General
-
Target
064b5a8a6527e9b7b857c78417c9701ccab7f6fd0cfcc367aa73a98a91e1f6a2
-
Size
199KB
-
Sample
220124-c3gaeaaeek
-
MD5
81da022977dec2624184697c779c0318
-
SHA1
e6591a63f5466d721e3227e05ae7fb5e726b81f8
-
SHA256
064b5a8a6527e9b7b857c78417c9701ccab7f6fd0cfcc367aa73a98a91e1f6a2
-
SHA512
f63b0b04c6a5e01b92172a7ffe37b29ee537e620c67bfeba6cb270950288b80a557e5fcb9e5cd0dda78241cc75b61a66396d6b8d7d3cf163991b547990c893ab
Static task
static1
Behavioral task
behavioral1
Sample
064b5a8a6527e9b7b857c78417c9701ccab7f6fd0cfcc367aa73a98a91e1f6a2.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
064b5a8a6527e9b7b857c78417c9701ccab7f6fd0cfcc367aa73a98a91e1f6a2.exe
Resource
win10-en-20211208
Malware Config
Extracted
C:\1mu4v19ta7-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8DD156D589223FF0
http://decryptor.top/8DD156D589223FF0
Extracted
sodinokibi
19
96
vitormmcosta.com
allinonecampaign.com
edvestors.org
haard-totaal.nl
stabilisateur.fr
anleggsregisteret.no
ufovidmag.com
oraweb.net
oththukaruva.com
acumenconsultingcompany.com
xn--billigafrgpatroner-stb.se
glennverschueren.be
subquercy.fr
leadforensics.com
devplus.be
silkeight.com
bluetenreich-brilon.de
askstaffing.com
hutchstyle.co.uk
netadultere.fr
autoteamlast.de
broccolisoep.nl
baumfinancialservices.com
qandmmusiccenter.com
ijsselbeton.nl
astrographic.com
charlottelhanna.com
awag-blog.de
cl0nazepamblog.com
csaballoons.com
sochi-okna23.ru
hostastay.com
skyscanner.ro
mursall.de
orchardbrickwork.com
shortysspices.com
latteswithleslie.com
rentsportsequip.com
ravage-webzine.nl
bayshoreelite.com
dentourage.com
thenalpa.com
hawaiisteelbuilding.com
ocduiblog.com
landgoedspica.nl
opt4cdi.com
onlinemarketingsurgery.co.uk
alpesiberie.com
mac-computer-support-hamburg.de
fysiotherapierijnmond.nl
sunsolutions.es
redpebblephotography.com
optigas.com
lassocrm.com
cincinnatiphotocompany.org
scentedlair.com
catalyseurdetransformation.com
wirmuessenreden.com
tanatek.com
bookingwheel.com
mariannelemenestrel.com
kosten-vochtbestrijding.be
benchbiz.com
blavait.fr
mikegoodfellow.co.uk
mslp.org
leansupremegarcinia.net
aquacheck.co.za
lexced.com
cesep2019.com
laaisterplakky.nl
topvijesti.net
g2mediainc.com
bluemarinefoundation.com
gaearoyals.com
stoneridgemontessori.com
spectamarketingdigital.com.br
gurutechnologies.net
arazi.eus
bajova.sk
smartworkplaza.com
the-cupboard.co.uk
smartmind.net
angeleyezstripclub.com
bonitabeachassociation.com
stanleyqualitysystems.com
hotelturbo.de
drbrianhweeks.com
aceroprime.com
humanviruses.org
brownswoodblog.com
paprikapod.com
fotoeditores.com
the5thquestion.com
campusce.com
bcmets.info
goodherbalhealth.com
haus-landliebe.de
jefersonalessandro.com
lovcase.com
efficiencyconsulting.es
alaskaremote.com
ziliak.com
ya-elka.ru
stralsund-ansichten.de
solidhosting.nl
c-sprop.com
coachpreneuracademy.com
mieleshopping.it
nexstagefinancial.com
harleystreetspineclinic.com
daveystownhouse.com
banksrl.co.za
animation-pro.co.uk
pazarspor.org.tr
johnstonmingmanning.com
cardsandloyalty.com
operativadigital.com
