General
-
Target
ba9592242e0e033b3c75bf06406b9ad8510123e950a139ac363de1812631cfe3
-
Size
204KB
-
Sample
220124-bkxzrshcel
-
MD5
91443fabe2b4bb7764ec65b07abb5de6
-
SHA1
7fecfae5088225aadd5a7c8bbdbb229410d20a6c
-
SHA256
ba9592242e0e033b3c75bf06406b9ad8510123e950a139ac363de1812631cfe3
-
SHA512
630775064e3865ddf50835f818dbfc45b900042674f4fdbe37fff7ac2fe46e92d59fef20cfeffa3916b919fe19a89b2317ed575636ef973bdb662dc7daa149d1
Static task
static1
Behavioral task
behavioral1
Sample
ba9592242e0e033b3c75bf06406b9ad8510123e950a139ac363de1812631cfe3.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
ba9592242e0e033b3c75bf06406b9ad8510123e950a139ac363de1812631cfe3.exe
Resource
win10-en-20211208
Malware Config
Extracted
C:\c2ob0r4j2d-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/050D90DFE5A0A4CD
http://decryptor.top/050D90DFE5A0A4CD
Extracted
sodinokibi
19
36
bcabattoirs.org
baita.ac
prometeyagro.com.ua
nepal-pictures.com
juergenblaetz.de
3daywebs.com
penumbuhrambutkeiskei.com
primemarineengineering.com
slideevents.be
holocine.de
circlecitydj.com
basindentistry.com
kemtron.fr
deziplan.ru
diverfiestas.com.es
craftron.com
mariannelemenestrel.com
ufovidmag.com
eafx.pro
humanviruses.org
gaearoyals.com
arazi.eus
leansupremegarcinia.net
tastevirginia.com
achetrabalhos.com
ceocenters.com
drvoip.com
fanuli.com.au
sololibrerie.it
oththukaruva.com
oncarrot.com
buerocenter-butzbach-werbemittel.de
reizenmetkinderen.be
atelierkomon.com
motocrosshideout.com
b3b.ch
ilveshistoria.com
tesisatonarim.com
teamsegeln.ch
ketomealprep.academy
jeanmonti.com
line-x.co.uk
onesynergyinternational.com
cp-bap.de
edrickennedymacfoy.com
unislaw-narty.pl
kiraribeaute-nani.com
chinowarehousespace.com
bellesiniacademy.org
ayudaespiritualtamara.com
alattekniksipil.com
billyoart.com
parentsandkids.com
coachpreneuracademy.com
oraweb.net
pinthelook.com
cssp-mediation.org
jandhpest.com
alene.co
leijstrom.com
framemyballs.com
xn--ziinoapte-6ld.ro
aheadloftladders.co.uk
profibersan.com
khtrx.com
goddardleadership.org
worldproskitour.com
mondolandscapes.com
sunsolutions.es
rvside.com
nourella.com
blucamp.com
malzomattalar.com
matteoruzzaofficial.com
lgiwines.com
cl0nazepamblog.com
augen-praxisklinik-rostock.de
sweetz.fr
linkbuilding.life
sppdstats.com
rubyaudiology.com
transifer.fr
silverbird.dk
stanleyqualitysystems.com
lsngroupe.com
lifeinbreaths.com
delegationhub.com
buzzneakers.com
queertube.net
m2graph.fr
neolaiamedispa.com
glas-kuck.de
qrs-international.com
rozmata.com
metriplica.academy
smartercashsystem.com
golfclublandgoednieuwkerk.nl
ox-home.com
denverwynkoopdentist.com
chorusconsulting.net
jlgraphisme.fr
aquacheck.co.za
pedmanson.com
projektparkiet.pl
weddingceremonieswithtim.com
leatherjees.com
triplettabordeaux.fr
kookooo.com
maxcube24.com.ua
fskhjalmar.se
nginx.com
boyfriendsgoal.site
alharsunindo.com
saboboxtel.uk
nalliasmali.net
agencewho-aixenprovence.fr
fla.se
jonnyhooley.com
toranjtuition.org
globalcompliancenews.com
clinic-beethovenstrasse-ag.ch
