General
-
Target
00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf
-
Size
204KB
-
Sample
220124-c36v3aaefm
-
MD5
7d7ee58c2696794b3be958b165eb61a9
-
SHA1
d24d3921aad182754f4ee5fa0ef13b2699d20108
-
SHA256
00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf
-
SHA512
b04eec574166812a1c85b5abf0acb20c99eedab3d07ebbaf4dba2a4d5847c98f029f9f1671349899adb661bf17cc45f74b7dbde784c333127972ebb1ab488c27
Static task
static1
Behavioral task
behavioral1
Sample
00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf.exe
Resource
win10-en-20211208
Malware Config
Extracted
C:\p72pe-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3258074B51DD5655
http://decryptor.top/3258074B51DD5655
Extracted
sodinokibi
19
100
suonenjoen.fi
forskolinslimeffect.net
dentalcircle.com
bourchier.org
epicjapanart.com
apogeeconseils.fr
goodherbalhealth.com
vapiano.fr
reizenmetkinderen.be
smartspeak.com
thesilkroadny.com
latableacrepes-meaux.fr
triplettagaite.fr
inewsstar.com
internestdigital.com
salonlamar.nl
altitudeboise.com
fixx-repair.com
cxcompany.com
aheadloftladders.co.uk
dogsunlimitedguide.com
gratiocafeblog.wordpress.com
spacebel.be
g2mediainc.com
mangimirossana.it
hotjapaneselesbian.com
shortsalemap.com
raeoflightmusic.com
ingresosextras.online
metriplica.academy
opticahubertruiz.com
sunsolutions.es
campinglaforetdetesse.com
taulunkartano.fi
glennverschueren.be
parksideseniorliving.net
mariannelemenestrel.com
atrgroup.it
rino-gmbh.com
greeneyetattoo.com
laylavalentine.com
spectamarketingdigital.com.br
claudiakilian.de
rivermusic.nl
victorvictoria.com
rozmata.com
bringmehope.org
parentsandkids.com
haard-totaal.nl
hartofurniture.com
zinnystar.com
hiddensee-buhne11.de
liverpoolabudhabi.ae
tanatek.com
yvesdoin-aquarelles.fr
innervisions-id.com
zumrutkuyutemel.com
denverwynkoopdentist.com
c-sprop.com
maryairbnb.wordpress.com
jayfurnitureco.com
karelinjames.com
linearete.com
aceroprime.com
edrickennedymacfoy.com
dentourage.com
kuriero.pro
schlagbohrmaschinetests.com
letsstopsmoking.co.uk
putzen-reinigen.com
hawthornsretirement.co.uk
xrresources.com
jacquesgarcianoto.com
factorywizuk.com
crestgood.com
yournextshoes.com
cp-bap.de
advancedeyecare.com
molinum.pt
xn--80addfr4ahr.dp.ua
rs-danmark.dk
nepressurecleaning.com
initconf.com
boomerslivinglively.com
kdbrh.com
craftron.com
stressreliefadvice.com
mslp.org
manzel.tn
boyfriendsgoal.site
evsynthacademy.org
bescomedical.de
kickittickets.com
xn--billigafrgpatroner-stb.se
nexstagefinancial.com
wg-heiligenstadt.de
deduktia.fi
switch-made.com
casinodepositors.com
chainofhopeeurope.eu
nrgvalue.com
innovationgames-brabant.nl
site.markkit.com.br
benchbiz.com
mieleshopping.it
diverfiestas.com.es
edvestors.org
p-ride.live
hypogenforensic.com
ronielyn.com
husetsanitas.dk
ocduiblog.com
kvetymichalovce.sk
stagefxinc.com
sololibrerie.it
ketomealprep.academy
nauticmarine.dk
veggienessa.com
biblica.com
leijstrom.com
elex.is
poems-for-the-soul.ch
hostaletdelsindians.es
lgiwines.com