initconf.com
andreaskildegaard.dk
christopherhannan.com
osn.ro
dogsunlimitedguide.com
thepixelfairy.com
scholarquotes.com
myplaywin3.com
eyedoctordallas.com
tchernia-conseil.fr
cac2040.com
katherinealy.com
jayfurnitureco.com
futurenetworking.com
greeneyetattoo.com
innervisions-id.com
line-x.co.uk
koncept-m.ru
cuadc.org
fridakids.com
richardiv.com
worldproskitour.com
linkbuilding.life
schulz-moelln.de
pinkxgayvideoawards.com
magnetvisual.com
tatyanakopieva.ru
nepal-pictures.com
mbuildinghomes.com
spacebel.be
bertbutter.nl
salonlamar.nl
bcabattoirs.org
markseymourphotography.co.uk
prodentalblue.com
aberdeenartwalk.org
funworx.de
electricianul.com
buzzneakers.com
memphishealthandwellness.com
physio-lang.de
globalcompliancenews.com
gazelle-du-web.com
skooppi.fi
golfclublandgoednieuwkerk.nl
luvinsburger.fr
wordpress.idium.no
glende-pflanzenparadies.de
texanscan.org
peppergreenfarmcatering.com.au
alexwenzel.de
aktivfriskcenter.se
randyabrown.com
jax-interim-and-projectmanagement.com
campinglaforetdetesse.com
heuvelland-oaze.nl
kdbrh.com
agrifarm.dk
mazift.dk
rarefoods.ro
ledyoucan.com
cookinn.nl
blucamp.com
forskolinslimeffect.net
tecleados.com
singletonfinancial.com
matteoruzzaofficial.com
kafkacare.com
muller.nl
richardmaybury.co.uk
gatlinburgcottage.com
awaisghauri.com
mollymccarthydesign.com
teethinadaydentalimplants.com
hm-com.com
switch-made.com
lifeinbreaths.com
buonabitare.com
annida.it
tothebackofthemoon.com
julielusktherapy.com
santastoy.store
der-stempelking.de
vipcarrental.ae
dinecorp.com
bodet150ans.com
go.labibini.ch
qwikcoach.com
startuplive.org
georgemuncey.com
grafikstudio-visuell.de
modamarfil.com
rozmata.com
geoweb.software
cap29010.it
birthplacemag.com
edrickennedymacfoy.com
kamin-somnium.de
hostingbangladesh.net
mustangmarketinggroup.com
wyreforest.net
catchup-mag.com
palmenhaus-erfurt.de
skyboundnutrition.co.uk
dierenambulancealkmaar.nl
fskhjalmar.se
mrcar.nl
alabamaroofingllc.com
slideevents.be
altitudeboise.com
vitoriaecoturismo.com.br
goeppinger-teppichreinigung.de
lunoluno.com
jobstomoveamerica.org
profibersan.com
bridalcave.com
rsidesigns.com
animalfood-online.de
lookandseen.com
voice2biz.com
husetsanitas.dk
dentalcircle.com
auto-opel.ro
kausette.com
albcleaner.fr
sycamoregreenapts.com
ownidentity.com
thesilkroadny.com
boloria.de
sharonalbrightdds.com
bratek-immobilien.de
skidpiping.de
lovetzuchia.com
lmmont.sk
happycatering.de
biodentify.ai
theatre-embellie.fr
muni.pe
drbenveniste.com
eafx.pro
innovationgames-brabant.nl
bourchier.org
gta-jjb.fr
ramirezprono.com
paardcentraal.nl
gsconcretecoatings.com
triavlete.com
sellthewrightway.com
jdscenter.com
activeterroristwarningcompany.com
leopoldineroux.com
utilisacteur.fr
reygroup.pt
pourlabretagne.bzh
explora.nl
ilovefullcircle.com
techybash.com
parksideseniorliving.net
epicjapanart.com
rossomattonecase.it
ncjc.ca
pubcon.com
midwestschool.org
shortsalemap.com
pixelhealth.net
artcase.pl
successcolony.com.ng
silverbird.dk
yvesdoin-aquarelles.fr
logosindustries.com
iron-mine.ru
