General
-
Target
97ce758904aa53c3c4b3e0e4f9fec84958c4bae0cade393d0159a78cfc79cd8d
-
Size
204KB
-
Sample
220124-bxkvzaheem
-
MD5
bee0969692fe9aa8996a3436feb7b764
-
SHA1
370e8a179085da36ef9ed780ece2b75abf1a6de6
-
SHA256
97ce758904aa53c3c4b3e0e4f9fec84958c4bae0cade393d0159a78cfc79cd8d
-
SHA512
355677ffe9bf4aa69adc9dc1310e04de3493b90be26830f25cc6080c06890d055d56a0d9040c941c55db895d474f99422630c27012af06b8625971a72f6a5c6c
Static task
static1
Behavioral task
behavioral1
Sample
97ce758904aa53c3c4b3e0e4f9fec84958c4bae0cade393d0159a78cfc79cd8d.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
97ce758904aa53c3c4b3e0e4f9fec84958c4bae0cade393d0159a78cfc79cd8d.exe
Resource
win10-en-20211208
Malware Config
Extracted
C:\p85949-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/45230101C056B520
http://decryptor.top/45230101C056B520
Extracted
sodinokibi
19
96
noda.com.ua
jalkapuu.net
azerbaycanas.com
animation-pro.co.uk
jimprattmediations.com
factoriareloj.com
rozmata.com
yourcosmicbeing.com
profiz.com
aslog.fr
rhino-turf.com
skinkeeper.li
brisbaneosteopathic.com.au
testitjavertailut.net
mayprogulka.ru
patriotcleaning.net
hawaiisteelbuilding.com
loparnille.se
nutriwell.com.sg
yournextshoes.com
beandrivingschool.com.au
smartmind.net
modamarfil.com
proffteplo.com
martha-frets-ceramics.nl
parksideseniorliving.net
vapiano.fr
letsstopsmoking.co.uk
dibli.store
1deals.com
ya-elka.ru
signededenroth.dk
yayasanprimaunggul.org
epicjapanart.com
endlessrealms.net
futurenetworking.com
thegrinningmanmusical.com
mazzaropi.com.br
richardmaybury.co.uk
masecologicos.com
motocrosshideout.com
buerocenter-butzbach-werbemittel.de
alnectus.com
acumenconsultingcompany.com
pazarspor.org.tr
alattekniksipil.com
look.academy
volta.plus
xrresources.com
greatofficespaces.net
andrealuchesi.it
gosouldeep.com
leatherjees.com
holocine.de
vdolg24.online
spectamarketingdigital.com.br
triavlete.com
theater-lueneburg.de
spartamovers.com
goodboyscustom.com
funworx.de
kryptos72.com
fazagostar.co
worldproskitour.com
latteswithleslie.com
catalyseurdetransformation.com
gazelle-du-web.com
wademurray.com
kellengatton.com
web865.com
bagaholics.in
midwestschool.org
trainiumacademy.com
vipcarrental.ae
diakonie-weitramsdorf-sesslach.de
richardiv.com
jameswilliamspainting.com
akwaba-safaris.com
angelika-schwarz.com
levelseven.be
line-x.co.uk
9nar.com
teamsegeln.ch
grafikstudio-visuell.de
mursall.de
humanviruses.org
business-basic.de
hiddensee-buhne11.de
mollymccarthydesign.com
raeoflightmusic.com
test-teleachat.fr
amco.net.au
jonnyhooley.com
dayenne-styling.nl
sweetz.fr
ciga-france.fr
alwaysdc.com
pharmeko-group.com
rentingwell.com
indiebizadvocates.org
laylavalentine.com
bruut.online
chatterchatterchatter.com
foerderverein-vatterschule.de
morgansconsult.com
soncini.ch
b3b.ch
oexebusiness.com
ivancacu.com
traitware.com
janellrardon.com
reizenmetkinderen.be
rechtenplicht.be
radishallgood.com
t3brothers.com
larchwoodmarketing.com
trevi-vl.ru
glennverschueren.be
rokthetalk.com
pubcon.com
delegationhub.com