marmarabasin.com
vvego.com
theintellect.edu.pk
amyandzac.com
the5thquestion.com
devplus.be
advesa.com
singletonfinancial.com
autoteamlast.de
lashandbrowenvy.com
cainlaw-okc.com
motocrossplace.co.uk
cotton-avenue.co.il
limounie.com
kompresory-opravy.com
jakubrybak.com
paradigmlandscape.com
forumsittard.nl
golfclublandgoednieuwkerk.nl
block-optic.com
bodet150ans.com
agendatwentytwenty.com
catalyseurdetransformation.com
sber-biznes.com
simpleitsolutions.ch
tastevirginia.com
atma.nl
pansionatblago.ru
bychowo.pl
groovedealers.ru
premiumweb.com.ua:443
curtsdiscountguns.com
silkeight.com
angelsmirrorus.com
onlinemarketingsurgery.co.uk
qwikcoach.com
jandhpest.com
acb-gruppe.ch
leatherjees.com
keyboardjournal.com
sochi-okna23.ru
rubyaudiology.com
lunoluno.com
renderbox.ch
ddmgen.com
worldproskitour.com
patriotcleaning.net
scholarquotes.com
hotelturbo.de
eshop.design
happylublog.wordpress.com
campusce.com
agrifarm.dk
wyreforest.net
primemarineengineering.com
nuohous.com
dentallabor-luenen.de
zealcon.ae
renehartman.nl
eafx.pro
adabible.org
designimage.ae
magrinya.net
towelroot.co
amorbellezaysalud.com
n-newmedia.de
bcmets.info
fitnessblenderstory.com
domaine-des-pothiers.com
bohrlochversicherung.info
janasfokus.com
fla.se
riffenmattgarage.ch
whoopingcrane.com
pankiss.ru
precisetemp.com
shrinkingplanet.com
ya-elka.ru
mayprogulka.ru
diakonie-weitramsdorf-sesslach.de
easydental.ae
mariamalmahdi.com
penumbuhrambutkeiskei.com
goodboyscustom.com
annenymus.com
chomiksy.net
fluzfluzrewards.com
agencewho-aixenprovence.fr
pourlabretagne.bzh
mediogiro.com.ar
hostingbangladesh.net
fanuli.com.au
2020hindsight.info
wallflowersandrakes.com
kenmccallum.com
ultimatelifesource.com
janellrardon.com
bjornvanvulpen.nl
profibersan.com
scietech.academy
happycatering.de
slotspinner.com
guohedd.com
drvoip.com
gardenpartner.pl
almamidwifery.com
osn.ro
campusescalade.com
oscommunity.de
bratek-immobilien.de
mikegoodfellow.co.uk
ijsselbeton.nl
sachainchiuk.com
thepixelfairy.com
bluemarinefoundation.com
tothebackofthemoon.com
advance-refle.com
hvitfeldt.dk
t3brothers.com
oraweb.net
zaczytana.com
90nguyentuan.com
mrmac.com
olry-cloisons.fr
boloria.de
cardsandloyalty.com
jag.me
sarahspics.co.uk
m2graph.fr
soundseeing.net
oportowebdesign.com
christopherhannan.com
skyscanner.ro
bluelakevision.com
landgoedspica.nl
belofloripa.be
ziliak.com
the-beauty-guides.com
pilotgreen.com
collegetennis.info
dierenambulancealkmaar.nl
istantidigitali.com
allinonecampaign.com
kemtron.fr
cascinarosa33.it
ludoil.it
alaskaremote.com
ufovidmag.com
hom-frisor.dk
rokthetalk.com
hm-com.com
pureelements.nl
hekecrm.com
bubbalucious.com
sveneulberg.de
medicalsupportco.com
mrcar.nl
techybash.com
barbaramcfadyenjewelry.com
airserviceunlimited.com
bonitabeachassociation.com
cap29010.it
alnectus.com
avtoboss163.ru:443
prodentalblue.com
arthakapitalforvaltning.dk
mundo-pieces-auto.fr
rolleepollee.com
cssp-mediation.org
patassociation.com
ciga-france.fr
nutriwell.com.sg
