Static task
static1
Behavioral task
behavioral1
Sample
b2bc8b74846b6caa644107fe50a7a7ae7d44fc6a2e154064d742ec3daf81cfbc.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
b2bc8b74846b6caa644107fe50a7a7ae7d44fc6a2e154064d742ec3daf81cfbc.dll
Resource
win10-en-20211208
General
-
Target
b2bc8b74846b6caa644107fe50a7a7ae7d44fc6a2e154064d742ec3daf81cfbc
-
Size
164KB
-
MD5
1929607abe0a6247be80b1ad7f272890
-
SHA1
39de4e83c82237c92d1cceaddf010362642141ed
-
SHA256
b2bc8b74846b6caa644107fe50a7a7ae7d44fc6a2e154064d742ec3daf81cfbc
-
SHA512
c77660e1d51f644635197f6afa9e57fdfaedaf7d24550816ad105fdf737d87dfab9935ec092c2e3af115127e0c05a35900f8be83e051a9fe71d2fb4b0560e0e1
-
SSDEEP
3072:FWeI5JXJRGpUhFiWjmfb+HP+rnRfUjU2IONc:FWe29/GuzjmfCHWtUQ2TC
Malware Config
Extracted
sodinokibi
28
1347
parseport.com
hensleymarketing.com
prodentalblue.com
putzen-reinigen.com
triplettagaite.fr
rentingwell.com
bmw-i-pure-impulse.com
pixelhealth.net
rino-gmbh.com
kompresory-opravy.com
redctei.co
ownidentity.com
ziliak.com
wg-heiligenstadt.de
thenalpa.com
catalyseurdetransformation.com
santastoy.store
alpesiberie.com
hospitalitytrainingsolutions.co.uk
satoblog.org
eventosvirtualesexitosos.com
boomerslivinglively.com
startuplive.org
90nguyentuan.com
saberconcrete.com
saboboxtel.uk
jandhpest.com
smartmind.net
electricianul.com
dinecorp.com
theatre-embellie.fr
bluetenreich-brilon.de
walterman.es
alabamaroofingllc.com
smartworkplaza.com
arabianmice.com
dcc-eu.com
thehovecounsellingpractice.co.uk
11.in.ua
kamin-somnium.de
neonodi.be
imajyuku-sozoku.com
glende-pflanzenparadies.de
mensemetgesigte.co.za
mbuildinghomes.com
auberives-sur-vareze.fr
monstarrsoccer.com
plbinsurance.com
haard-totaal.nl
loysonbryan.com
sveneulberg.de
sytzedevries.com
hawaiisteelbuilding.com
eafx.pro
dentallabor-luenen.de
soncini.ch
tieronechic.com
noda.com.ua
pankiss.ru
karelinjames.com
web865.com
apmollerpension.com
polynine.com
gbk-tp1.de
baumfinancialservices.com
awag-blog.de
arazi.eus
carsten.sparen-it.de
limmortelyouth.com
specialtyhomeservicesllc.com
parisschool.ru
bescomedical.de
uci-france.fr
linkbuilding.life
jeanmonti.com
globalskills.pt
thisprettyhair.com
trivselsguide.dk
mrmac.com
silverbird.dk
distrifresh.com
leatherjees.com
hinotruckwreckers.com.au
b3b.ch
aheadloftladders.co.uk
professionetata.com
inewsstar.com
dentourage.com
blueridgeheritage.com
gratiocafeblog.wordpress.com
metallbau-hartmann.eu
ivancacu.com
scentedlair.com
littlesaints.academy
motocrossplace.co.uk
mind2muscle.nl
marcandy.com
lidkopingsnytt.nu
nevadaruralhousingstudies.org
greenrider.nl
glas-kuck.de
cmeow.com
hekecrm.com
wademurray.com
gsconcretecoatings.com
mediahub.co.nz
worldproskitour.com
dayenne-styling.nl
fann.ru
hom-frisor.dk
tweedekansenloket.nl
protoplay.ca
watchsale.biz
katherinealy.com
kdbrh.com
craftron.com
bavovrienden.nl
terraflair.de
penumbuhrambutkeiskei.com
rishigangoly.com
marmarabasin.com
etgdogz.de
o2o-academy.com
switch-made.com
3daywebs.com
yayasanprimaunggul.org