airvapourbarrier.com
circuit-diagramz.com
wirmuessenreden.com
comoserescritor.com
pankiss.ru
agencewho-aixenprovence.fr
drbenveniste.com
legundschiess.de
istantidigitali.com
hotelturbo.de
p-ride.live
khtrx.com
arazi.eus
mesajjongeren.nl
smartworkplaza.com
fla.se
aciscomputers.com
smartspeak.com
greeneyetattoo.com
wyreforest.net
heuvelland-oaze.nl
ikzoekgod.be
soundseeing.net
chris-anne.com
forskolinslimeffect.net
glas-kuck.de
dentourage.com
slotenmakerszwijndrecht.nl
pays-saint-flour.fr
mieleshopping.it
werkzeugtrolley.net
globalskills.pt
stoneridgemontessori.com
ced-elec.com
docarefoundation.org
natturestaurante.com.br
nginx.com
tzn.nu
tesisatonarim.com
billyoart.com
towelroot.co
lyricalduniya.com
buffdaddyblog.com
licensed-public-adjuster.com
awaitspain.com
buonabitare.com
belinda.af
hostingbangladesh.net
promus.ca
onlinemarketingsurgery.co.uk
zinnystar.com
skyboundnutrition.co.uk
encounter-p.net
alaskaremote.com
framemyballs.com
brinkdoepke.eu
endstarvation.com
cc-experts.de
rivermusic.nl
goeppinger-teppichreinigung.de
lidkopingsnytt.nu
saboboxtel.uk
utilisacteur.fr
auto-opel.ro
zumrutkuyutemel.com
denverwynkoopdentist.com
acornishstudio.co.uk
palmenhaus-erfurt.de
furland.ru
crestgood.com
limmortelyouth.com
affligemsehondenschool.be
manzel.tn
jefersonalessandro.com
nuohous.com
internalresults.com
naukaip.ru
luvbec.com
mslp.org
cac2040.com
the-cupboard.co.uk
kombi-dress.com
xtensifi.com
girlish.ae
johnkoen.com
renehartman.nl
from02pro.com
bubbalucious.com
thehovecounsellingpractice.co.uk
agendatwentytwenty.com
marcandy.com
directique.com
piestar.com
billigeflybilletter.dk
bumbipdeco.site
bodet150ans.com
klapanvent.ru
mneti.ru
unexplored.gr
slotspinner.com
mbuildinghomes.com
koncept-m.ru
linkbuilding.life
orchardbrickwork.com
chainofhopeeurope.eu
global-migrate.com
handyman-silkeborg.dk
leansupremegarcinia.net
basindentistry.com
richardkershawwines.co.za
placermonticello.com
racefietsenblog.nl
subyard.com
apmollerpension.com
casinodepositors.com
stralsund-ansichten.de
tatyanakopieva.ru
liepertgrafikweb.at
jacquesgarcianoto.com
turing.academy
brighthillgroup.com
pilotgreen.com
kookooo.com
awaisghauri.com
hepishopping.com
charlottelhanna.com
ketomealprep.academy
unboxtherapy.site
ziliak.com
hawthornsretirement.co.uk
georgemuncey.com
nepressurecleaning.com
dentalcircle.com
trivselsguide.dk
johnsonweekly.com
dcc-eu.com
jayfurnitureco.com
5pointpt.com
barbaramcfadyenjewelry.com
mensemetgesigte.co.za
o90.dk
ahgarage.com
fotoslubna.com
leijstrom.com
curtsdiscountguns.com
nalliasmali.net
reputation-medical.online
rarefoods.ro
atma.nl
mindsparkescape.com
rvside.com
ronielyn.com
physio-lang.de
denhaagfoodie.nl
riffenmattgarage.ch
artcase.pl
michaelfiegel.com
keyboardjournal.com
dogsunlimitedguide.com
astrographic.com
terraflair.de
cainlaw-okc.com
fbmagazine.ru
bulyginnikitav.000webhostapp.com
paardcentraal.nl
kerstliedjeszingen.nl
bohrlochversicherung.info
entdoctor-durban.com
omegamarbella.com
andreaskildegaard.dk
fixx-repair.com