unexplored.gr
bg.szczecin.pl
zdrowieszczecin.pl
delegationhub.com
loysonbryan.com
buffdaddyblog.com
newonestop.com
stitch-n-bitch.com
outstandingminialbums.com
adaduga.info
dayenne-styling.nl
goddardleadership.org
circlecitydj.com
grancanariaregional.com
mondolandscapes.com
baikalflot.ru
bringmehope.org
towelroot.co
pays-saint-flour.fr
nrgvalue.com
mediogiro.com.ar
chatberlin.de
graygreenbiomedservices.com
publicompserver.de
placermonticello.com
altocontatto.net
insane.agency
wg-heiligenstadt.de
pureelements.nl
leatherjees.com
11.in.ua
otpusk.zp.ua
supercarhire.co.uk
b3b.ch
soundseeing.net
bilius.dk
brighthillgroup.com
k-zubki.ru
holocine.de
innersurrection.com
ikzoekgod.be
queertube.net
forumsittard.nl
voetbalhoogeveen.nl
specialtyhomeservicesllc.com
therapybusinessacademy.com
look.academy
concontactodirecto.com
studionumerik.fr
jandhpest.com
wallflowersandrakes.com
alattekniksipil.com
marcandy.com
smarttourism.academy
akcadagofis.com
frimec-international.es
t3brothers.com
satoblog.org
bumbipdeco.site
m2graph.fr
min-virksomhed.dk
legundschiess.de
azerbaycanas.com
domaine-des-pothiers.com
lgiwines.com
taulunkartano.fi
lumturo.academy
masecologicos.com
atrgroup.it
jeanmonti.com
itheroes.dk
mrkluttz.com
cyberpromote.de
photographycreativity.co.uk
bakingismyyoga.com
eastgrinsteadwingchun.com
patassociation.com
pokemonturkiye.com
toranjtuition.org
p-ride.live
craftstone.co.nz
from02pro.com
biketruck.de
soncini.ch
oro.ae
martinipstudios.com
citiscapes-art.com
hotjapaneselesbian.com
davedavisphotos.com
raeoflightmusic.com
sber-biznes.com
kelsigordon.com
eurethicsport.eu
rattanwarehouse.co.uk
levelseven.be
schlagbohrmaschinetests.com
myfbateam.com
solutionshosting.co.uk
espaciopolitica.com
letsstopsmoking.co.uk
carmel-york.com
pansionatblago.ru
molade.nl
gbk-tp1.de
n-newmedia.de
jimprattmediations.com
mneti.ru
polynine.com
happylublog.wordpress.com
creohn.de
dentallabor-luenen.de
jlwilsonbooks.com
topautoinsurers.net
shrinkingplanet.com
pxsrl.it
monstarrsoccer.com
cops4causes.org
pilotgreen.com
o2o-academy.com
johnsonweekly.com
5thactors.com
professionetata.com
smartspeak.com
frankgoll.com
schluesseldienste-hannover.de
gratiocafeblog.wordpress.com
kuriero.pro
yourhappyevents.fr
evsynthacademy.org
geitoniatonaggelon.gr
bd2fly.com
saberconcrete.com
slotspinner.com
parisschool.ru
klapanvent.ru
bellesiniacademy.org
web865.com
jobkiwi.com.ng
proffteplo.com
rizplakatjaya.com
richardkershawwines.co.za
ruggestar.ch
neolaiamedispa.com
nginx.com
quitescorting.com
rs-danmark.dk
welovecustomers.fr
omnicademy.com
90nguyentuan.com
banukumbak.com
agendatwentytwenty.com
groovedealers.ru
lesyeuxbleus.net
onlinetvgroup.com
cssp-mediation.org
aslog.fr
teutoradio.de
buerocenter-butzbach-werbemittel.de
webforsites.com
campusescalade.com
alltagsrassismus-entknoten.de
hoteltantra.com
tradenavigator.ch
rubyaudiology.com
rhino-storage.co.uk
domilivefurniture.com
agora-collectivites.com
imaginekithomes.co.nz
letterscan.de
reizenmetkinderen.be
ronielyn.com
poems-for-the-soul.ch
profiz.com