lookandseen.com
pixelhealth.net
four-ways.com
easydental.ae
hnkns.com
rechtenplicht.be
dieetuniversiteit.nl
zorgboerderijravensbosch.nl
inewsstar.com
renderbox.ch
rentsportsequip.com
parisschool.ru
universelle.fr
pinkxgayvideoawards.com
finsahome.co.uk
cyberpromote.de
teethinadaydentalimplants.com
rino-gmbh.com
hutchstyle.co.uk
mamajenedesigns.com
solidhosting.nl
loysonbryan.com
biketruck.de
adterium.com
pansionatblago.ru
margaretmcshane.com
rattanwarehouse.co.uk
eventosvirtualesexitosos.com
atrgroup.it
chatterchatterchatter.com
happycatering.de
limounie.com
palema.gr
testitjavertailut.net
bajova.sk
dayenne-styling.nl
ikadomus.com
hospitalitytrainingsolutions.co.uk
tbalp.co.uk
marmarabasin.com
nykfdyrehospital.dk
onlinetvgroup.com
azloans.com
chris-anne.com
anleggsregisteret.no
cxcompany.com
carolynfriedlander.com
martha-frets-ceramics.nl
baikalflot.ru
digitale-elite.de
sbit.ag
barbaramcfadyenjewelry.com
webforsites.com
mrmac.com
angelika-schwarz.com
animalfood-online.de
mediahub.co.nz
mieleshopping.it
charlottelhanna.com
zdrowieszczecin.pl
efficiencyconsulting.es
cmeow.com
test-teleachat.fr
mslp.org
successcolony.com.ng
levelseven.be
putzen-reinigen.com
profiz.com
handyman-silkeborg.dk
clemenfoto.dk
suitesartemis.gr
corporacionrr.com
cincinnatiphotocompany.org
morgansconsult.com
placermonticello.com
thestudio.academy
jefersonalessandro.com
angelsmirrorus.com
magrinya.net
stringnosis.academy
zumrutkuyutemel.com
dentallabor-luenen.de
lassocrm.com
awag-blog.de
sealgrinderpt.com
xn--billigafrgpatroner-stb.se
111firstdelray.com
kickittickets.com
fitnessblenderstory.com
eshop.design
hm-com.com
ronaldhendriks.nl
skidpiping.de
istantidigitali.com
rokthetalk.com
tatyanakopieva.ru
midwestschool.org
osn.ro
hartofurniture.com
molade.nl
lashandbrowenvy.com
furland.ru
kristianboennelykke.dk
oportowebdesign.com
globalskills.pt
triplettagaite.fr
brinkdoepke.eu
laylavalentine.com
irizar.com
oro.ae
gurutechnologies.net
lesyeuxbleus.net
stathmoulis.gr
diakonie-weitramsdorf-sesslach.de
haard-totaal.nl
narca.net
mediabolmong.com
proffteplo.com
subyard.com
neonodi.be
utilisacteur.fr
docarefoundation.org
zwemofficial.nl
mgimalta.com
bavovrienden.nl
soncini.ch
cap29010.it
mensemetgesigte.co.za
advancedeyecare.com
aslog.fr
nrgvalue.com
julielusktherapy.com
sharonalbrightdds.com
vedsegaard.dk
directique.com
altitudeboise.com
enews-qca.com
artcase.pl
vapiano.fr
burg-zelem.de
angeleyezstripclub.com
lollachiro.com
tradenavigator.ch
mrcar.nl
ruggestar.ch
grupoexin10.com
landgoedspica.nl
innersurrection.com
wg-heiligenstadt.de
from02pro.com
verbouwingsdouche.nl
hostingbangladesh.net
craftstone.co.nz
leadforensics.com
aciscomputers.com
belinda.af
pureelements.nl
husetsanitas.dk
topautoinsurers.net
ijsselbeton.nl
kellengatton.com
limmortelyouth.com
internalresults.com
1deals.com
explora.nl
harleystreetspineclinic.com
ya-elka.ru
moira-cristescu.com
advance-refle.com
foerderverein-vatterschule.de
web865.com
jollity.hu
mneti.ru
abulanov.com
fridakids.com
ilovefullcircle.com