rarefoods.ro
tellthebell.website
palema.gr
jlgraphisme.fr
galatee-couture.com
kosten-vochtbestrijding.be
descargandoprogramas.com
ykobbqchicken.ca
delegationhub.com
paardcentraal.nl
eos-horlogerie.com
lyricalduniya.com
docarefoundation.org
theatre-embellie.fr
ikadomus.com
haus-landliebe.de
humanviruses.org
photographycreativity.co.uk
parseport.com
banukumbak.com
omegamarbella.com
palmenhaus-erfurt.de
richardkershawwines.co.za
johnstonmingmanning.com
unexplored.gr
nxtstg.org
ncjc.ca
toranjtuition.org
broccolisoep.nl
katherinealy.com
adaduga.info
klapanvent.ru
onlinetvgroup.com
expohomes.com
fsbforsale.com
teutoradio.de
finsahome.co.uk
narca.net
wademurray.com
michal-s.co.il
thisprettyhair.com
spirello.nl
startuplive.org
jmmartinezilustrador.com
acibademmobil.com.tr
atelierkomon.com
fazagostar.co
cleanroomequipment.ie
reputation-medical.online
mensemetgesigte.co.za
heuvelland-oaze.nl
lsngroupe.com
jaaphoekzema.nl
loparnille.se
carsten.sparen-it.de
lagschools.ng
otpusk.zp.ua
leadforensics.com
hostastay.com
graygreenbiomedservices.com
look.academy
trainiumacademy.com
iexpert99.com
buzzneakers.com
auto-opel.ro
solutionshosting.co.uk
carmel-york.com
akwaba-safaris.com
optigas.com
glende-pflanzenparadies.de
nicksrock.com
pro-gamer.pl
jlwilsonbooks.com
ygallerysalonsoho.com:443
denhaagfoodie.nl
dennisverschuur.com
mneti.ru
innersurrection.com
springfieldplumbermo.com
placermonticello.com
epsondriversforwindows.com
karmeliterviertel.com
biketruck.de
thiagoperez.com
kookooo.com
theboardroomafrica.com
imajyuku-sozoku.com
professionetata.com
donau-guides.eu
encounter-p.net
premier-iowa.com
buffdaddyblog.com
eatyoveges.com
animalfood-online.de
jeanmonti.com
fi-institutionalfunds.com
krishnabrawijaya.com
nginx.com
finnergo.eu
jobscore.com
stralsund-ansichten.de
naukaip.ru
kroophold-sjaelland.dk
geitoniatonaggelon.gr
nevadaruralhousingstudies.org
legundschiess.de
wrinstitute.org
hepishopping.com
furland.ru
globalskills.pt
liepertgrafikweb.at
grafikstudio-visuell.de
lassocrm.com
adterium.com
mac-computer-support-hamburg.de
zorgboerderijravensbosch.nl
bruut.online
tutvracks.com
maxcube24.com.ua
rsidesigns.com
chorusconsulting.net
bertbutter.nl
afbudsrejserallinclusive.dk
b3b.ch
saint-malo-developpement.fr
datatri.be
k-v-f.de
anleggsregisteret.no
bilius.dk
silverbird.dk
electricianul.com
zdrowieszczecin.pl
latteswithleslie.com
sytzedevries.com
bmw-i-pure-impulse.com
dnqa.co.uk
christianscholz.de
keuken-prijs.nl
mursall.de
hinotruckwreckers.com.au
traitware.com
buonabitare.com
masecologicos.com
lisa-poncon.fr
global-migrate.com
qrs-international.com
cmeow.com
girlish.ae
tecleados.com
awag-blog.de
studionumerik.fr
mindsparkescape.com
rizplakatjaya.com
bridalcave.com
hnkns.com
mgimalta.com
druktemakersheerenveen.nl
baikalflot.ru
grupoexin10.com
gurutechnologies.net
licensed-public-adjuster.com
arazi.eus
jonnyhooley.com
angeleyezstripclub.com
subyard.com
mariajosediazdemera.com
perfectgrin.com
lollachiro.com
