Static task
static1
Behavioral task
behavioral1
Sample
448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe
Resource
win10-en-20211208
General
-
Target
448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab
-
Size
179KB
-
MD5
a4f599b558815938a9eabaca693b0021
-
SHA1
4a0ef962e3b2b01eb07177a2778d0cd7c9352989
-
SHA256
448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab
-
SHA512
685ee2b6898432ed1c6429e680b8c34f578558ad42f08f0e07ffdf30d5de56a38d511245c9eb19d7a548d97ab64abcbf384e62a94433a205161bec3be0b48564
-
SSDEEP
3072:LNKQ4JTBg0Q8F63VETed7/kBazzFbULkdLjE8ztBhg5T:LNn4FQS63VE6F/M4qWL9f6T
Malware Config
Extracted
sodinokibi
19
29
wg-heiligenstadt.de
dentalcircle.com
framemyballs.com
schulz-moelln.de
linkbuilding.life
agriturismocastagneto.it
stabilisateur.fr
tchernia-conseil.fr
ikadomus.com
hepishopping.com
endlessrealms.net
ownidentity.com
dr-vita.de
medicalsupportco.com
aheadloftladders.co.uk
lumturo.academy
aoyama.ac
sharonalbrightdds.com
yuanshenghotel.com
gatlinburgcottage.com
hm-com.com
nuohous.com
dayenne-styling.nl
from02pro.com
pazarspor.org.tr
mneti.ru
lexced.com
rsidesigns.com
theatre-embellie.fr
hom-frisor.dk
daveystownhouse.com
chorusconsulting.net
jameswilliamspainting.com
breathebettertolivebetter.com
barbaramcfadyenjewelry.com
larchwoodmarketing.com
rozmata.com
xn--ziinoapte-6ld.ro
christopherhannan.com
billscars.net
eyedoctordallas.com
baikalflot.ru
acibademmobil.com.tr
mesajjongeren.nl
shrinkingplanet.com
laylavalentine.com
lovetzuchia.com
khtrx.com
logosindustries.com
skoczynski.eu
gazelle-du-web.com
loparnille.se
beauty-traveller.com
unexplored.gr
factoriareloj.com
encounter-p.net
peppergreenfarmcatering.com.au
bayshoreelite.com
eurethicsport.eu
triplettabordeaux.fr
irizar.com
goeppinger-teppichreinigung.de
amorbellezaysalud.com
oexebusiness.com
baita.ac
alene.co
myfbateam.com
vapiano.fr
direitapernambuco.com
futurenetworking.com
epicjapanart.com
putzen-reinigen.com
cops4causes.org
lovcase.com
mike.matthies.de
craftstone.co.nz
parksideseniorliving.net
cainlaw-okc.com
spacebel.be
skyboundnutrition.co.uk
citiscapes-art.com
haard-totaal.nl
vedsegaard.dk
racefietsenblog.nl
askstaffing.com
dogsunlimitedguide.com
chris-anne.com
pedmanson.com
lollachiro.com
cap29010.it
look.academy
operativadigital.com
luvinsburger.fr
janmorgenstern.com
masecologicos.com
heimdalbygg.no
hostaletdelsindians.es
signededenroth.dk
loysonbryan.com
glende-pflanzenparadies.de
tecleados.com
omnicademy.com
sochi-okna23.ru
ncn.nl
advesa.com
vvego.com
buzzneakers.com
maxcube24.com.ua
eventosvirtualesexitosos.com
buerocenter-butzbach-werbemittel.de
johnsonweekly.com
greenrider.nl
mediabolmong.com
campusescalade.com
biketruck.de
the5thquestion.com
welovecustomers.fr
deduktia.fi
advancedeyecare.com
gosouldeep.com
smartworkplaza.com
site.markkit.com.br
mariamalmahdi.com
agora-collectivites.com
dreamvoiceclub.org
slideevents.be
photographycreativity.co.uk
devus.de
unislaw-narty.pl
ilveshistoria.com
kuriero.pro
rhino-turf.com
cmeow.com
indiebizadvocates.org