fann.ru
wribrazil.com
fsbforsale.com
handyman-silkeborg.dk
kickittickets.com
casinodepositors.com
ceocenters.com
nauticmarine.dk
leloupblanc.gr
framemyballs.com
lidkopingsnytt.nu
condormobile.fr
michaelfiegel.com
jglconsultancy.com
alwaysdc.com
mazzaropi.com.br
linearete.com
encounter-p.net
cymru.futbol
denverwynkoopdentist.com
forextimes.ru
descargandoprogramas.com
annenymus.com
manzel.tn
premiumweb.com.ua:443
penumbuhrambutkeiskei.com
larchwoodmarketing.com
stringnosis.academy
metcalfe.ca
die-immo-agentur.de
molinum.pt
skolaprome.eu
hnkns.com
bundan.com
theintellect.edu.pk
rentingwell.com
cc-experts.de
plbinsurance.com
iexpert99.com
martha-frets-ceramics.nl
arabianmice.com
carsten.sparen-it.de
chorusconsulting.net
finnergo.eu
alcye.com
invela.dk
rino-gmbh.com
chinowarehousespace.com
bendel-partner.de
limounie.com
lsngroupe.com
chris-anne.com
zinnystar.com
auberives-sur-vareze.fr
thehovecounsellingpractice.co.uk
zorgboerderijravensbosch.nl
hypogenforensic.com
angelsmirrorus.com
internalresults.com
tutvracks.com
unislaw-narty.pl
schroederschoembs.com
angelika-schwarz.com
mjk.digital
bescomedical.de
aoyama.ac
fla.se
malevannye.ru
biblica.com
eos-horlogerie.com
agencewho-aixenprovence.fr
fidelitytitleoregon.com
mensemetgesigte.co.za
matthieupetel.fr
endstarvation.com
barbaramcfadyenjewelry.com
enews-qca.com
hepishopping.com
apmollerpension.com
putzen-reinigen.com
almamidwifery.com
mahikuchen.com
circuit-diagramz.com
1deals.com
baita.ac
affligemsehondenschool.be
scietech.academy
cascinarosa33.it
yayasanprimaunggul.org
ilveshistoria.com
digitale-elite.de
lattalvor.com
factoriareloj.com
oncarrot.com
jacquesgarcianoto.com
morgansconsult.com
karmeliterviertel.com
kryddersnapsen.dk
juergenblaetz.de
kemtron.fr
spartamovers.com
mrmac.com
oportowebdesign.com
inewsstar.com
parseport.com
sprintcoach.com
energosbit-rp.ru
vvego.com
hvitfeldt.dk
sweetz.fr
janmorgenstern.com
stage-infirmier.fr
endlessrealms.net
zumrutkuyutemel.com
betterce.com
motocrosshideout.com
yuanshenghotel.com
thiagoperez.com
so-sage.fr
fascaonline.com
jalkapuu.net
miscbo.it
nuohous.com
tweedekansenloket.nl
internestdigital.com
avisioninthedesert.com
a-zpaperwork.eu
jollity.hu
hom-frisor.dk
vdolg24.online
the3-week-diet.net
selected-minds.de
computer-place.de
liveyourheartout.co
dantreranch.com
victorvictoria.com
tages-geldvergleich.de
alharsunindo.com
dcc-eu.com
thestudio.academy
nalliasmali.net
craftron.com
ayudaespiritualtamara.com
goodboyscustom.com
asiaartgallery.jp
strauchs-wanderlust.info
avtoboss163.ru:443
mariajosediazdemera.com
mamajenedesigns.com
hiddensee-buhne11.de
rtc24.com
3daywebs.com
k-v-f.de
simpleitsolutions.ch
pisofare.co
bubbalucious.com
boomerslivinglively.com
reputation-medical.online
signamedia.de
fluzfluzrewards.com
irizar.com
dnqa.co.uk
motocrossplace.co.uk
achetrabalhos.com
bmw-i-pure-impulse.com
nourella.com
trainiumacademy.com
colored-shelves.com
johnkoen.com
loparnille.se
dreamvoiceclub.org
rename.kz
wrinstitute.org
globalskills.pt
kiraribeaute-nani.com
designimage.ae