activeterroristwarningcompany.com
nationnewsroom.com
kerstliedjeszingen.nl
lovetzuchia.com
klapanvent.ru
moira-cristescu.com
topvijesti.net
legundschiess.de
witraz.pl
kryptos72.com
studionumerik.fr
janmorgenstern.com
malevannye.ru
jalkapuu.net
davedavisphotos.com
cc-experts.de
krishnabrawijaya.com
skoczynski.eu
xn--80abehgab4ak0ddz.xn--p1ai
delegationhub.com
breakluckrecords.com
queertube.net
stage-infirmier.fr
redpebblephotography.com
agora-collectivites.com
orchardbrickwork.com
voice2biz.com
omegamarbella.com
brunoimmobilier.com
pxsrl.it
jdscenter.com
denverwynkoopdentist.com
bratek-immobilien.de
datatri.be
fluzfluzrewards.com
altocontatto.net
hutchstyle.co.uk
pansionatblago.ru
billyoart.com
alexwenzel.de
wribrazil.com
rokthetalk.com
kuriero.pro
lapponiasafaris.com
suonenjoen.fi
secrets-clubs.co.uk
tbalp.co.uk
goodboyscustom.com
n-newmedia.de
stitch-n-bitch.com
stringnosis.academy
bg.szczecin.pl
relevantonline.eu
whoopingcrane.com
salonlamar.nl
galatee-couture.com
bridalcave.com
alcye.com
skinkeeper.li
osn.ro
fi-institutionalfunds.com
hostingbangladesh.net
traitware.com
solutionshosting.co.uk
qandmmusiccenter.com
blucamp.com
nourella.com
tramadolhealth.com
drbrianhweeks.com
autoteamlast.de
gurutechnologies.net
iactechnologies.net
jobkiwi.com.ng
gta-jjb.fr
ebible.co
ikadomus.com
finsahome.co.uk
onesynergyinternational.com
slideevents.be
pinkxgayvideoawards.com
amorbellezaysalud.com
brannbornfastigheter.se
stagefxinc.com
annenymus.com
louiedager.com
bumbipdeco.site
dantreranch.com
albcleaner.fr
aslog.fr
go.labibini.ch
jameswilliamspainting.com
perceptdecor.com
heimdalbygg.no
sycamoregreenapts.com
designimage.ae
acornishstudio.co.uk
2020hindsight.info
frameshift.it
blavait.fr
gardenpartner.pl
1deals.com
voetbalhoogeveen.nl
pourlabretagne.bzh
maryairbnb.wordpress.com
nuohous.com
mieleshopping.it
koncept-m.ru
drbenveniste.com
hartofurniture.com
the-cupboard.co.uk
enactusnhlstenden.com
sachainchiuk.com
baikalflot.ru
agendatwentytwenty.com
julielusktherapy.com
johnsonweekly.com
thegrinningmanmusical.com
georgemuncey.com
gatlinburgcottage.com
mgimalta.com
turing.academy
mediabolmong.com
gazelle-du-web.com
weddingceremonieswithtim.com
drvoip.com
kelsigordon.com
kvetymichalovce.sk
encounter-p.net
skyscanner.ro
vapiano.fr
valiant-voice.com
antesacademy.it
lattalvor.com
colored-shelves.com
gosouldeep.com
invela.dk
mustangmarketinggroup.com
opticahubertruiz.com
profibersan.com
cainlaw-okc.com
palema.gr
smartercashsystem.com
morgansconsult.com
strauchs-wanderlust.info
jaaphoekzema.nl
signamedia.de
letsstopsmoking.co.uk
cp-bap.de
beauty-traveller.com
mediogiro.com.ar
simpleitsolutions.ch
mariajosediazdemera.com
circuit-diagramz.com
liepertgrafikweb.at
bluelakevision.com
richardkershawwines.co.za
chorusconsulting.net
kiraribeaute-nani.com
supercarhire.co.uk
xn--ziinoapte-6ld.ro
taulunkartano.fi
mindfuelers.com
innervisions-id.com
luvbec.com
abulanov.com
chinowarehousespace.com
cleanroomequipment.ie