ygallerysalonsoho.com:443
arearugcleaningnyc.com
tieronechic.com
bellesiniacademy.org
oncarrot.com
scentedlair.com
pinkxgayvideoawards.com
stage-infirmier.fr
vvego.com
kroophold-sjaelland.dk
magrinya.net
bavovrienden.nl
limounie.com
tetameble.pl
datatri.be
alisodentalcare.com
cymru.futbol
direitapernambuco.com
bluemarinefoundation.com
mgimalta.com
latableacrepes-meaux.fr
boyfriendsgoal.site
charlesfrancis.photos
theatre-embellie.fr
pro-gamer.pl
unislaw-narty.pl
ilovefullcircle.com
ninjaki.com
letterscan.de
sytzedevries.com
hotjapaneselesbian.com
renderbox.ch
gratiocafeblog.wordpress.com
pourlabretagne.bzh
jobkiwi.com.ng
texanscan.org
campusce.com
lisa-poncon.fr
lumturo.academy
shortysspices.com
lovetzuchia.com
n-newmedia.de
kamin-somnium.de
iactechnologies.net
medicalsupportco.com
livelai.com
kartuindonesia.com
glende-pflanzenparadies.de
poems-for-the-soul.ch
jlwilsonbooks.com
pureelements.nl
thenalpa.com
centuryvisionglobal.com
initconf.com
stringnosis.academy
jdscenter.com
monstarrsoccer.com
azloans.com
descargandoprogramas.com
ruggestar.ch
avtoboss163.ru:443
karelinjames.com
oraweb.net
hom-frisor.dk
zealcon.ae
ikadomus.com
operativadigital.com
fitnessblenderstory.com
andermattswisswatches.ch
pajagus.fr
thegetawaycollective.com
sachainchiuk.com
jeanmonti.com
cmeow.com
sellthewrightway.com
nvisionsigns.com
druktemakersheerenveen.nl
peppergreenfarmcatering.com.au
rs-danmark.dk
gavelmasters.com
myplaywin3.com
amyandzac.com
mondolandscapes.com
smartercashsystem.com
floweringsun.org
pansionatblago.ru
ddmgen.com
tbalp.co.uk
queertube.net
finsahome.co.uk
suonenjoen.fi
epsondriversforwindows.com
lashandbrowenvy.com
janasfokus.com
golfclublandgoednieuwkerk.nl
frimec-international.es
hnkns.com
speiserei-hannover.de
m2graph.fr
ilveshistoria.com
spacebel.be
kenmccallum.com
der-stempelking.de
duthler.nl
davedavisphotos.com
tchernia-conseil.fr
uci-france.fr
eastgrinsteadwingchun.com
karmeliterviertel.com
ox-home.com
scietech.academy
johnstonmingmanning.com
profibersan.com
bluelakevision.com
julielusktherapy.com
schulz-moelln.de
go.labibini.ch
avis.mantova.it
plbinsurance.com
geitoniatonaggelon.gr
wineandgo.hu
strauchs-wanderlust.info
lsngroupe.com
aoyama.ac
nevadaruralhousingstudies.org
90nguyentuan.com
wordpress.idium.no
dreamvoiceclub.org
sveneulberg.de
adedesign.com
thiagoperez.com
greenrider.nl
louiedager.com
hensleymarketing.com
sololibrerie.it
advancedeyecare.com
haus-landliebe.de
mrmac.com
oththukaruva.com
nauticmarine.dk
putzen-reinigen.com
galatee-couture.com
prometeyagro.com.ua
k-v-f.de
bertbutter.nl
devus.de
randyabrown.com
amorbellezaysalud.com
zwemofficial.nl
fskhjalmar.se
katherinealy.com
tradenavigator.ch
the3-week-diet.net
publicompserver.de
tramadolhealth.com
olry-cloisons.fr
alharsunindo.com
weddingceremonieswithtim.com
speakaudible.com
pedmanson.com
kelsigordon.com
pxsrl.it
michal-s.co.il
hoteltantra.com
alcye.com
tanatek.com
stitch-n-bitch.com
pixelhealth.net
guohedd.com
eksperdanismanlik.com
keuken-prijs.nl
askstaffing.com
kuriero.pro