acumenconsultingcompany.com
riffenmattgarage.ch
gratiocafeblog.wordpress.com
noda.com.ua
asiaartgallery.jp
die-immo-agentur.de
levencovka.ru
adaduga.info
vipcarrental.ae
pharmeko-group.com
envomask.com
alltagsrassismus-entknoten.de
liverpoolabudhabi.ae
egpu.fr
min-virksomhed.dk
drnelsonpediatrics.com
scietech.academy
albcleaner.fr
ebible.co
ronielyn.com
drbenveniste.com
otpusk.zp.ua
pro-gamer.pl
perceptdecor.com
electricianul.com
hoteltantra.com
victorvictoria.com
craftingalegacy.com
jglconsultancy.com
parseport.com
avis.mantova.it
heimdalbygg.no
leloupblanc.gr
direitapernambuco.com
yourhappyevents.fr
devus.de
hostastay.com
bd2fly.com
glennverschueren.be
marcandy.com
bruut.online
buffdaddyblog.com
hawaiisteelbuilding.com
agendatwentytwenty.com
silkeight.com
the-beauty-guides.com
nicksrock.com
johnkoen.com
rs-danmark.dk
sytzedevries.com
apogeeconseils.fr
paardcentraal.nl
mariajosediazdemera.com
hameghlim.com
keyboardjournal.com
thenalpa.com
cotton-avenue.co.il
hvitfeldt.dk
opticahubertruiz.com
zaczytana.com
arthakapitalforvaltning.dk
mercadodelrio.com
ncn.nl
dentourage.com
thiagoperez.com
unexplored.gr
livedeveloper.com
patassociation.com
hom-frisor.dk
hostaletdelsindians.es
elliemaccreative.wordpress.com
mike.matthies.de
baptistdistinctives.org
amelielecompte.wordpress.com
omnicademy.com
block-optic.com
advesa.com
metallbau-hartmann.eu
alabamaroofingllc.com
startuplive.org
singletonfinancial.com
floweringsun.org
finnergo.eu
auberives-sur-vareze.fr
poems-for-the-soul.ch
ahgarage.com
lovcase.com
innervisions-id.com
citiscapes-art.com
akwaba-safaris.com
krishnabrawijaya.com
rivermusic.nl
a-zpaperwork.eu
internestdigital.com
saint-malo-developpement.fr
log-barn.co.uk
stagefxinc.com
collegetennis.info
dentalcircle.com
mrkluttz.com
hensleymarketing.com
physio-lang.de
endstarvation.com
blueridgeheritage.com
wordpress.idium.no
dmlcpa.com
spectamarketingdigital.com.br
ikzoekgod.be
uci-france.fr
lunoluno.com
opt4cdi.com
omegamarbella.com
graygreenbiomedservices.com
druktemakersheerenveen.nl
bakingismyyoga.com
agora-collectivites.com
devplus.be
naukaip.ru
ingresosextras.online
kerstliedjeszingen.nl
studionumerik.fr
boloria.de
5thactors.com
bluetenreich-brilon.de
andreaskildegaard.dk
logosindustries.com
hotelturbo.de
strauchs-wanderlust.info
wademurray.com
askstaffing.com
11.in.ua
animation-pro.co.uk
aceroprime.com
natturestaurante.com.br
oscommunity.de
quitescorting.com
business-basic.de
linearete.com
schulz-moelln.de
masecologicos.com
switch-made.com
hekecrm.com
dogsunlimitedguide.com
sjtpo.org
richardkershawwines.co.za
g2mediainc.com
yayasanprimaunggul.org
affligemsehondenschool.be
loparnille.se
bonitabeachassociation.com
ziliak.com
texanscan.org
funworx.de
palmecophilippines.com
espaciopolitica.com
jlwilsonbooks.com
itheroes.dk
witraz.pl
leopoldineroux.com
imajyuku-sozoku.com
taulunkartano.fi
lagschools.ng
olry-cloisons.fr
spartamovers.com
traitware.com
cascinarosa33.it
domilivefurniture.com
cormanmarketing.com
jayfurnitureco.com