thegrinningmanmusical.com
the-beauty-guides.com
olry-cloisons.fr
suonenjoen.fi
nepressurecleaning.com
marmarabasin.com
perfectgrin.com
krishnabrawijaya.com
pvandambv.nl
tzn.nu
piestar.com
natturestaurante.com.br
brinkdoepke.eu
pinthelook.com
witraz.pl
leijstrom.com
uci-france.fr
turing.academy
azloans.com
racefietsenblog.nl
jlgraphisme.fr
jakubrybak.com
rivermusic.nl
jag.me
drvoip.com
galatee-couture.com
lisa-poncon.fr
elex.is
fanuli.com.au
yournextshoes.com
terraflair.de
weddingceremonieswithtim.com
zwemofficial.nl
sshomme.com
imagine-entertainment.com
sealgrinderpt.com
9nar.com
makingmillionaires.net
apiarista.de
metallbau-hartmann.eu
four-ways.com
mindfuelers.com
axisoflove.org:443
nieuwsindeklas.be
andermattswisswatches.ch
cxcompany.com
glas-kuck.de
adterium.com
arthakapitalforvaltning.dk
magrinya.net
wademurray.com
heimdalbygg.no
radishallgood.com
sveneulberg.de
janasfokus.com
afbudsrejserallinclusive.dk
antesacademy.it
paradigmlandscape.com
o90.dk
hensleymarketing.com
premier-iowa.com
billscars.net
renehartman.nl
louiedager.com
lagschools.ng
catering.com
beandrivingschool.com.au
iactechnologies.net
entdoctor-durban.com
narca.net
cp-bap.de
akwaba-safaris.com
trevi-vl.ru
alisodentalcare.com
belinda.af
bodymindchallenger.com
5pointpt.com
jmmartinezilustrador.com
nationnewsroom.com
spirello.nl
karelinjames.com
pankiss.ru
sppdstats.com
mindsparkescape.com
deduktia.fi
imajyuku-sozoku.com
universelle.fr
bohrlochversicherung.info
luvbec.com
collegetennis.info
kookooo.com
slotenmakerszwijndrecht.nl
projektparkiet.pl
secrets-clubs.co.uk
keyboardjournal.com
tastevirginia.com
eventosvirtualesexitosos.com
traitware.com
adedesign.com
ronaldhendriks.nl
directique.com
advance-refle.com
drnelsonpediatrics.com
jameswilliamspainting.com
peninggibadan.co.id
ddmgen.com
cotton-avenue.co.il
rishigangoly.com
rolleepollee.com
nicksrock.com
tesisatonarim.com
andrealuchesi.it
fixx-repair.com
dieetuniversiteit.nl
fire-space.com
ideamode.com
primemarineengineering.com
relevantonline.eu
easydental.ae
corporacionrr.com
beauty-traveller.com
guohedd.com
brunoimmobilier.com
curtsdiscountguns.com
opticahubertruiz.com
enactusnhlstenden.com
finsahome.co.uk
signededenroth.dk
epsondriversforwindows.com
kombi-dress.com
walterman.es
gavelmasters.com
rokthetalk.com
smartercashsystem.com
donau-guides.eu
levencovka.ru
ingresosextras.online
mediabolmong.com
atelierkomon.com
maxcube24.com.ua
bychowo.pl
zuerich-umzug.ch
elliemaccreative.wordpress.com
chomiksy.net
pharmeko-group.com
renderbox.ch
amelielecompte.wordpress.com
factorywizuk.com
kellengatton.com
napisat-pismo-gubernatoru.ru:443
vapiano.fr
amco.net.au
noda.com.ua
lapponiasafaris.com
anchelor.com
fta-media.com
amyandzac.com
wineandgo.hu
111firstdelray.com
wasnederland.nl
jonnyhooley.com
cmeow.com
foerderverein-vatterschule.de
ultimatelifesource.com
cleanroomequipment.ie
cmascd.com
2020hindsight.info
customroasts.com
acb-gruppe.ch
littlesaints.academy
ciga-france.fr
skoczynski.eu
nbva.co.uk
powershell.su
zaczytana.com
bagaholics.in