yourhappyevents.fr
bescomedical.de
onesynergyinternational.com
maxcube24.com.ua
onlinetvgroup.com
cp-bap.de
secrets-clubs.co.uk
kiraribeaute-nani.com
juergenblaetz.de
mrcar.nl
premier-iowa.com
ncn.nl
tastevirginia.com
bychowo.pl
magnetvisual.com
enews-qca.com
craftingalegacy.com
gbk-tp1.de
campinglaforetdetesse.com
xn--ziinoapte-6ld.ro
bratek-immobilien.de
bendel-partner.de
witraz.pl
therapybusinessacademy.com
achetrabalhos.com
housesofwa.com
cap29010.it
rsidesigns.com
lovcase.com
bonitabeachassociation.com
opticahubertruiz.com
anleggsregisteret.no
efficiencyconsulting.es
cormanmarketing.com
sunsolutions.es
saberconcrete.com
donau-guides.eu
annida.it
blavait.fr
expohomes.com
animalfood-online.de
purepreprod4.com
breathebettertolivebetter.com
block-optic.com
thestudio.academy
site.markkit.com.br
ronaldhendriks.nl
arthakapitalforvaltning.dk
energosbit-rp.ru
netadultere.fr
boloria.de
etgdogz.de
universelle.fr
stabilisateur.fr
cascinarosa33.it
whoopingcrane.com
acibademmobil.com.tr
invela.dk
aktivfriskcenter.se
stagefxinc.com
cesep2019.com
devplus.be
rtc24.com
slideevents.be
welovecustomers.fr
myfbateam.com
digitale-elite.de
alpesiberie.com
rubyaudiology.com
ijsselbeton.nl
logosindustries.com
berdonllp.com
bilius.dk
burg-zelem.de
haard-totaal.nl
lunoluno.com
airserviceunlimited.com
motocrossplace.co.uk
galaniuklaw.com
lmmont.sk
banksrl.co.za
martinipstudios.com
amelielecompte.wordpress.com
pokemonturkiye.com
gardenpartner.pl
fire-space.com
scotlandsroute66.co.uk
yuanshenghotel.com
bodymindchallenger.com
dmlcpa.com
professionetata.com
teethinadaydentalimplants.com
ideamode.com
advanced-removals.co.uk
aberdeenartwalk.org
jaaphoekzema.nl
marmarabasin.com
triplettabordeaux.fr
jlgraphisme.fr
muller.nl
hostastay.com
brannbornfastigheter.se
mustangmarketinggroup.com
neolaiamedispa.com
fridakids.com
fidelitytitleoregon.com
photographycreativity.co.uk
chomiksy.net
globalcompliancenews.com
rizplakatjaya.com
breakluckrecords.com
bundan.com
bcabattoirs.org
lattalvor.com
catchup-mag.com
easydental.ae
cssp-mediation.org
cotton-avenue.co.il
bakingismyyoga.com
jobstomoveamerica.org
itheroes.dk
vedsegaard.dk
pvandambv.nl
successcolony.com.ng
carolynfriedlander.com
adterium.com
fanuli.com.au
customroasts.com
111firstdelray.com
espaciopolitica.com
omnicademy.com
biblica.com
hypogenforensic.com
anchelor.com
taulunkartano.fi
cardsandloyalty.com
avisioninthedesert.com
opt4cdi.com
tages-geldvergleich.de
maryairbnb.wordpress.com
nourella.com
stressreliefadvice.com
wrinstitute.org
salonlamar.nl
graygreenbiomedservices.com
sealgrinderpt.com
napisat-pismo-gubernatoru.ru:443
cxcompany.com
simpleitsolutions.ch
aheadloftladders.co.uk
ebible.co
gsconcretecoatings.com
mundo-pieces-auto.fr
thepixelfairy.com
eatyoveges.com
elitkeramika-shop.com.ua
leloupblanc.gr
parentsandkids.com
bridalcave.com
tellthebell.website
fluzfluzrewards.com
goodherbalhealth.com
citiscapes-art.com
premiumweb.com.ua:443
bcmets.info
stathmoulis.gr
kafkacare.com
nicksrock.com
catering.com
internestdigital.com