gsconcretecoatings.com
eksperdanismanlik.com
bulyginnikitav.000webhostapp.com
liveyourheartout.co
bagaholics.in
littlesaints.academy
parksideseniorliving.net
ddmgen.com
stage-infirmier.fr
richardmaybury.co.uk
skooppi.fi
keuken-prijs.nl
chatberlin.de
lmmont.sk
smarttourism.academy
xrresources.com
geoweb.software
chainofhopeeurope.eu
licensed-public-adjuster.com
mundo-pieces-auto.fr
jobkiwi.com.ng
rizplakatjaya.com
jaaphoekzema.nl
peninggibadan.co.id
encounter-p.net
dr-vita.de
bringmehope.org
computer-place.de
cesep2019.com
triavlete.com
epicjapanart.com
cleanroomequipment.ie
domaine-des-pothiers.com
martinipstudios.com
katherinealy.com
bourchier.org
teutoradio.de
thehovecounsellingpractice.co.uk
rarefoods.ro
expohomes.com
werkzeugtrolley.net
lexced.com
trivselsguide.dk
maryairbnb.wordpress.com
sycamoregreenapts.com
nxtstg.org
vdolg24.online
wirmuessenreden.com
catalyseurdetransformation.com
selected-minds.de
subquercy.fr
ocduiblog.com
gardenpartner.pl
dreamvoiceclub.org
hypogenforensic.com
mollymccarthydesign.com
berdonllp.com
mikegoodfellow.co.uk
peppergreenfarmcatering.com.au
azerbaycanas.com
myfbateam.com
randyabrown.com
metroton.ru
arabianmice.com
alpesiberie.com
miscbo.it
axisoflove.org:443
premiumweb.com.ua:443
livelai.com
agrifarm.dk
stitch-n-bitch.com
scentedlair.com
georgemuncey.com
duthler.nl
molinum.pt
cmascd.com
pourlabretagne.bzh
annida.it
antesacademy.it
billigeflybilletter.dk
alaskaremote.com
groovedealers.ru
frankgoll.com
theatre-embellie.fr
zealcon.ae
vitormmcosta.com
shortysspices.com
sprintcoach.com
brunoimmobilier.com
paprikapod.com
aoyama.ac
kelsigordon.com
imaginekithomes.co.nz
entdoctor-durban.com
qandmmusiccenter.com
charlesfrancis.photos
k-zubki.ru
catering.com
ultimatelifesource.com
yuanshenghotel.com
kenmccallum.com
bluemarinefoundation.com
photonag.com
the5thquestion.com
factoriareloj.com
beauty-traveller.com
vitoriaecoturismo.com.br
claudiakilian.de
catchup-mag.com
focuskontur.com
awaitspain.com
eyedoctordallas.com
koncept-m.ru
tilldeeke.de
stralsund-ansichten.de
lyricalduniya.com
smartspeak.com
grafikstudio-visuell.de
jobstomoveamerica.org
goodboyscustom.com
global-migrate.com
lattalvor.com
dantreranch.com
redctei.co
bilius.dk
fbmagazine.ru
brighthillgroup.com
ledyoucan.com
elex.is
whoopingcrane.com
ncjc.ca
santastoy.store
galatee-couture.com
blavait.fr
skoczynski.eu
site.markkit.com.br
altocontatto.net
bg.szczecin.pl
photographycreativity.co.uk
grancanariaregional.com
pays-saint-flour.fr
o90.dk
rossomattonecase.it
lidkopingsnytt.nu
mazift.dk
dcc-eu.com
tutvracks.com
publicompserver.de
billscars.net
hawthornsretirement.co.uk
betterce.com
ownidentity.com
shortsalemap.com
jakubrybak.com
happylublog.wordpress.com
aberdeenartwalk.org
satoblog.org
condormobile.fr
sber-biznes.com
nuohous.com
o2o-academy.com
dnqa.co.uk
kosten-vochtbestrijding.be
campinglaforetdetesse.com
auto-opel.ro
uncensoredhentaigif.com
bundan.com
onlinemarketingsurgery.co.uk
pubcon.com
cuadc.org
patriotcleaning.net
