
gta-jjb.fr
galaniuklaw.com
imaginekithomes.co.nz
cincinnatiphotocompany.org
factorywizuk.com
blavait.fr
inewsstar.com
itheroes.dk
frankgoll.com
nvisionsigns.com
cascinarosa33.it
hekecrm.com
rattanwarehouse.co.uk
leadforensics.com
bg.szczecin.pl
thehovecounsellingpractice.co.uk
loparnille.se
lumturo.academy
strauchs-wanderlust.info
catchup-mag.com
sjtpo.org
smarttourism.academy
forextimes.ru
grafikstudio-visuell.de
dmlcpa.com
haus-landliebe.de
raeoflightmusic.com
nepal-pictures.com
laaisterplakky.nl
fann.ru
jmmartinezilustrador.com
muni.pe
mesajjongeren.nl
distrifresh.com
pilotgreen.com
jameswilliamspainting.com
prodentalblue.com
triplettagaite.fr
alltagsrassismus-entknoten.de
rtc24.com
ykobbqchicken.ca
bayshoreelite.com
vdolg24.online
cmascd.com
corporacionrr.com
citydogslife.com
goeppinger-teppichreinigung.de
craftstone.co.nz
imagine-entertainment.com
perceptdecor.com
collegetennis.info
ikadomus.com
midwestschool.org
utilisacteur.fr
zdrowieszczecin.pl
humanviruses.org
sharonalbrightdds.com
verbouwingsdouche.nl
soundseeing.net
jimprattmediations.com
protoplay.ca
skyboundnutrition.co.uk
pro-gamer.pl
site.markkit.com.br
acumenconsultingcompany.com
hinotruckwreckers.com.au
shortsalemap.com
acb-gruppe.ch
levencovka.ru
medicalsupportco.com
richardmaybury.co.uk
smartmind.net
memphishealthandwellness.com
four-ways.com
signededenroth.dk
magrinya.net
the3-week-diet.net
iron-mine.ru
chris-anne.com
beandrivingschool.com.au
bilius.dk
baikalflot.ru
taulunkartano.fi
chomiksy.net
reputation-medical.online
letsstopsmoking.co.uk
livelai.com
tchernia-conseil.fr
tramadolhealth.com
ivancacu.com
operativadigital.com
harleystreetspineclinic.com
mike.matthies.de
putzen-reinigen.com
towelroot.co
achetrabalhos.com
albcleaner.fr
log-barn.co.uk
brunoimmobilier.com
penumbuhrambutkeiskei.com
entdoctor-durban.com
angeleyezstripclub.com
banksrl.co.za
rubyaudiology.com
lovetzuchia.com
biodentify.ai
efficiencyconsulting.es
craftron.com
toranjtuition.org
renehartman.nl
orchardbrickwork.com
mariamalmahdi.com
hameghlim.com
redctei.co
ijsselbeton.nl
ravage-webzine.nl
ronielyn.com
grancanariaregional.com
mediabolmong.com
fitnessblenderstory.com
jlgraphisme.fr
cainlaw-okc.com
lagschools.ng
geitoniatonaggelon.gr
tesisatonarim.com
oththukaruva.com
druktemakersheerenveen.nl
diverfiestas.com.es
thesilkroadny.com
narca.net
thegrinningmanmusical.com
yuanshenghotel.com
denhaagfoodie.nl
avtoboss163.ru:443
amelielecompte.wordpress.com
daveystownhouse.com
frimec-international.es
kdbrh.com
leansupremegarcinia.net
skinkeeper.li
kryddersnapsen.dk
scentedlair.com
mediahub.co.nz
cormanmarketing.com
11.in.ua
artvark.nl
hom-frisor.dk
outstandingminialbums.com
jobkiwi.com.ng
klapanvent.ru
augen-praxisklinik-rostock.de
drvoip.com
funworx.de
agriturismocastagneto.it
gardenpartner.pl
wademurray.com
allinonecampaign.com
schroederschoembs.com
clemenfoto.dk
mind2muscle.nl
bodymindchallenger.com
sveneulberg.de
advanced-removals.co.uk
justaroundthecornerpetsit.com
mazzaropi.com.br
bulyginnikitav.000webhostapp.com
specialtyhomeservicesllc.com
broccolisoep.nl
eos-horlogerie.com
promus.ca
m2graph.fr
jglconsultancy.com
licensed-public-adjuster.com
bookingwheel.com
mondolandscapes.com
photonag.com
gurutechnologies.net
fidelitytitleoregon.com
ilveshistoria.com
o90.dk
osn.ro
relevantonline.eu
sbit.ag
molade.nl