leatherjees.com
andermattswisswatches.ch
narca.net
clinic-beethovenstrasse-ag.ch
arthakapitalforvaltning.dk
metriplica.academy
1deals.com
littlesaints.academy
glennverschueren.be
fire-space.com
onlinemarketingsurgery.co.uk
hostastay.com
pixelhealth.net
bagaholics.in
the-beauty-guides.com
globalcompliancenews.com
tellthebell.website
hameghlim.com
jaaphoekzema.nl
brunoimmobilier.com
innovationgames-brabant.nl
malzomattalar.com
kombi-dress.com
rokthetalk.com
amelielecompte.wordpress.com
campinglaforetdetesse.com
modamarfil.com
endstarvation.com
kroophold-sjaelland.dk
kvetymichalovce.sk
kartuindonesia.com
b3b.ch
lmmont.sk
secrets-clubs.co.uk
spectamarketingdigital.com.br
gta-jjb.fr
napisat-pismo-gubernatoru.ru:443
adaduga.info
annida.it
moira-cristescu.com
fixx-repair.com
richardiv.com
metallbau-hartmann.eu
alattekniksipil.com
billyoart.com
beandrivingschool.com.au
galatee-couture.com
yourhappyevents.fr
michaelfiegel.com
benchbiz.com
manzel.tn
rentingwell.com
pajagus.fr
dennisverschuur.com
schluesseldienste-hannover.de
ketomealprep.academy
powershell.su
bubbalucious.com
mangimirossana.it
blucamp.com
alnectus.com
rattanwarehouse.co.uk
angeleyezstripclub.com
switch-made.com
victorvictoria.com
lidkopingsnytt.nu
jag.me
tradenavigator.ch
profibersan.com
dibli.store
banksrl.co.za
domaine-des-pothiers.com
margaretmcshane.com
brisbaneosteopathic.com.au
toranjtuition.org
landgoedspica.nl
springfieldplumbermo.com
mjk.digital
bd2fly.com
bluelakevision.com
scentedlair.com
fann.ru
a-zpaperwork.eu
sveneulberg.de
hawaiisteelbuilding.com
thepixelfairy.com
web865.com
centuryvisionglobal.com
adabible.org
michal-s.co.il
makingmillionaires.net
keyboardjournal.com
glas-kuck.de
solutionshosting.co.uk
duthler.nl
pisofare.co
groovedealers.ru
stage-infirmier.fr
promus.ca
initconf.com
fitnessblenderstory.com
hotjapaneselesbian.com
smartspeak.com
wirmuessenreden.com
ivancacu.com
stanleyqualitysystems.com
burg-zelem.de
watchsale.biz
leansupremegarcinia.net
holocine.de
pankiss.ru
zaczytana.com
noda.com.ua
achetrabalhos.com
avisioninthedesert.com
relevantonline.eu
goddardleadership.org
kausette.com
alcye.com
dnqa.co.uk
latableacrepes-meaux.fr
signamedia.de
90nguyentuan.com
nrgvalue.com
witraz.pl
bulyginnikitav.000webhostapp.com
jdscenter.com
the-cupboard.co.uk
axisoflove.org:443
vitoriaecoturismo.com.br
tzn.nu
bridalcave.com
apmollerpension.com
trevi-vl.ru
newonestop.com
studionumerik.fr
iron-mine.ru
the3-week-diet.net
frameshift.it
azloans.com
bg.szczecin.pl
auto-opel.ro
nourella.com
chatberlin.de
ideamode.com
envomask.com
wordpress.idium.no
designimage.ae
fi-institutionalfunds.com
nbva.co.uk
richardkershawwines.co.za
innervisions-id.com
mgimalta.com
rechtenplicht.be
kenmccallum.com
shortysspices.com
wineandgo.hu
thegrinningmanmusical.com
louiedager.com
speakaudible.com
iactechnologies.net
descargandoprogramas.com
ruggestar.ch
mollymccarthydesign.com
brighthillgroup.com
creohn.de
opticahubertruiz.com
comoserescritor.com
hospitalitytrainingsolutions.co.uk
heuvelland-oaze.nl
chomiksy.net