cardsandloyalty.com
mangimirossana.it
bendel-partner.de
billscars.net
elex.is
cymru.futbol
fidelitytitleoregon.com
skidpiping.de
xn--80addfr4ahr.dp.ua
axisoflove.org:443
brinkdoepke.eu
lmmont.sk
mahikuchen.com
luvinsburger.fr
michal-s.co.il
bcabattoirs.org
jollity.hu
nxtstg.org
licensed-public-adjuster.com
craftstone.co.nz
vdolg24.online
texanscan.org
perfectgrin.com
aberdeenartwalk.org
cotton-avenue.co.il
piestar.com
iron-mine.ru
happycatering.de
rossomattonecase.it
medicalsupportco.com
ufovidmag.com
ykobbqchicken.ca
mjk.digital
mrcar.nl
epicjapanart.com
belofloripa.be
sololibrerie.it
buerocenter-butzbach-werbemittel.de
denhaagfoodie.nl
tellthebell.website
adaduga.info
leadforensics.com
reygroup.pt
lexced.com
kartuindonesia.com
mondolandscapes.com
fysiotherapierijnmond.nl
fta-media.com
transifer.fr
dreamvoiceclub.org
akcadagofis.com
frankgoll.com
nginx.com
onlinemarketingsurgery.co.uk
tanatek.com
utilisacteur.fr
tzn.nu
logosindustries.com
interlinkone.com
from02pro.com
sealgrinderpt.com
stoneridgemontessori.com
fascaonline.com
adabible.org
ruggestar.ch
reizenmetkinderen.be
atrgroup.it
aciscomputers.com
unexplored.gr
mike.matthies.de
k-v-f.de
janellrardon.com
auto-opel.ro
efficiencyconsulting.es
optigas.com
advesa.com
aceroprime.com
omnicademy.com
zorgboerderijravensbosch.nl
outstandingminialbums.com
purepreprod4.com
ahgarage.com
cormanmarketing.com
test-teleachat.fr
hawthornsretirement.co.uk
christianscholz.de
newonestop.com
amco.net.au
anleggsregisteret.no
janasfokus.com
apiarista.de
tutvracks.com
springfieldplumbermo.com
pays-saint-flour.fr
bubbalucious.com
flossmoordental.com
amelielecompte.wordpress.com
levelseven.be
yourhappyevents.fr
bonitabeachassociation.com
fire-space.com
geitoniatonaggelon.gr
randyabrown.com
topautoinsurers.net
kellengatton.com
ketomealprep.academy
ncjc.ca
peninggibadan.co.id
rattanwarehouse.co.uk
spectamarketingdigital.com.br
lifeinbreaths.com
cesep2019.com
azerbaycanas.com
angelika-schwarz.com
matteoruzzaofficial.com
catering.com
energosbit-rp.ru
kookooo.com
levencovka.ru
berdonllp.com
napisat-pismo-gubernatoru.ru:443
ciga-france.fr
donau-guides.eu
forumsittard.nl
ygallerysalonsoho.com:443
frimec-international.es
elitkeramika-shop.com.ua
bayshoreelite.com
fotoeditores.com
epsondriversforwindows.com
wirmuessenreden.com
keuken-prijs.nl
juergenblaetz.de
gaearoyals.com
trainiumacademy.com
greatofficespaces.net
ludoil.it
explora.nl
diakonie-weitramsdorf-sesslach.de
modamarfil.com
altitudeboise.com
fbmagazine.ru
devplus.be
breathebettertolivebetter.com
harleystreetspineclinic.com
cxcompany.com
eastgrinsteadwingchun.com
basindentistry.com
molade.nl
zaczytana.com
selected-minds.de
dr-vita.de
toranjtuition.org
bilius.dk
hostaletdelsindians.es
banksrl.co.za
silkeight.com
myfbateam.com
eyedoctordallas.com
arearugcleaningnyc.com
cookinn.nl
shortsalemap.com
tages-geldvergleich.de
astrographic.com
pajagus.fr
biblica.com
sarahspics.co.uk
premier-iowa.com
hostastay.com