tellthebell.website
aberdeenartwalk.org
datatri.be
triavlete.com
letterscan.de
malevannye.ru
awag-blog.de
heuvelland-oaze.nl
thiagoperez.com
auberives-sur-vareze.fr
elex.is
cardsandloyalty.com
avis.mantova.it
lattalvor.com
patassociation.com
aoyama.ac
basindentistry.com
dentourage.com
radishallgood.com
sunsolutions.es
condormobile.fr
encounter-p.net
andreaskildegaard.dk
julielusktherapy.com
metriplica.academy
nykfdyrehospital.dk
tradenavigator.ch
rolleepollee.com
webforsites.com
p-ride.live
fotoslubna.com
mneti.ru
stoneridgemontessori.com
alharsunindo.com
directique.com
stagefxinc.com
lashandbrowenvy.com
alnectus.com
innersurrection.com
angelsmirrorus.com
eatyoveges.com
bcabattoirs.org
blucamp.com
biblica.com
chatterchatterchatter.com
salonlamar.nl
pxsrl.it
aceroprime.com
xn--ziinoapte-6ld.ro
monstarrsoccer.com
randyabrown.com
comoserescritor.com
babysitting-hk.helpergo.co
jax-interim-and-projectmanagement.com
janasfokus.com
hartofurniture.com
crestgood.com
vitoriaecoturismo.com.br
keuken-prijs.nl
azerbaycanas.com
factoriareloj.com
business-basic.de
solutionshosting.co.uk
suitesartemis.gr
mieleshopping.it
eafx.pro
krishnabrawijaya.com
kosten-vochtbestrijding.be
onlinetvgroup.com
voetbalhoogeveen.nl
nginx.com
hm-com.com
envomask.com
brisbaneosteopathic.com.au
agendatwentytwenty.com
heimdalbygg.no
levelseven.be
frameshift.it
pazarspor.org.tr
sambaglow.com
optigas.com
cesep2019.com
triplettabordeaux.fr
oro.ae
craftingalegacy.com
1deals.com
hotjapaneselesbian.com
bluetenreich-brilon.de
alene.co
simpleitsolutions.ch
bratek-immobilien.de
guohedd.com
parentsandkids.com
kristianboennelykke.dk
ox-home.com
proffteplo.com
stabilisateur.fr
kompresory-opravy.com
rename.kz
lapponiasafaris.com
carolynfriedlander.com
explora.nl
opt4cdi.com
schluesseldienste-hannover.de
walterman.es
christopherhannan.com
leijstrom.com
5pointpt.com
vvego.com
testitjavertailut.net
campusce.com
fluzfluzrewards.com
auto-opel.ro
axisoflove.org:443
adabible.org
internalresults.com
avisioninthedesert.com
antesacademy.it
pokemonturkiye.com
kroophold-sjaelland.dk
kryptos72.com
premiumweb.com.ua:443
limounie.com
zwemofficial.nl
chorusconsulting.net
futurenetworking.com
professionetata.com
matthieupetel.fr
sber-biznes.com
enactusnhlstenden.com
k-zubki.ru
eyedoctordallas.com
marcandy.com
poems-for-the-soul.ch
greeneyetattoo.com
ddmgen.com
min-virksomhed.dk
slotspinner.com
peppergreenfarmcatering.com.au
awaisghauri.com
sytzedevries.com
successcolony.com.ng
block-optic.com
finnergo.eu
furland.ru
ronaldhendriks.nl
mgimalta.com
traitware.com
jobstomoveamerica.org
advesa.com
ideamode.com
lgiwines.com
direitapernambuco.com
christianscholz.de
activeterroristwarningcompany.com
moira-cristescu.com
onesynergyinternational.com
ikzoekgod.be
kickittickets.com
gratiocafeblog.wordpress.com
pays-saint-flour.fr
trivselsguide.dk
queertube.net
hepishopping.com
arabianmice.com
bumbipdeco.site
saboboxtel.uk
ziliak.com
chinowarehousespace.com
flossmoordental.com
whoopingcrane.com
luvbec.com
ramirezprono.com
davedavisphotos.com
bringmehope.org
boyfriendsgoal.site
morgansconsult.com
leloupblanc.gr
shortysspices.com
jefersonalessandro.com
jeanmonti.com
akcadagofis.com
luvinsburger.fr
gosouldeep.com
cc-experts.de
ruggestar.ch
mursall.de
mayprogulka.ru
devus.de
ncjc.ca
dennisverschuur.com
bjornvanvulpen.nl
bluemarinefoundation.com