angeleyezstripclub.com
ykobbqchicken.ca
lapponiasafaris.com
krishnabrawijaya.com
watchsale.biz
four-ways.com
fi-institutionalfunds.com
kausette.com
gurutechnologies.net
metcalfe.ca
nepal-pictures.com
alabamaroofingllc.com
albcleaner.fr
citydogslife.com
apiarista.de
walterman.es
solutionshosting.co.uk
auberives-sur-vareze.fr
o2o-academy.com
flossmoordental.com
dentallabor-luenen.de
collegetennis.info
hospitalitytrainingsolutions.co.uk
smarttourism.academy
mike.matthies.de
saint-malo-developpement.fr
mrkluttz.com
baumfinancialservices.com
paradigmlandscape.com
theboardroomafrica.com
biketruck.de
qrs-international.com
distrifresh.com
banukumbak.com
kemtron.fr
tilldeeke.de
janmorgenstern.com
elex.is
focuskontur.com
mariajosediazdemera.com
lookandseen.com
vitoriaecoturismo.com.br
brownswoodblog.com
otpusk.zp.ua
mangimirossana.it
zuerich-umzug.ch
almamidwifery.com
solidhosting.nl
metriplica.academy
edrickennedymacfoy.com
eventosvirtualesexitosos.com
antesacademy.it
lesyeuxbleus.net
die-immo-agentur.de
optigas.com
studionumerik.fr
innersurrection.com
inewsstar.com
hameghlim.com
daveystownhouse.com
topautoinsurers.net
eurethicsport.eu
vitormmcosta.com
justaroundthecornerpetsit.com
verbouwingsdouche.nl
precisetemp.com
fta-media.com
stanleyqualitysystems.com
newonestop.com
paprikapod.com
elliemaccreative.wordpress.com
akcadagofis.com
sber-biznes.com
rossomattonecase.it
5thactors.com
lifeinbreaths.com
rino-gmbh.com
jollity.hu
redctei.co
enactusnhlstenden.com
landgoedspica.nl
skooppi.fi
jakubrybak.com
dnqa.co.uk
2020hindsight.info
sarahspics.co.uk
lgiwines.com
corporacionrr.com
egpu.fr
activeterroristwarningcompany.com
designimage.ae
palmecophilippines.com
leadforensics.com
mariamalmahdi.com
adaduga.info
supercarhire.co.uk
theintellect.edu.pk
apogeeconseils.fr
zorgboerderijravensbosch.nl
blucamp.com
goddardleadership.org
domaine-des-pothiers.com
mariannelemenestrel.com
jobscore.com
toranjtuition.org
tutvracks.com
projektparkiet.pl
ufovidmag.com
nykfdyrehospital.dk
sjtpo.org
bjornvanvulpen.nl
cuadc.org
pisofare.co
frameshift.it
silkeight.com
harleystreetspineclinic.com
zaczytana.com
gaearoyals.com
insane.agency
beauty-traveller.com
quitescorting.com
k-zubki.ru
neonodi.be
ludoil.it
bd2fly.com
alltagsrassismus-entknoten.de
livedeveloper.com
sbit.ag
leopoldineroux.com
nrgvalue.com
sycamoregreenapts.com
rolleepollee.com
nieuwsindeklas.be
axisoflove.org:443
cmascd.com
bg.szczecin.pl
sprintcoach.com
belofloripa.be
chinowarehousespace.com
deduktia.fi
rhino-storage.co.uk
iron-mine.ru
annenymus.com
gatlinburgcottage.com
laaisterplakky.nl
redpebblephotography.com
allinonecampaign.com
broccolisoep.nl
mind2muscle.nl
dinecorp.com
dierenambulancealkmaar.nl
brunoimmobilier.com
springfieldplumbermo.com
carsten.sparen-it.de
campusescalade.com
sshomme.com
miscbo.it
nexstagefinancial.com
kosten-vochtbestrijding.be
patassociation.com
tweedekansenloket.nl
bookingwheel.com
condormobile.fr
molinum.pt
cops4causes.org
primemarineengineering.com
finnergo.eu
osn.ro