olry-cloisons.fr
adedesign.com
handyman-silkeborg.dk
richardiv.com
leloupblanc.gr
banukumbak.com
burg-zelem.de
oththukaruva.com
rs-danmark.dk
kombi-dress.com
hvitfeldt.dk
lesyeuxbleus.net
the-beauty-guides.com
jax-interim-and-projectmanagement.com
otpusk.zp.ua
renderbox.ch
lollachiro.com
miscbo.it
uncensoredhentaigif.com
ramirezprono.com
apogeeconseils.fr
zinnystar.com
imaginekithomes.co.nz
andermattswisswatches.ch
atma.nl
mikegoodfellow.co.uk
fanuli.com.au
metcalfe.ca
ikzoekgod.be
mamajenedesigns.com
g2mediainc.com
magrinya.net
baptistdistinctives.org
dinedrinkdetroit.com
mariannelemenestrel.com
devus.de
limounie.com
rhino-storage.co.uk
cincinnatiphotocompany.org
natturestaurante.com.br
thegetawaycollective.com
onlinetvgroup.com
powershell.su
speakaudible.com
babysitting-hk.helpergo.co
bourchier.org
martinipstudios.com
so-sage.fr
brisbaneosteopathic.com.au
nbva.co.uk
haus-landliebe.de
lunoluno.com
eos-horlogerie.com
lumturo.academy
housesofwa.com
achetrabalhos.com
rizplakatjaya.com
kafkacare.com
o90.dk
bruut.online
theboardroomafrica.com
precisetemp.com
fotoslubna.com
chris-anne.com
coachpreneuracademy.com
premiumweb.com.ua:443
hotjapaneselesbian.com
glennverschueren.be
yvesdoin-aquarelles.fr
rechtenplicht.be
edrickennedymacfoy.com
buzzneakers.com
oexebusiness.com
hoteltantra.com
guohedd.com
acb-gruppe.ch
tetameble.pl
muni.pe
directique.com
lagschools.ng
indiebizadvocates.org
maxcube24.com.ua
futurenetworking.com
memphishealthandwellness.com
eatyoveges.com
nepal-pictures.com
sprintcoach.com
bodymindchallenger.com
ijsselbeton.nl
alisodentalcare.com
vvego.com
wordpress.idium.no
avisioninthedesert.com
airvapourbarrier.com
airserviceunlimited.com
eksperdanismanlik.com
bakingismyyoga.com
floweringsun.org
nicksrock.com
nauticmarine.dk
golfclublandgoednieuwkerk.nl
catchup-mag.com
descargandoprogramas.com
log-barn.co.uk
bajova.sk
andrealuchesi.it
alnectus.com
bringmehope.org
fridakids.com
ced-elec.com
thestudio.academy
rename.kz
sweetz.fr
pvandambv.nl
stressreliefadvice.com
tecleados.com
kristianboennelykke.dk
bertbutter.nl
skooppi.fi
aoyama.ac
tesisatonarim.com
physio-lang.de
domaine-des-pothiers.com
mariamalmahdi.com
cac2040.com
pureelements.nl
avtoboss163.ru:443
zumrutkuyutemel.com
jacquesgarcianoto.com
pharmeko-group.com
circlecitydj.com
lashandbrowenvy.com
ledyoucan.com
mazzaropi.com.br
mesajjongeren.nl
suitesartemis.gr
smartspeak.com
beandrivingschool.com.au
xn--billigafrgpatroner-stb.se
endlessrealms.net
kenmccallum.com
leopoldineroux.com
metroton.ru
justaroundthecornerpetsit.com
goddardleadership.org
johnkoen.com
ingresosextras.online
augen-praxisklinik-rostock.de
projektparkiet.pl
framemyballs.com
peppergreenfarmcatering.com.au
alltagsrassismus-entknoten.de
palmenhaus-erfurt.de
pinthelook.com
solidhosting.nl
tothebackofthemoon.com
scotlandsroute66.co.uk
triavlete.com
look.academy
verbouwingsdouche.nl
bluemarinefoundation.com
finnergo.eu
business-basic.de
poems-for-the-soul.ch