innervisions-id.com
tastevirginia.com
wirmuessenreden.com
metroton.ru
biketruck.de
xn--billigafrgpatroner-stb.se
iexpert99.com
universelle.fr
descargandoprogramas.com
housesofwa.com
initconf.com
opticahubertruiz.com
kemtron.fr
centuryvisionglobal.com
line-x.co.uk
askstaffing.com
tbalp.co.uk
eshop.design
beauty-traveller.com
ingresosextras.online
foerderverein-vatterschule.de
metcalfe.ca
test-teleachat.fr
lisa-poncon.fr
endstarvation.com
rishigangoly.com
zuerich-umzug.ch
lmmont.sk
cxcompany.com
circlecitydj.com
theater-lueneburg.de
go.labibini.ch
paprikapod.com
alisodentalcare.com
grupoexin10.com
ketomealprep.academy
carsten.sparen-it.de
drbenveniste.com
mac-computer-support-hamburg.de
scotlandsroute66.co.uk
mollymccarthydesign.com
interlinkone.com
tzn.nu
lookandseen.com
autoteamlast.de
skidpiping.de
mangimirossana.it
mjk.digital
epsondriversforwindows.com
campinglaforetdetesse.com
lunoluno.com
epicjapanart.com
ilovefullcircle.com
arearugcleaningnyc.com
b3b.ch
affligemsehondenschool.be
karmeliterviertel.com
bluelakevision.com
tecleados.com
acornishstudio.co.uk
precisetemp.com
motocrossplace.co.uk
startuplive.org
finsahome.co.uk
n-newmedia.de
istantidigitali.com
fascaonline.com
alcye.com
husetsanitas.dk
powershell.su
muller.nl
purepreprod4.com
martinipstudios.com
domaine-des-pothiers.com
kerstliedjeszingen.nl
zaczytana.com
rentsportsequip.com
tilldeeke.de
singletonfinancial.com
deziplan.ru
leatherjees.com
dreamvoiceclub.org
ciga-france.fr
smartercashsystem.com
breakluckrecords.com
glende-pflanzenparadies.de
denverwynkoopdentist.com
rokthetalk.com
dentallabor-luenen.de
annida.it
jdscenter.com
die-immo-agentur.de
glennverschueren.be
ntinasfiloxenia.gr
landgoedspica.nl
rechtenplicht.be
latableacrepes-meaux.fr
thegetawaycollective.com
wallflowersandrakes.com
manzel.tn
sachainchiuk.com
blueridgeheritage.com
supercarhire.co.uk
mahikuchen.com
fire-space.com
expohomes.com
vipcarrental.ae
der-stempelking.de
csaballoons.com
rarefoods.ro
apogeeconseils.fr
motocrosshideout.com
cops4causes.org
eksperdanismanlik.com
mrmac.com
parisschool.ru
skooppi.fi
teamsegeln.ch
hawthornsretirement.co.uk
brinkdoepke.eu
schulz-moelln.de
sycamoregreenapts.com
ledyoucan.com
cymru.futbol
carmel-york.com
clinic-beethovenstrasse-ag.ch
birthplacemag.com
devplus.be
golfclublandgoednieuwkerk.nl
floweringsun.org
khtrx.com
skyscanner.ro
bavovrienden.nl
t3brothers.com
oportowebdesign.com
annenymus.com
arazi.eus
bonitabeachassociation.com
invela.dk
projektparkiet.pl
creohn.de
chatberlin.de
atma.nl
turing.academy
catering.com
fysiotherapierijnmond.nl
donau-guides.eu
so-sage.fr
jobscore.com
premier-iowa.com
jayfurnitureco.com
evsynthacademy.org
miscbo.it
spacebel.be
pourlabretagne.bzh
buffdaddyblog.com
kombi-dress.com
xrresources.com
xn--80abehgab4ak0ddz.xn--p1ai
yayasanprimaunggul.org
dinedrinkdetroit.com
marmarabasin.com
rvside.com
maxcube24.com.ua
the5thquestion.com
stralsund-ansichten.de
aktivfriskcenter.se
framemyballs.com
uci-france.fr
drbrianhweeks.com
mikegoodfellow.co.uk
kafkacare.com
g2mediainc.com
agencewho-aixenprovence.fr
keyboardjournal.com
dcc-eu.com
aquacheck.co.za
michaelfiegel.com
almamidwifery.com
thisprettyhair.com
cl0nazepamblog.com
lexced.com
skolaprome.eu
physio-lang.de
oexebusiness.com
greatofficespaces.net
sshomme.com
weddingceremonieswithtim.com
oraweb.net
wordpress.idium.no