speakaudible.com
mundo-pieces-auto.fr
hartofurniture.com
watchsale.biz
sbit.ag
augen-praxisklinik-rostock.de
unboxtherapy.site
sytzedevries.com
promus.ca
frameshift.it
purepreprod4.com
ketomealprep.academy
tetameble.pl
airserviceunlimited.com
neonodi.be
bavovrienden.nl
dennisverschuur.com
business-basic.de
global-migrate.com
abulanov.com
duthler.nl
elitkeramika-shop.com.ua
photonag.com
mariamalmahdi.com
jaaphoekzema.nl
brannbornfastigheter.se
tellthebell.website
nxtstg.org
distrifresh.com
lollachiro.com
girlish.ae
thegetawaycollective.com
nevadaruralhousingstudies.org
clemenfoto.dk
kompresory-opravy.com
focuskontur.com
kartuindonesia.com
cormanmarketing.com
laylavalentine.com
tbalp.co.uk
volta.plus
tilldeeke.de
istantidigitali.com
xn--80abehgab4ak0ddz.xn--p1ai
xrresources.com
fazagostar.co
blueridgeheritage.com
scotlandsroute66.co.uk
ivancacu.com
xn--ziinoapte-6ld.ro
veggienessa.com
fitnessblenderstory.com
protoplay.ca
acibademmobil.com.tr
craftingalegacy.com
chatterchatterchatter.com
advancedeyecare.com
oexebusiness.com
furland.ru
bulyginnikitav.000webhostapp.com
boyfriendsgoal.site
licensed-public-adjuster.com
teamsegeln.ch
eatyoveges.com
rhino-turf.com
hawthornsretirement.co.uk
pajagus.fr
envomask.com
kvetymichalovce.sk
fotoslubna.com
triplettagaite.fr
sjtpo.org
mesajjongeren.nl
awaitspain.com
parentsandkids.com
liepertgrafikweb.at
etgdogz.de
vedsegaard.dk
billyoart.com
hameghlim.com
mercadodelrio.com
limmortelyouth.com
interlinkone.com
cainlaw-okc.com
housesofwa.com
grupoexin10.com
medicalsupportco.com
sarahspics.co.uk
margaretmcshane.com
charlesfrancis.photos
ikadomus.com
log-barn.co.uk
test-teleachat.fr
production-stills.co.uk
egpu.fr
greenrider.nl
docarefoundation.org
ludoil.it
pro-gamer.pl
mangimirossana.it
hospitalitytrainingsolutions.co.uk
mike.matthies.de
agenceassemble.fr
alnectus.com
uncensoredhentaigif.com
comoserescritor.com
flossmoordental.com
mayprogulka.ru
dr-vita.de
zealcon.ae
arearugcleaningnyc.com
alene.co
sambaglow.com
theboardroomafrica.com
floweringsun.org
nvisionsigns.com
metriplica.academy
rvside.com
ykobbqchicken.ca
diverfiestas.com.es
kerstliedjeszingen.nl
centuryvisionglobal.com
triplettabordeaux.fr
claudiakilian.de
sololibrerie.it
rapid5kloan.org
fi-institutionalfunds.com
theater-lueneburg.de
maryairbnb.wordpress.com
advesa.com
saint-malo-developpement.fr
saboboxtel.uk
denhaagfoodie.nl
latableacrepes-meaux.fr
datatri.be
hostaletdelsindians.es
justaroundthecornerpetsit.com
ced-elec.com
billigeflybilletter.dk
babysitting-hk.helpergo.co
lashandbrowenvy.com
suitesartemis.gr
phoenixcrane.com
avis.mantova.it
belofloripa.be
block-optic.com
direitapernambuco.com
ninjaki.com
redctei.co
lyricalduniya.com
palmecophilippines.com
rechtenplicht.be
diakonie-weitramsdorf-sesslach.de
kenmccallum.com
kroophold-sjaelland.dk
xtensifi.com
deziplan.ru
mind2muscle.nl
kristianboennelykke.dk
ahgarage.com
ox-home.com
khtrx.com
subyard.com
tramadolhealth.com
speiserei-hannover.de
riffenmattgarage.ch
pedmanson.com
precisetemp.com
prometeyagro.com.ua