thesilkroadny.com
moira-cristescu.com
jglconsultancy.com
claudiakilian.de
fascaonline.com
zdrowieszczecin.pl
creohn.de
santastoy.store
the5thquestion.com
geoweb.software
awag-blog.de
switch-made.com
buzzneakers.com
dr-vita.de
agrifarm.dk
signamedia.de
mindfuelers.com
imaginekithomes.co.nz
bourchier.org
innovationgames-brabant.nl
kompresory-opravy.com
ravage-webzine.nl
xn--80addfr4ahr.dp.ua
min-virksomhed.dk
grancanariaregional.com
spirello.nl
wallflowersandrakes.com
mikegoodfellow.co.uk
valiant-voice.com
augen-praxisklinik-rostock.de
dinedrinkdetroit.com
eshop.design
baita.ac
domilivefurniture.com
hinotruckwreckers.com.au
craftstone.co.nz
betterce.com
perfectgrin.com
imajyuku-sozoku.com
afbudsrejserallinclusive.dk
jag.me
shortsalemap.com
ingresosextras.online
advesa.com
diverfiestas.com.es
prodentalblue.com
agenceassemble.fr
outstandingminialbums.com
birthplacemag.com
memphishealthandwellness.com
photonag.com
polynine.com
webforsites.com
margaretmcshane.com
c-sprop.com
phoenixcrane.com
mac-computer-support-hamburg.de
agora-collectivites.com
a-zpaperwork.eu
cleanroomequipment.ie
markseymourphotography.co.uk
billscars.net
victorvictoria.com
skidpiping.de
dieetuniversiteit.nl
g2mediainc.com
ledyoucan.com
interlinkone.com
happycatering.de
mediahub.co.nz
husetsanitas.dk
electricianul.com
aceroprime.com
hvitfeldt.dk
nbva.co.uk
suitesartemis.gr
gta-jjb.fr
ramirezprono.com
eafx.pro
abulanov.com
lexced.com
perceptdecor.com
metroton.ru
arabianmice.com
thisprettyhair.com
cyberpromote.de
angelsmirrorus.com
penumbuhrambutkeiskei.com
hm-com.com
oro.ae
rattanwarehouse.co.uk
ultimatelifesource.com
skoczynski.eu
factorywizuk.com
linearete.com
peninggibadan.co.id
cincinnatiphotocompany.org
fann.ru
ayudaespiritualtamara.com
selected-minds.de
sppdstats.com
specialtyhomeservicesllc.com
groovedealers.ru
jax-interim-and-projectmanagement.com
littlesaints.academy
boomerslivinglively.com
baptistdistinctives.org
hekecrm.com
blueridgeheritage.com
loysonbryan.com
wribrazil.com
adabible.org
explora.nl
uncensoredhentaigif.com
ncjc.ca
shrinkingplanet.com
babysitting-hk.helpergo.co
christianscholz.de
bringmehope.org
carmel-york.com
tecleados.com
oscommunity.de
cl0nazepamblog.com
fotoeditores.com
bluetenreich-brilon.de
schluesseldienste-hannover.de
mediabolmong.com
matteoruzzaofficial.com
evsynthacademy.org
startuplive.org
grupoexin10.com
baikalflot.ru
kickittickets.com
drnelsonpediatrics.com
fsbforsale.com
jmmartinezilustrador.com
clemenfoto.dk
heimdalbygg.no
mediogiro.com.ar
triplettagaite.fr
transifer.fr
csaballoons.com
oportowebdesign.com
rename.kz
ocduiblog.com
aidanpublishing.co.uk
clinic-beethovenstrasse-ag.ch
voetbalhoogeveen.nl
so-sage.fr
iexpert99.com
alene.co
altitudeboise.com
colored-shelves.com
altocontatto.net
acb-gruppe.ch
mamajenedesigns.com
molade.nl
hutchstyle.co.uk
3daywebs.com
kryddersnapsen.dk
advance-refle.com
reygroup.pt
parseport.com
envomask.com
biodentify.ai
sochi-okna23.ru
narca.net
edvestors.org
mercadodelrio.com
bmw-i-pure-impulse.com
rishigangoly.com