metallbau-hartmann.eu
bajova.sk
liveyourheartout.co
terraflair.de
kvetymichalovce.sk
wrinstitute.org
tieronechic.com
rozmata.com
angelika-schwarz.com
janellrardon.com
global-migrate.com
saberconcrete.com
uncensoredhentaigif.com
ceocenters.com
rentingwell.com
renderbox.ch
rsidesigns.com
louiedager.com
egpu.fr
berdonllp.com
janmorgenstern.com
polynine.com
tweedekansenloket.nl
alattekniksipil.com
azloans.com
coachpreneuracademy.com
goodboyscustom.com
kellengatton.com
geoweb.software
scietech.academy
tatyanakopieva.ru
thenalpa.com
rapid5kloan.org
indiebizadvocates.org
enews-qca.com
techybash.com
mindfuelers.com
dierenambulancealkmaar.nl
laylavalentine.com
trevi-vl.ru
switch-made.com
electricianul.com
agrifarm.dk
hnkns.com
volta.plus
nationnewsroom.com
fta-media.com
nrgvalue.com
animalfood-online.de
yvesdoin-aquarelles.fr
yourcosmicbeing.com
k-v-f.de
theintellect.edu.pk
witraz.pl
gsconcretecoatings.com
kamin-somnium.de
malzomattalar.com
apmollerpension.com
perfectgrin.com
modamarfil.com
vapiano.fr
stitch-n-bitch.com
buzzneakers.com
ufovidmag.com
mbuildinghomes.com
qwikcoach.com
phoenixcrane.com
therapybusinessacademy.com
hensleymarketing.com
akwaba-safaris.com
hypogenforensic.com
pansionatblago.ru
adterium.com
alexwenzel.de
nicksrock.com
racefietsenblog.nl
leopoldineroux.com
elitkeramika-shop.com.ua
sochi-okna23.ru
chainofhopeeurope.eu
abulanov.com
unexplored.gr
fskhjalmar.se
dentalcircle.com
signamedia.de
hvitfeldt.dk
happylublog.wordpress.com
silkeight.com
airvapourbarrier.com
haard-totaal.nl
soncini.ch
internestdigital.com
wribrazil.com
2020hindsight.info
palema.gr
bescomedical.de
agora-collectivites.com
web865.com
dieetuniversiteit.nl
baumfinancialservices.com
qandmmusiccenter.com
otpusk.zp.ua
silverbird.dk
hotelturbo.de
scholarquotes.com
bridalcave.com
liepertgrafikweb.at
dinecorp.com
fixx-repair.com
lollachiro.com
anleggsregisteret.no
kartuindonesia.com
rizplakatjaya.com
90nguyentuan.com
betterce.com
goddardleadership.org
ninjaki.com
wineandgo.hu
bmw-i-pure-impulse.com
happycatering.de
onlinemarketingsurgery.co.uk
linearete.com
linkbuilding.life
forskolinslimeffect.net
theboardroomafrica.com
molinum.pt
burg-zelem.de
the-cupboard.co.uk
spartamovers.com
mazift.dk
mindsparkescape.com
adedesign.com
hostingbangladesh.net
parksideseniorliving.net
jakubrybak.com
edrickennedymacfoy.com
banukumbak.com
pixelhealth.net
5thactors.com
sarahspics.co.uk
fotoeditores.com
profibersan.com
globalcompliancenews.com
karelinjames.com
look.academy
asiaartgallery.jp
voice2biz.com
unboxtherapy.site
jalkapuu.net
valiant-voice.com
zinnystar.com
spectamarketingdigital.com.br
speakaudible.com
ya-elka.ru
forumsittard.nl
imajyuku-sozoku.com
jaaphoekzema.nl
rino-gmbh.com
vedsegaard.dk
gaearoyals.com
xn--80addfr4ahr.dp.ua
breathebettertolivebetter.com
publicompserver.de
lifeinbreaths.com
cac2040.com
alwaysdc.com
artcase.pl
saint-malo-developpement.fr
nexstagefinancial.com
reygroup.pt
ncn.nl
bagaholics.in
sellthewrightway.com
logosindustries.com
werkzeugtrolley.net
livedeveloper.com
awaitspain.com
tothebackofthemoon.com
fsbforsale.com
matteoruzzaofficial.com
pvandambv.nl
dibli.store
speiserei-hannover.de
zumrutkuyutemel.com
nourella.com
diakonie-weitramsdorf-sesslach.de
yourhappyevents.fr
nieuwsindeklas.be
yournextshoes.com
cap29010.it
ayudaespiritualtamara.com
3daywebs.com