skyboundnutrition.co.uk
phoenixcrane.com
ced-elec.com
comoserescritor.com
schroederschoembs.com
liepertgrafikweb.at
dibli.store
zuerich-umzug.ch
sambaglow.com
operativadigital.com
avtoboss163.ru:443
bendel-partner.de
mind2muscle.nl
cac2040.com
letterscan.de
tweedekansenloket.nl
fire-space.com
christianscholz.de
almamidwifery.com
techybash.com
pajagus.fr
pvandambv.nl
buonabitare.com
muller.nl
apmollerpension.com
makingmillionaires.net
artvark.nl
pxsrl.it
colored-shelves.com
speakaudible.com
kuriero.pro
nvisionsigns.com
factorywizuk.com
allinonecampaign.com
airvapourbarrier.com
michaelfiegel.com
forextimes.ru
iexpert99.com
goeppinger-teppichreinigung.de
energosbit-rp.ru
endlessrealms.net
xn--80abehgab4ak0ddz.xn--p1ai
thegrinningmanmusical.com
raeoflightmusic.com
unboxtherapy.site
slotspinner.com
biodentify.ai
agenceassemble.fr
activeterroristwarningcompany.com
5pointpt.com
tetameble.pl
amorbellezaysalud.com
acb-gruppe.ch
slotenmakerszwijndrecht.nl
xtensifi.com
vvego.com
larchwoodmarketing.com
hinotruckwreckers.com.au
signededenroth.dk
mbuildinghomes.com
janellrardon.com
skyscanner.ro
customroasts.com
bodymindchallenger.com
skinkeeper.li
breathebettertolivebetter.com
tothebackofthemoon.com
enactusnhlstenden.com
specialtyhomeservicesllc.com
p-ride.live
rapid5kloan.org
terraflair.de
cops4causes.org
nbva.co.uk
indiebizadvocates.org
amco.net.au
look.academy
salonlamar.nl
greenrider.nl
christopherhannan.com
janasfokus.com
promus.ca
reygroup.pt
karmeliterviertel.com
fascaonline.com
stoneridgemontessori.com
bratek-immobilien.de
tecleados.com
valiant-voice.com
motocrossplace.co.uk
bubbalucious.com
fta-media.com
nutriwell.com.sg
trevi-vl.ru
redpebblephotography.com
invela.dk
wallflowersandrakes.com
cymru.futbol
goodherbalhealth.com
denhaagfoodie.nl
bjornvanvulpen.nl
birthplacemag.com
simpleitsolutions.ch
smartmind.net
luvbec.com
innovationgames-brabant.nl
mediogiro.com.ar
scotlandsroute66.co.uk
mindsparkescape.com
luvinsburger.fr
brisbaneosteopathic.com.au
dinecorp.com
eastgrinsteadwingchun.com
johnstonmingmanning.com
initconf.com
cookinn.nl
lumturo.academy
magnetvisual.com
piestar.com
galaniuklaw.com
lapponiasafaris.com
yourcosmicbeing.com
muni.pe
smartworkplaza.com
saberconcrete.com
mjk.digital
signamedia.de
fysiotherapierijnmond.nl
jax-interim-and-projectmanagement.com
fi-institutionalfunds.com
tchernia-conseil.fr
janmorgenstern.com
gosouldeep.com
aktivfriskcenter.se
flossmoordental.com
richardiv.com
bookingwheel.com
solutionshosting.co.uk
matthieupetel.fr
monstarrsoccer.com
kausette.com
bluelakevision.com
tramadolhealth.com
sshomme.com
so-sage.fr
elitkeramika-shop.com.ua
advanced-removals.co.uk
radishallgood.com
cardsandloyalty.com
orchardbrickwork.com
tzn.nu
dennisverschuur.com
astrographic.com
eatyoveges.com
mangimirossana.it
t3brothers.com
therapybusinessacademy.com
benchbiz.com
cainlaw-okc.com
sochi-okna23.ru
tellthebell.website
iactechnologies.net
turing.academy
towelroot.co
greeneyetattoo.com
mustangmarketinggroup.com
bertbutter.nl