glas-kuck.de
avis.mantova.it
miscbo.it
affligemsehondenschool.be
endlessrealms.net
tbalp.co.uk
promus.ca
bodymindchallenger.com
sealgrinderpt.com
bakingismyyoga.com
outstandingminialbums.com
prometeyagro.com.ua
mahikuchen.com
metroton.ru
mjk.digital
goeppinger-teppichreinigung.de
charlottelhanna.com
rapid5kloan.org
werkzeugtrolley.net
santastoy.store
cormanmarketing.com
pazarspor.org.tr
bavovrienden.nl
vipcarrental.ae
heimdalbygg.no
molade.nl
ikzoekgod.be
operativadigital.com
teamsegeln.ch
blueridgeheritage.com
1deals.com
monstarrsoccer.com
plbinsurance.com
direitapernambuco.com
napisat-pismo-gubernatoru.ru:443
fotoeditores.com
saberconcrete.com
thehovecounsellingpractice.co.uk
bluetenreich-brilon.de
cymru.futbol
lifeinbreaths.com
creohn.de
richardiv.com
betterce.com
distrifresh.com
citiscapes-art.com
blavait.fr
adedesign.com
factoriareloj.com
yayasanprimaunggul.org
pinthelook.com
burg-zelem.de
quitescorting.com
sshomme.com
cc-experts.de
aktivfriskcenter.se
watchsale.biz
airvapourbarrier.com
margaretmcshane.com
volta.plus
o2o-academy.com
alattekniksipil.com
lovetzuchia.com
bayshoreelite.com
aoyama.ac
wordpress.idium.no
mollymccarthydesign.com
nepal-pictures.com
efficiencyconsulting.es
koncept-m.ru
mesajjongeren.nl
achetrabalhos.com
reygroup.pt
angelika-schwarz.com
wirmuessenreden.com
kerstliedjeszingen.nl
natturestaurante.com.br
abulanov.com
rhino-turf.com
topvijesti.net
neonodi.be
agriturismocastagneto.it
luvinsburger.fr
tramadolhealth.com
mercadodelrio.com
juergenblaetz.de
ox-home.com
azerbaycanas.com
gatlinburgcottage.com
so-sage.fr
chinowarehousespace.com
smarttourism.academy
bajova.sk
awaisghauri.com
aquacheck.co.za
vitoriaecoturismo.com.br
o90.dk
motocrosshideout.com
enews-qca.com
concontactodirecto.com
computer-place.de
comoserescritor.com
breathebettertolivebetter.com
espaciopolitica.com
avisioninthedesert.com
tilldeeke.de
saboboxtel.uk
amco.net.au
log-barn.co.uk
carolynfriedlander.com
egpu.fr
craftingalegacy.com
paprikapod.com
georgemuncey.com
luvbec.com
lapponiasafaris.com
alwaysdc.com
stitch-n-bitch.com
entdoctor-durban.com
dinecorp.com
agenceassemble.fr
aslog.fr
cincinnatiphotocompany.org
kamin-somnium.de
mazift.dk
circuit-diagramz.com
livedeveloper.com
ravage-webzine.nl
verbouwingsdouche.nl
relevantonline.eu
lovcase.com
martha-frets-ceramics.nl
therapybusinessacademy.com
powershell.su
uci-france.fr
tages-geldvergleich.de
letterscan.de
from02pro.com
axisoflove.org:443
min-virksomhed.dk
gaearoyals.com
limmortelyouth.com
bumbipdeco.site
netadultere.fr
fire-space.com
frameshift.it
awaitspain.com
bcabattoirs.org
bulyginnikitav.000webhostapp.com
profiz.com
rtc24.com
cyberpromote.de
kryddersnapsen.dk
eyedoctordallas.com
zuerich-umzug.ch
modamarfil.com
kristianboennelykke.dk
alene.co
leloupblanc.gr
ilveshistoria.com
dmlcpa.com
eventosvirtualesexitosos.com
rossomattonecase.it
aidanpublishing.co.uk
ntinasfiloxenia.gr
rentsportsequip.com
ledyoucan.com
palmecophilippines.com
brighthillgroup.com