kiraribeaute-nani.com
delegationhub.com
edvestors.org
studionumerik.fr
magnetvisual.com
buerocenter-butzbach-werbemittel.de
peninggibadan.co.id
gbk-tp1.de
myplaywin3.com
nutriwell.com.sg
pureelements.nl
suonenjoen.fi
aciscomputers.com
liverpoolabudhabi.ae
alabamaroofingllc.com
claudiakilian.de
agenceassemble.fr
koncept-m.ru
lsngroupe.com
thestudio.academy
rossomattonecase.it
gazelle-du-web.com
aidanpublishing.co.uk
redpebblephotography.com
mrcar.nl
photographycreativity.co.uk
springfieldplumbermo.com
larchwoodmarketing.com
bundan.com
nevadaruralhousingstudies.org
stringnosis.academy
pinkxgayvideoawards.com
aslog.fr
easydental.ae
buonabitare.com
barbaramcfadyenjewelry.com
andermattswisswatches.ch
altocontatto.net
richardkershawwines.co.za
handyman-silkeborg.dk
billscars.net
altitudeboise.com
c-sprop.com
palmecophilippines.com
topvijesti.net
bubbalucious.com
bourchier.org
ultimatelifesource.com
colored-shelves.com
hostaletdelsindians.es
ahgarage.com
nalliasmali.net
jacquesgarcianoto.com
jandhpest.com
nauticmarine.dk
cyberpromote.de
subyard.com
teutoradio.de
casinodepositors.com
graygreenbiomedservices.com
andrealuchesi.it
cookinn.nl
legundschiess.de
brownswoodblog.com
mustangmarketinggroup.com
stage-infirmier.fr
digitale-elite.de
eventosvirtualesexitosos.com
lyricalduniya.com
hawaiisteelbuilding.com
lidkopingsnytt.nu
jag.me
dnqa.co.uk
qrs-international.com
tanatek.com
duthler.nl
piestar.com
fla.se
richardiv.com
dantreranch.com
boomerslivinglively.com
jollity.hu
domilivefurniture.com
globalskills.pt
groovedealers.ru
computer-place.de
concontactodirecto.com
designimage.ae
noda.com.ua
cp-bap.de
thepixelfairy.com
sprintcoach.com
ced-elec.com
mrkluttz.com
a-zpaperwork.eu
slideevents.be
charlottelhanna.com
smartspeak.com
alpesiberie.com
brannbornfastigheter.se
juergenblaetz.de
topautoinsurers.net
rs-danmark.dk
pedmanson.com
shrinkingplanet.com
astrographic.com
phukienbepthanhdat.com
pinthelook.com
billigeflybilletter.dk
ownidentity.com
prometeyagro.com.ua
billyoart.com
gatlinburgcottage.com
paardcentraal.nl
brighthillgroup.com
cuadc.org
placermonticello.com
solidhosting.nl
oncarrot.com
hoteltantra.com
martha-frets-ceramics.nl
glas-kuck.de
goodherbalhealth.com
lassocrm.com
victorvictoria.com
fi-institutionalfunds.com
loysonbryan.com
latteswithleslie.com
-
net
true
-
pid
21
-
prc
distrib.exe
onenote.exe
visio.exe
sqlbrowser.exe
firefoxconfig.exe
xfssvccon.exe
agntsvc.exe
wordpad.exe
dbeng50.exe
ocautoupds.exe
sqlwriter.exe
ocssd.exe
sqlagent.exe
mydesktopservice.exe
thebat64.exe
encsvc.exe
excel.exe
oracle.exe
msftesql.exe
msaccess.exe
powerpnt.exe
mspub.exe
msmdsrv.exe
logread.exe
mysqld_opt.exe
tbirdconfig.exe
isqlplussvc.exe
msdtssrvr.exe
infopath.exe
steam.exe
outlook.exe
synctime.exe
mysqld.exe
sqbcoreservice.exe
thunderbird.exe
winword.exe
sqlceip.exe
ocomm.exe
mysqld_nt.exe
sqlservr.exe
mydesktopqos.exe
thebat.exe
dbsnmp.exe
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
65
Signatures
-
Sodinokibi family
-
Sodinokibi/Revil sample 1 IoCs
Processes:
resource yara_rule sample family_sodinokobi
Files
-
c407c0db2f79f607dfdc5eb2f4f222491f96ea3540d8689c8ed6fba89a240757.exe windows x86
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 62KB - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.eiv Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