insane.agency
suonenjoen.fi
rename.kz
kombi-dress.com
k-v-f.de
bodet150ans.com
epsondriversforwindows.com
gatlinburgcottage.com
polynine.com
annenymus.com
xn--80addfr4ahr.dp.ua
mahikuchen.com
adabible.org
jag.me
babysitting-hk.helpergo.co
the-cupboard.co.uk
casinodepositors.com
breakluckrecords.com
napisat-pismo-gubernatoru.ru:443
mursall.de
fidelitytitleoregon.com
baumfinancialservices.com
nevadaruralhousingstudies.org
bychowo.pl
veggienessa.com
alcye.com
lisa-poncon.fr
agriturismocastagneto.it
powershell.su
newonestop.com
jimprattmediations.com
laaisterplakky.nl
fotoeditores.com
geitoniatonaggelon.gr
production-stills.co.uk
concontactodirecto.com
paradigmlandscape.com
ygallerysalonsoho.com:443
walterman.es
yvesdoin-aquarelles.fr
broccolisoep.nl
etgdogz.de
citydogslife.com
pokemonturkiye.com
iron-mine.ru
hepishopping.com
crestgood.com
topvijesti.net
andrealuchesi.it
eos-horlogerie.com
frameshift.it
fazagostar.co
bescomedical.de
kompresory-opravy.com
stressreliefadvice.com
modamarfil.com
interlinkone.com
reputation-medical.online
kdbrh.com
volta.plus
alexwenzel.de
speiserei-hannover.de
gavelmasters.com
sarahspics.co.uk
mariamalmahdi.com
afbudsrejserallinclusive.dk
schluesseldienste-hannover.de
greatofficespaces.net
rhino-turf.com
alwaysdc.com
prodentalblue.com
davedavisphotos.com
scholarquotes.com
springfieldplumbermo.com
jdscenter.com
mazzaropi.com.br
precisetemp.com
ntinasfiloxenia.gr
ludoil.it
the3-week-diet.net
klapanvent.ru
racefietsenblog.nl
datatri.be
soundseeing.net
pankiss.ru
netadultere.fr
carsten.sparen-it.de
donau-guides.eu
tages-geldvergleich.de
housesofwa.com
theintellect.edu.pk
rtc24.com
evsynthacademy.org
sachainchiuk.com
kryddersnapsen.dk
atma.nl
gazelle-du-web.com
fsbforsale.com
hiddensee-buhne11.de
rsidesigns.com
andermattswisswatches.ch
rhino-storage.co.uk
optigas.com
brownswoodblog.com
thepixelfairy.com
chomiksy.net
kryptos72.com
ciga-france.fr
gbk-tp1.de
thesilkroadny.com
rentingwell.com
medicalsupportco.com
beandrivingschool.com.au
latableacrepes-meaux.fr
palmenhaus-erfurt.de
supercarhire.co.uk
premier-iowa.com
acibademmobil.com.tr
kamin-somnium.de
mindfuelers.com
centuryvisionglobal.com
stabilisateur.fr
dinedrinkdetroit.com
nieuwsindeklas.be
belofloripa.be
memphishealthandwellness.com
ideamode.com
kvetymichalovce.sk
aidanpublishing.co.uk
tanatek.com
mac-computer-support-hamburg.de
fluzfluzrewards.com
letsstopsmoking.co.uk
apiarista.de
cc-experts.de
phukienbepthanhdat.com
jalkapuu.net
fann.ru
forskolinslimeffect.net
sellthewrightway.com
dierenambulancealkmaar.nl
wyreforest.net
daveystownhouse.com
michal-s.co.il
biblica.com
jobscore.com
csaballoons.com
edvestors.org
karelinjames.com
futurenetworking.com
imagine-entertainment.com
c-sprop.com
skolaprome.eu
professionetata.com
qwikcoach.com
kafkacare.com
metcalfe.ca
latteswithleslie.com
arearugcleaningnyc.com
spacebel.be
banukumbak.com
alisodentalcare.com
jameswilliamspainting.com
alnectus.com
rolleepollee.com
manzel.tn
carmel-york.com
creohn.de
thisprettyhair.com