kelsigordon.com
breakluckrecords.com
handyman-silkeborg.dk
muni.pe
neolaiamedispa.com
lattalvor.com
imaginekithomes.co.nz
globalcompliancenews.com
harleystreetspineclinic.com
kafkacare.com
grancanariaregional.com
stabilisateur.fr
suitesartemis.gr
oththukaruva.com
agora-collectivites.com
gazelle-du-web.com
andreaskildegaard.dk
schluesseldienste-hannover.de
speiserei-hannover.de
pixelhealth.net
trivselsguide.dk
pharmeko-group.com
tradenavigator.ch
kellengatton.com
voetbalhoogeveen.nl
nalliasmali.net
mamajenedesigns.com
rename.kz
nationnewsroom.com
gosouldeep.com
thegetawaycollective.com
berdonllp.com
soncini.ch
witraz.pl
enactusnhlstenden.com
leopoldineroux.com
gsconcretecoatings.com
malzomattalar.com
111firstdelray.com
elliemaccreative.wordpress.com
terraflair.de
strauchs-wanderlust.info
frimec-international.es
satoblog.org
etgdogz.de
birthplacemag.com
selected-minds.de
acornishstudio.co.uk
pinkxgayvideoawards.com
jameswilliamspainting.com
biodentify.ai
annida.it
craftstone.co.nz
scentedlair.com
cac2040.com
mindfuelers.com
fotoslubna.com
sjtpo.org
wasnederland.nl
nieuwsindeklas.be
5pointpt.com
advanced-removals.co.uk
fidelitytitleoregon.com
leansupremegarcinia.net
skyboundnutrition.co.uk
clinic-beethovenstrasse-ag.ch
interlinkone.com
vdolg24.online
webforsites.com
geoweb.software
alharsunindo.com
nbva.co.uk
opt4cdi.com
acumenconsultingcompany.com
larchwoodmarketing.com
energosbit-rp.ru
daveystownhouse.com
topautoinsurers.net
apmollerpension.com
jobkiwi.com.ng
xtensifi.com
phukienbepthanhdat.com
brannbornfastigheter.se
valiant-voice.com
transifer.fr
pxsrl.it
csaballoons.com
richardmaybury.co.uk
gavelmasters.com
fskhjalmar.se
turing.academy
mustangmarketinggroup.com
apiarista.de
skoczynski.eu
nvisionsigns.com
trevi-vl.ru
xn--ziinoapte-6ld.ro
jax-interim-and-projectmanagement.com
julielusktherapy.com
nourella.com
schroederschoembs.com
ramirezprono.com
drbrianhweeks.com
scotlandsroute66.co.uk
hameghlim.com
astrographic.com
voice2biz.com
protoplay.ca
slotenmakerszwijndrecht.nl
blucamp.com
kausette.com
littlesaints.academy
gta-jjb.fr
greenrider.nl
insane.agency
oro.ae
augen-praxisklinik-rostock.de
hensleymarketing.com
andrealuchesi.it
line-x.co.uk
sambaglow.com
jglconsultancy.com
chatberlin.de
subquercy.fr
circlecitydj.com
tieronechic.com
wineandgo.hu
mediabolmong.com
ninjaki.com
randyabrown.com
die-immo-agentur.de
kryptos72.com
supercarhire.co.uk
basindentistry.com
zwemofficial.nl
specialtyhomeservicesllc.com
arearugcleaningnyc.com
bagaholics.in
3daywebs.com
go.labibini.ch
physio-lang.de
moira-cristescu.com
jimprattmediations.com
citydogslife.com
sppdstats.com
animation-pro.co.uk
brinkdoepke.eu
mazzaropi.com.br
alcye.com
fbmagazine.ru
stringnosis.academy
vitormmcosta.com
funworx.de
justaroundthecornerpetsit.com
muller.nl
housesofwa.com
charlesfrancis.photos
devus.de
vedsegaard.dk
iron-mine.ru
malevannye.ru
drnelsonpediatrics.com
pubcon.com
business-basic.de
ruggestar.ch
jefersonalessandro.com