gardenpartner.pl
skinkeeper.li
aidanpublishing.co.uk
dmlcpa.com
whoopingcrane.com
hinotruckwreckers.com.au
oscommunity.de
trivselsguide.dk
gosouldeep.com
ebible.co
druktemakersheerenveen.nl
apogeeconseils.fr
liverpoolabudhabi.ae
springfieldplumbermo.com
carolynfriedlander.com
advanced-removals.co.uk
breathebettertolivebetter.com
yourcosmicbeing.com
ntinasfiloxenia.gr
bluelakevision.com
omegamarbella.com
moira-cristescu.com
basindentistry.com
burg-zelem.de
expohomes.com
keuken-prijs.nl
metroton.ru
michal-s.co.il
site.markkit.com.br
amorbellezaysalud.com
onesynergyinternational.com
ncn.nl
naukaip.ru
qrs-international.com
nutriwell.com.sg
hekecrm.com
werkzeugtrolley.net
malzomattalar.com
aciscomputers.com
palema.gr
bjornvanvulpen.nl
ygallerysalonsoho.com:443
agriturismocastagneto.it
testitjavertailut.net
aheadloftladders.co.uk
eshop.design
valiant-voice.com
kryptos72.com
transifer.fr
jobscore.com
perceptdecor.com
stagefxinc.com
stressreliefadvice.com
crestgood.com
galaniuklaw.com
mgimalta.com
devus.de
verbouwingsdouche.nl
mediahub.co.nz
greatofficespaces.net
stathmoulis.gr
tieronechic.com
christianscholz.de
eksperdanismanlik.com
atma.nl
sachainchiuk.com
baptistdistinctives.org
dibli.store
livedeveloper.com
patriotcleaning.net
artvark.nl
fbmagazine.ru
berdonllp.com
janellrardon.com
livelai.com
breakluckrecords.com
airvapourbarrier.com
adabible.org
thisprettyhair.com
clinic-beethovenstrasse-ag.ch
dinedrinkdetroit.com
chainofhopeeurope.eu
indiebizadvocates.org
brisbaneosteopathic.com.au
acornishstudio.co.uk
bruut.online
citydogslife.com
nykfdyrehospital.dk
phukienbepthanhdat.com
xn--80addfr4ahr.dp.ua
-
net
true
-
pid
19
-
prc
firefoxconfig.exe
mysqld_opt.exe
thebat64.exe
powerpnt.exe
tbirdconfig.exe
msftesql.exe
mysqld.exe
sqlwriter.exe
infopath.exe
winword.exe
sqlbrowser.exe
sqlagent.exe
sqbcoreservice.exe
mspub.exe
onenote.exe
thebat.exe
visio.exe
mysqld_nt.exe
excel.exe
thunderbird.exe
encsvc.exe
mydesktopservice.exe
ocssd.exe
steam.exe
ocomm.exe
isqlplussvc.exe
dbsnmp.exe
synctime.exe
agntsvc.exe
mydesktopqos.exe
ocautoupds.exe
wordpad.exe
dbeng50.exe
outlook.exe
xfssvccon.exe
oracle.exe
sqlservr.exe
msaccess.exe
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
96
Extracted
C:\7c7nm6-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A9BF329183CAC3F1
http://decryptor.top/A9BF329183CAC3F1
Targets
-
-
Target
064b5a8a6527e9b7b857c78417c9701ccab7f6fd0cfcc367aa73a98a91e1f6a2
-
Size
199KB
-
MD5
81da022977dec2624184697c779c0318
-
SHA1
e6591a63f5466d721e3227e05ae7fb5e726b81f8
-
SHA256
064b5a8a6527e9b7b857c78417c9701ccab7f6fd0cfcc367aa73a98a91e1f6a2
-
SHA512
f63b0b04c6a5e01b92172a7ffe37b29ee537e620c67bfeba6cb270950288b80a557e5fcb9e5cd0dda78241cc75b61a66396d6b8d7d3cf163991b547990c893ab
-
Detect Neshta Payload
-
Modifies system executable filetype association
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Sodinokibi/Revil sample
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Loads dropped DLL
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-