perfectgrin.com
campusescalade.com
oexebusiness.com
welovecustomers.fr
bayshoreelite.com
descargandoprogramas.com
9nar.com
kartuindonesia.com
pazarspor.org.tr
drbrianhweeks.com
shrinkingplanet.com
protoplay.ca
bcmets.info
airserviceunlimited.com
brannbornfastigheter.se
kroophold-sjaelland.dk
hotjapaneselesbian.com
spirello.nl
relevantonline.eu
johnsonweekly.com
trainiumacademy.com
myplaywin3.com
anchelor.com
fixx-repair.com
jmmartinezilustrador.com
sveneulberg.de
campusce.com
ivancacu.com
autoteamlast.de
nepressurecleaning.com
adedesign.com
haus-landliebe.de
heuvelland-oaze.nl
voice2biz.com
thegetawaycollective.com
deduktia.fi
tieronechic.com
yournextshoes.com
mesajjongeren.nl
wribrazil.com
pisofare.co
curtsdiscountguns.com
90nguyentuan.com
watchsale.biz
rishigangoly.com
malevannye.ru
2020hindsight.info
wineandgo.hu
nexstagefinancial.com
banksrl.co.za
boomerslivinglively.com
girlish.ae
distrifresh.com
mayprogulka.ru
justaroundthecornerpetsit.com
circuit-diagramz.com
wrinstitute.org
theater-lueneburg.de
glende-pflanzenparadies.de
ykobbqchicken.ca
guohedd.com
bohrlochversicherung.info
legundschiess.de
avisioninthedesert.com
ravage-webzine.nl
markseymourphotography.co.uk
nauticmarine.dk
louiedager.com
jacquesgarcianoto.com
bumbipdeco.site
forumsittard.nl
ramirezprono.com
wasnederland.nl
der-stempelking.de
lovetzuchia.com
frimec-international.es
fotoslubna.com
awaisghauri.com
designimage.ae
theboardroomafrica.com
bridalcave.com
acornishstudio.co.uk
schlagbohrmaschinetests.com
nationnewsroom.com
zinnystar.com
purepreprod4.com
akcadagofis.com
eurethicsport.eu
plbinsurance.com
voetbalhoogeveen.nl
go.labibini.ch
gta-jjb.fr
bmw-i-pure-impulse.com
secrets-clubs.co.uk
pilotgreen.com
n-newmedia.de
ninjaki.com
amyandzac.com
renehartman.nl
outstandingminialbums.com
-
net
true
-
pid
19
-
prc
steam
agntsvc
synctime
oracle
isqlplussvc
dbsnmp
outlook
infopath
excel
xfssvccon
ocautoupds
firefoxconfig
onenote
mydesktopqos
mysqld_nt
wordpad
ocssd
ocomm
sqlwriter
thebat
winword
tbirdconfig
thebat64
mysqld_opt
sqlservr
mysqld
sqbcoreservice
mydesktopservice
sqlagent
visio
thunderbird
msftesql
sqlbrowser
powerpnt
mspub
msaccess
encsvc
dbeng50
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
36
-
svc
backup
memtas
sophos
veeam
mepocs
vss
sql
svc$
Extracted
C:\13f1fd7rp-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0E5B02AC0834A296
http://decryptor.top/0E5B02AC0834A296
Targets
-
-
Target
ba9592242e0e033b3c75bf06406b9ad8510123e950a139ac363de1812631cfe3
-
Size
204KB
-
MD5
91443fabe2b4bb7764ec65b07abb5de6
-
SHA1
7fecfae5088225aadd5a7c8bbdbb229410d20a6c
-
SHA256
ba9592242e0e033b3c75bf06406b9ad8510123e950a139ac363de1812631cfe3
-
SHA512
630775064e3865ddf50835f818dbfc45b900042674f4fdbe37fff7ac2fe46e92d59fef20cfeffa3916b919fe19a89b2317ed575636ef973bdb662dc7daa149d1
-
Modifies system executable filetype association
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Sodinokibi/Revil sample
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-