hawaiisteelbuilding.com
arabianmice.com
polynine.com
morgansconsult.com
welovecustomers.fr
peninggibadan.co.id
redpebblephotography.com
bellesiniacademy.org
fascaonline.com
triavlete.com
shortysspices.com
internalresults.com
laaisterplakky.nl
liveyourheartout.co
tweedekansenloket.nl
dantreranch.com
bookingwheel.com
orchardbrickwork.com
pajagus.fr
nykfdyrehospital.dk
catchup-mag.com
amelielecompte.wordpress.com
radishallgood.com
babysitting-hk.helpergo.co
pisofare.co
ilovefullcircle.com
memphishealthandwellness.com
askstaffing.com
stage-infirmier.fr
tetameble.pl
thegrinningmanmusical.com
test-teleachat.fr
dcc-eu.com
bg.szczecin.pl
oncarrot.com
publicompserver.de
mike.matthies.de
aciscomputers.com
alexwenzel.de
ced-elec.com
thestudio.academy
skooppi.fi
colored-shelves.com
logosindustries.com
janmorgenstern.com
purepreprod4.com
uncensoredhentaigif.com
auberives-sur-vareze.fr
smartworkplaza.com
wribrazil.com
banksrl.co.za
cops4causes.org
fann.ru
davedavisphotos.com
markseymourphotography.co.uk
aberdeenartwalk.org
invela.dk
endstarvation.com
mbuildinghomes.com
kiraribeaute-nani.com
pokemonturkiye.com
deziplan.ru
foerderverein-vatterschule.de
jdscenter.com
yourcosmicbeing.com
dreamvoiceclub.org
kombi-dress.com
signededenroth.dk
mind2muscle.nl
activeterroristwarningcompany.com
billyoart.com
a-zpaperwork.eu
5thactors.com
stoneridgemontessori.com
michaelfiegel.com
fta-media.com
thenalpa.com
utilisacteur.fr
smartmind.net
livelai.com
skidpiping.de
cuadc.org
signamedia.de
jalkapuu.net
levencovka.ru
photonag.com
four-ways.com
dayenne-styling.nl
rhino-storage.co.uk
newonestop.com
ncn.nl
jollity.hu
pays-saint-flour.fr
cookinn.nl
alabamaroofingllc.com
teethinadaydentalimplants.com
lumturo.academy
baita.ac
successcolony.com.ng
anchelor.com
secrets-clubs.co.uk
ahgarage.com
gbk-tp1.de
slideevents.be
speakaudible.com
rattanwarehouse.co.uk
frankgoll.com
makingmillionaires.net
queertube.net
schulz-moelln.de
clemenfoto.dk
stanleyqualitysystems.com
indiebizadvocates.org
skinkeeper.li
directique.com
duthler.nl
matthieupetel.fr
alltagsrassismus-entknoten.de
triplettabordeaux.fr
peppergreenfarmcatering.com.au
tesisatonarim.com
cesep2019.com
redctei.co
jobstomoveamerica.org
the3-week-diet.net
sbit.ag
parisschool.ru
eurethicsport.eu
focuskontur.com
linkbuilding.life
belinda.af
mediahub.co.nz
irizar.com
elitkeramika-shop.com.ua
beauty-traveller.com
domilivefurniture.com
walterman.es
perceptdecor.com
kartuindonesia.com
racefietsenblog.nl
der-stempelking.de
mrkluttz.com
phoenixcrane.com
sycamoregreenapts.com
solidhosting.nl
lookandseen.com
corporacionrr.com
louiedager.com
forextimes.ru
johnkoen.com
spartamovers.com
metcalfe.ca
chatterchatterchatter.com
eksperdanismanlik.com
skolaprome.eu
weddingceremonieswithtim.com
brisbaneosteopathic.com.au
yuanshenghotel.com
dinedrinkdetroit.com
dieetuniversiteit.nl
xn--80abehgab4ak0ddz.xn--p1ai
mondolandscapes.com
tatyanakopieva.ru
customroasts.com
production-stills.co.uk
condormobile.fr