renehartman.nl
gavelmasters.com
vipcarrental.ae
aidanpublishing.co.uk
chatterchatterchatter.com
leansupremegarcinia.net
cyberpromote.de
victorvictoria.com
wyreforest.net
vedsegaard.dk
radishallgood.com
werkzeugtrolley.net
fazagostar.co
heuvelland-oaze.nl
buonabitare.com
afbudsrejserallinclusive.dk
vitoriaecoturismo.com.br
thepixelfairy.com
schulz-moelln.de
nvisionsigns.com
rozmata.com
neolaiamedispa.com
sbit.ag
bundan.com
rvside.com
liverpoolabudhabi.ae
ya-elka.ru
andreaskildegaard.dk
envomask.com
johnstonmingmanning.com
phoenixcrane.com
goodherbalhealth.com
bagaholics.in
mrkluttz.com
spacebel.be
goeppinger-teppichreinigung.de
bohrlochversicherung.info
sellthewrightway.com
kemtron.fr
nexstagefinancial.com
centuryvisionglobal.com
saint-malo-developpement.fr
mazift.dk
p-ride.live
cuadc.org
kickittickets.com
palmecophilippines.com
techybash.com
sber-biznes.com
elliemaccreative.wordpress.com
naukaip.ru
agriturismocastagneto.it
zdrowieszczecin.pl
alene.co
internestdigital.com
midwestschool.org
thiagoperez.com
chomiksy.net
unboxtherapy.site
metriplica.academy
yuanshenghotel.com
advance-refle.com
soundseeing.net
lgiwines.com
annida.it
jimprattmediations.com
bcmets.info
sharonalbrightdds.com
muller.nl
bjornvanvulpen.nl
profiz.com
ilovefullcircle.com
jakubrybak.com
ninjaki.com
awaitspain.com
fskhjalmar.se
global-migrate.com
campusescalade.com
animalfood-online.de
zealcon.ae
mercadodelrio.com
richardmaybury.co.uk
druktemakersheerenveen.nl
edvestors.org
schroederschoembs.com
tastevirginia.com
innovationgames-brabant.nl
volta.plus
askstaffing.com
der-stempelking.de
carolynfriedlander.com
c-sprop.com
qwikcoach.com
campusce.com
k-zubki.ru
subyard.com
hypogenforensic.com
letterscan.de
endstarvation.com
ddmgen.com
lassocrm.com
clemenfoto.dk
ravage-webzine.nl
manzel.tn
welovecustomers.fr
direitapernambuco.com
tatyanakopieva.ru
cl0nazepamblog.com
advanced-removals.co.uk
creohn.de
jmmartinezilustrador.com
ayudaespiritualtamara.com
skyboundnutrition.co.uk
reputation-medical.online
trevi-vl.ru
singletonfinancial.com
girlish.ae
paradigmlandscape.com
malzomattalar.com
prometeyagro.com.ua
fla.se
oncarrot.com
evsynthacademy.org
subquercy.fr
geoweb.software
wrinstitute.org
crestgood.com
margaretmcshane.com
min-virksomhed.dk
broccolisoep.nl
forextimes.ru
casinodepositors.com
focuskontur.com
grupoexin10.com
tchernia-conseil.fr
wasnederland.nl
biketruck.de
billigeflybilletter.dk
mneti.ru
line-x.co.uk
agrifarm.dk
initconf.com
fixx-repair.com
lookandseen.com
tradenavigator.ch
a-zpaperwork.eu
graygreenbiomedservices.com
grancanariaregional.com
hnkns.com
jayfurnitureco.com
mollymccarthydesign.com
nykfdyrehospital.dk
alharsunindo.com
aktivfriskcenter.se
eurethicsport.eu
rapid5kloan.org
keyboardjournal.com
baita.ac
pedmanson.com
xrresources.com
jobstomoveamerica.org
biodentify.ai
itheroes.dk
insane.agency
jag.me
speiserei-hannover.de
9nar.com
dentalcircle.com
four-ways.com
ilveshistoria.com
pro-gamer.pl
digitale-elite.de