subquercy.fr
bajova.sk
irizar.com
scholarquotes.com
topvijesti.net
happylublog.wordpress.com
yvesdoin-aquarelles.fr
eos-horlogerie.com
rapid5kloan.org
chatberlin.de
nxtstg.org
phukienbepthanhdat.com
wg-heiligenstadt.de
silverbird.dk
parisschool.ru
agriturismocastagneto.it
atrgroup.it
chorusconsulting.net
kdbrh.com
malevannye.ru
veggienessa.com
computer-place.de
sharonalbrightdds.com
alexwenzel.de
schroederschoembs.com
luvinsburger.fr
powershell.su
sambaglow.com
satoblog.org
log-barn.co.uk
ntinasfiloxenia.gr
mjk.digital
voice2biz.com
forumsittard.nl
asiaartgallery.jp
qandmmusiccenter.com
jandhpest.com
metallbau-hartmann.eu
cookinn.nl
palema.gr
wasnederland.nl
xn--billigafrgpatroner-stb.se
autoteamlast.de
skolaprome.eu
imagine-entertainment.com
kvetymichalovce.sk
dennisverschuur.com
tothebackofthemoon.com
teutoradio.de
the-beauty-guides.com
benchbiz.com
frankgoll.com
matthieupetel.fr
singletonfinancial.com
schlagbohrmaschinetests.com
malzomattalar.com
mahikuchen.com
kristianboennelykke.dk
forextimes.ru
liveyourheartout.co
deziplan.ru
atelierkomon.com
relevantonline.eu
aquacheck.co.za
11.in.ua
craftron.com
lollachiro.com
bayshoreelite.com
mazift.dk
qwikcoach.com
eyedoctordallas.com
coachpreneuracademy.com
drbrianhweeks.com
pinthelook.com
hartofurniture.com
techybash.com
hostaletdelsindians.es
production-stills.co.uk
liverpoolabudhabi.ae
circlecitydj.com
fysiotherapierijnmond.nl
rentsportsequip.com
lagschools.ng
dantreranch.com
nationnewsroom.com
lassocrm.com
ceocenters.com
skyscanner.ro
xn--80abehgab4ak0ddz.xn--p1ai
concontactodirecto.com
ownidentity.com
levencovka.ru
makingmillionaires.net
drvoip.com
artvark.nl
muni.pe
christopherhannan.com
innervisions-id.com
protoplay.ca
-
net
true
-
pid
19
-
prc
steam
encsvc
isqlplussvc
wordpad
oracle
ocssd
onenote
thebat
powerpnt
thebat64
mysqld
synctime
msaccess
xfssvccon
firefoxconfig
sqlagent
tbirdconfig
excel
visio
thunderbird
mydesktopqos
sqlbrowser
agntsvc
mysqld_nt
ocomm
dbsnmp
mysqld_opt
mydesktopservice
dbeng50
mspub
sqlservr
ocautoupds
infopath
msftesql
sqbcoreservice
winword
outlook
sqlwriter
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
96
-
svc
backup
veeam
svc$
sql
sophos
memtas
mepocs
vss
Extracted
C:\iy5r4zy9b-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F2D5D77A36801A97
http://decryptor.top/F2D5D77A36801A97
Targets
-
-
Target
97ce758904aa53c3c4b3e0e4f9fec84958c4bae0cade393d0159a78cfc79cd8d
-
Size
204KB
-
MD5
bee0969692fe9aa8996a3436feb7b764
-
SHA1
370e8a179085da36ef9ed780ece2b75abf1a6de6
-
SHA256
97ce758904aa53c3c4b3e0e4f9fec84958c4bae0cade393d0159a78cfc79cd8d
-
SHA512
355677ffe9bf4aa69adc9dc1310e04de3493b90be26830f25cc6080c06890d055d56a0d9040c941c55db895d474f99422630c27012af06b8625971a72f6a5c6c
-
Detect Neshta Payload
-
Modifies system executable filetype association
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Sodinokibi/Revil sample
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Loads dropped DLL
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-