eastgrinsteadwingchun.com
holocine.de
asiaartgallery.jp
sweetz.fr
tchernia-conseil.fr
dr-vita.de
rechtenplicht.be
pedmanson.com
myfbateam.com
piestar.com
unislaw-narty.pl
myplaywin3.com
ceocenters.com
galaniuklaw.com
martinipstudios.com
levelseven.be
billigeflybilletter.dk
brunoimmobilier.com
ideamode.com
lesyeuxbleus.net
9nar.com
projektparkiet.pl
cl0nazepamblog.com
hoteltantra.com
ayudaespiritualtamara.com
11.in.ua
digitale-elite.de
yourhappyevents.fr
beandrivingschool.com.au
onesynergyinternational.com
rishigangoly.com
ebible.co
framemyballs.com
johnsonweekly.com
greatofficespaces.net
fridakids.com
dibli.store
explora.nl
pvandambv.nl
flossmoordental.com
imagine-entertainment.com
iactechnologies.net
rvside.com
akcadagofis.com
theater-lueneburg.de
sprintcoach.com
centuryvisionglobal.com
lmmont.sk
coachpreneuracademy.com
tzn.nu
texanscan.org
bd2fly.com
envomask.com
alisodentalcare.com
metallbau-hartmann.eu
k-zubki.ru
alpesiberie.com
billscars.net
azloans.com
bendel-partner.de
albcleaner.fr
sellthewrightway.com
futurenetworking.com
goddardleadership.org
bundan.com
khtrx.com
antesacademy.it
cmascd.com
unboxtherapy.site
omnicademy.com
midwestschool.org
chris-anne.com
ronaldhendriks.nl
fysiotherapierijnmond.nl
floweringsun.org
stathmoulis.gr
catering.com
qandmmusiccenter.com
hutchstyle.co.uk
ivancacu.com
smartercashsystem.com
altocontatto.net
baptistdistinctives.org
matteoruzzaofficial.com
loysonbryan.com
noda.com.ua
rentingwell.com
andermattswisswatches.ch
universelle.fr
marcandy.com
lidkopingsnytt.nu
brownswoodblog.com
testitjavertailut.net
sharonalbrightdds.com
the-cupboard.co.uk
buerocenter-butzbach-werbemittel.de
hospitalitytrainingsolutions.co.uk
artvark.nl
ownidentity.com
oexebusiness.com
artcase.pl
lexced.com
itheroes.dk
proffteplo.com
baumfinancialservices.com
magnetvisual.com
drbenveniste.com
web865.com
-
net
true
-
pid
19
-
prc
synctime
mydesktopqos
sqlwriter
mydesktopservice
ocomm
oracle
thebat
ocautoupds
firefoxconfig
mysqld
msaccess
winword
isqlplussvc
powerpnt
outlook
agntsvc
mysqld_nt
sqbcoreservice
encsvc
sqlservr
thebat64
infopath
onenote
thunderbird
wordpad
msftesql
ocssd
sqlagent
steam
mysqld_opt
mspub
dbeng50
xfssvccon
sqlbrowser
dbsnmp
visio
tbirdconfig
excel
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
100
-
svc
sql
svc$
sophos
veeam
mepocs
backup
vss
memtas
Extracted
C:\a3s619ci94-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/11048068BFDE144E
http://decryptor.top/11048068BFDE144E
Targets
-
-
Target
00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf
-
Size
204KB
-
MD5
7d7ee58c2696794b3be958b165eb61a9
-
SHA1
d24d3921aad182754f4ee5fa0ef13b2699d20108
-
SHA256
00b5940a6a449f17a7134c9e81b6615c5e1e2fa1eef4cf8b3952d8c6817980cf
-
SHA512
b04eec574166812a1c85b5abf0acb20c99eedab3d07ebbaf4dba2a4d5847c98f029f9f1671349899adb661bf17cc45f74b7dbde784c333127972ebb1ab488c27
-
Modifies system executable filetype association
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-