masecologicos.com
forskolinslimeffect.net
spirello.nl
racefietsenblog.nl
betterce.com
quitescorting.com
agencewho-aixenprovence.fr
zwemofficial.nl
domilivefurniture.com
deduktia.fi
veggienessa.com
birthplacemag.com
hotelturbo.de
alaskaremote.com
eshop.design
linearete.com
ox-home.com
sjtpo.org
acibademmobil.com.tr
dierenambulancealkmaar.nl
mac-computer-support-hamburg.de
customroasts.com
yournextshoes.com
dogsunlimitedguide.com
paprikapod.com
khtrx.com
dnqa.co.uk
arthakapitalforvaltning.dk
belinda.af
enews-qca.com
lisa-poncon.fr
livelai.com
the3-week-diet.net
csaballoons.com
irizar.com
entdoctor-durban.com
craftingalegacy.com
leijstrom.com
bulyginnikitav.000webhostapp.com
factorywizuk.com
alattekniksipil.com
benchbiz.com
istantidigitali.com
smarttourism.academy
shortysspices.com
placermonticello.com
aquacheck.co.za
tilldeeke.de
anchelor.com
cops4causes.org
akwaba-safaris.com
barbaramcfadyenjewelry.com
amyandzac.com
lovcase.com
rolleepollee.com
schlagbohrmaschinetests.com
husetsanitas.dk
advancedeyecare.com
111firstdelray.com
ceocenters.com
theater-lueneburg.de
phukienbepthanhdat.com
scholarquotes.com
bookingwheel.com
5pointpt.com
hiddensee-buhne11.de
matthieupetel.fr
curtsdiscountguns.com
daveystownhouse.com
iexpert99.com
duthler.nl
oraweb.net
jonnyhooley.com
deziplan.ru
groovedealers.ru
stanleyqualitysystems.com
stathmoulis.gr
hepishopping.com
photonag.com
rhino-turf.com
jefersonalessandro.com
schluesseldienste-hannover.de
parksideseniorliving.net
jlwilsonbooks.com
netadultere.fr
citiscapes-art.com
oportowebdesign.com
clinic-beethovenstrasse-ag.ch
rentsportsequip.com
avis.mantova.it
agenceassemble.fr
qrs-international.com
m2graph.fr
boloria.de
lyricalduniya.com
laylavalentine.com
rarefoods.ro
opt4cdi.com
fitnessblenderstory.com
liveyourheartout.co
allinonecampaign.com
campinglaforetdetesse.com
the5thquestion.com
adterium.com
nalliasmali.net
hameghlim.com
artvark.nl
bellesiniacademy.org
cap29010.it
nutriwell.com.sg
shrinkingplanet.com
scietech.academy
signededenroth.dk
charlottelhanna.com
sochi-okna23.ru
espaciopolitica.com
atelierkomon.com
primemarineengineering.com
paardcentraal.nl
kausette.com
slotspinner.com
motocrosshideout.com
drnelsonpediatrics.com
kryddersnapsen.dk
landgoedspica.nl
dmlcpa.com
rivermusic.nl
grafikstudio-visuell.de
diverfiestas.com.es
latableacrepes-meaux.fr
brighthillgroup.com
makingmillionaires.net
nrgvalue.com
unislaw-narty.pl
rtc24.com
mslp.org
myplaywin3.com
mundo-pieces-auto.fr
asiaartgallery.jp
operativadigital.com
riffenmattgarage.ch
parentsandkids.com
bychowo.pl
sshomme.com
bodet150ans.com
easydental.ae
affligemsehondenschool.be
universelle.fr
azloans.com
ultimatelifesource.com
t3brothers.com
zuerich-umzug.ch
happylublog.wordpress.com
claudiakilian.de
skolaprome.eu
loparnille.se
sunsolutions.es
ideamode.com
galaniuklaw.com
testitjavertailut.net
citydogslife.com
bd2fly.com
humanviruses.org
sppdstats.com
concontactodirecto.com
collegetennis.info
successcolony.com.ng
cssp-mediation.org
therapybusinessacademy.com
brownswoodblog.com
proffteplo.com
imagine-entertainment.com
ronaldhendriks.nl
comoserescritor.com
foerderverein-vatterschule.de
vitormmcosta.com
promus.ca
pokemonturkiye.com
ronielyn.com
teutoradio.de
stabilisateur.fr
mayprogulka.ru
karmeliterviertel.com
patriotcleaning.net
greeneyetattoo.com
fsbforsale.com
block-optic.com
egpu.fr
pazarspor.org.tr
condormobile.fr
teamsegeln.ch
ocduiblog.com
site.markkit.com.br
corporacionrr.com
thesilkroadny.com
pilotgreen.com
hm-com.com
mindsparkescape.com
computer-place.de
mursall.de
charlesfrancis.photos
christopherhannan.com
docarefoundation.org
kosten-vochtbestrijding.be
laaisterplakky.nl
stralsund-ansichten.de
animation-pro.co.uk
triplettabordeaux.fr
wallflowersandrakes.com
holocine.de
globalcompliancenews.com
nieuwsindeklas.be
jlgraphisme.fr
publicompserver.de
cascinarosa33.it
5thactors.com
sambaglow.com
yourcosmicbeing.com
patassociation.com
magnetvisual.com
larchwoodmarketing.com
photographycreativity.co.uk
latteswithleslie.com
cmascd.com
xtensifi.com
jobscore.com
nepressurecleaning.com
ncn.nl
raeoflightmusic.com
towelroot.co
carmel-york.com
internalresults.com
factoriareloj.com
rubyaudiology.com
wineandgo.hu
boyfriendsgoal.site
martha-frets-ceramics.nl
michaelfiegel.com
production-stills.co.uk
chainofhopeeurope.eu
slotenmakerszwijndrecht.nl
furland.ru
artcase.pl
dibli.store
dieetuniversiteit.nl
teethinadaydentalimplants.com
livedeveloper.com
pisofare.co
awaisghauri.com
die-immo-agentur.de
ntinasfiloxenia.gr
spartamovers.com
angelsmirrorus.com
lsngroupe.com
theintellect.edu.pk
buffdaddyblog.com
markseymourphotography.co.uk
molinum.pt
jglconsultancy.com
kroophold-sjaelland.dk
oro.ae
narca.net
chatberlin.de
rsidesigns.com
almamidwifery.com
acumenconsultingcompany.com
webforsites.com
funworx.de
alwaysdc.com
angeleyezstripclub.com
oscommunity.de
expohomes.com
innersurrection.com
pubcon.com
dennisverschuur.com
-
net
true
-
pid
28
-
prc
mydesktopservice
powerpnt
ocssd
excel
ocautoupds
dbeng50
sql
agntsvc
visio
tbirdconfig
oracle
firefox
thunderbird
synctime
encsvc
wordpa
isqlplussvc
mspub
sqbcoreservice
dbsnmp
thebat
winword
outlook
mydesktopqos
steam
msaccess
xfssvccon
ocomm
infopath
onenote
-
ransom_oneliner
All of your files are encrypted! Find {EXT}_Wannadie.txt and follow instructions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
1347
-
svc
backup
svc$
veeam
sql
mepocs
memtas
sophos
vss
Signatures
-
Sodinokibi family
-
Sodinokibi/Revil sample 1 IoCs
Processes:
resource yara_rule sample family_sodinokobi
Files
-
b2bc8b74846b6caa644107fe50a7a7ae7d44fc6a2e154064d742ec3daf81cfbc.dll windows x86
c4c29c7e6a6897be412c7fedfcca8fe4
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
SetErrorMode
CreateThread
Sections
.text Size: 43KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 57KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.e4sm3 Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