curtsdiscountguns.com
jeanmonti.com
bonitabeachassociation.com
terraflair.de
leadforensics.com
silverbird.dk
aslog.fr
leijstrom.com
biodentify.ai
sambaglow.com
techybash.com
avis.mantova.it
yayasanprimaunggul.org
muller.nl
carsten.sparen-it.de
dieetuniversiteit.nl
carmel-york.com
mursall.de
n-newmedia.de
carolynfriedlander.com
afbudsrejserallinclusive.dk
kryptos72.com
veggienessa.com
kiraribeaute-nani.com
rubyaudiology.com
schlagbohrmaschinetests.com
koncept-m.ru
brannbornfastigheter.se
mind2muscle.nl
alharsunindo.com
riffenmattgarage.ch
tilldeeke.de
tweedekansenloket.nl
soncini.ch
bookingwheel.com
protoplay.ca
universelle.fr
dentourage.com
legundschiess.de
kerstliedjeszingen.nl
parisschool.ru
mac-computer-support-hamburg.de
thestudio.academy
licensed-public-adjuster.com
fotoslubna.com
mondolandscapes.com
fidelitytitleoregon.com
kelsigordon.com
unboxtherapy.site
hotelturbo.de
hutchstyle.co.uk
livelai.com
rossomattonecase.it
nykfdyrehospital.dk
klapanvent.ru
weddingceremonieswithtim.com
billigeflybilletter.dk
artcase.pl
thisprettyhair.com
photonag.com
artvark.nl
pinthelook.com
magnetvisual.com
elitkeramika-shop.com.ua
frimec-international.es
ocduiblog.com
theboardroomafrica.com
hnkns.com
alaskaremote.com
monstarrsoccer.com
computer-place.de
mercadodelrio.com
goodherbalhealth.com
bertbutter.nl
natturestaurante.com.br
rishigangoly.com
hartofurniture.com
prodentalblue.com
aktivfriskcenter.se
rvside.com
pvandambv.nl
ikzoekgod.be
espaciopolitica.com
coachpreneuracademy.com
saint-malo-developpement.fr
imaginekithomes.co.nz
tatyanakopieva.ru
kdbrh.com
banukumbak.com
sachainchiuk.com
tutvracks.com
birthplacemag.com
ncjc.ca
eos-horlogerie.com
aquacheck.co.za
m2graph.fr
raeoflightmusic.com
so-sage.fr
stringnosis.academy
efficiencyconsulting.es
asiaartgallery.jp
solidhosting.nl
apogeeconseils.fr
jobscore.com
happylublog.wordpress.com
perfectgrin.com
oportowebdesign.com
electricianul.com
bringmehope.org
limounie.com
mediogiro.com.ar
avtoboss163.ru:443
eksperdanismanlik.com
proffteplo.com
forextimes.ru
catalyseurdetransformation.com
slotenmakerszwijndrecht.nl
greatofficespaces.net
dinecorp.com
handyman-silkeborg.dk
clemenfoto.dk
datatri.be
insane.agency
cac2040.com
ahgarage.com
marmarabasin.com
expohomes.com
charlesfrancis.photos
bakingismyyoga.com
premiumweb.com.ua:443
skooppi.fi
concontactodirecto.com
projektparkiet.pl
jglconsultancy.com
olry-cloisons.fr
girlish.ae
strauchs-wanderlust.info
advanced-removals.co.uk
agendatwentytwenty.com
nauticmarine.dk
keuken-prijs.nl
bourchier.org
jonnyhooley.com
gardenpartner.pl
qrs-international.com
triavlete.com
animalfood-online.de
business-basic.de
akwaba-safaris.com
elliemaccreative.wordpress.com
kafkacare.com
ceocenters.com
salonlamar.nl
eafx.pro
grafikstudio-visuell.de
purepreprod4.com
penumbuhrambutkeiskei.com
physio-lang.de
mundo-pieces-auto.fr
cesep2019.com
motocrossplace.co.uk
fascaonline.com
pro-gamer.pl
internalresults.com
precisetemp.com
nicksrock.com
g2mediainc.com
therapybusinessacademy.com
arazi.eus
primemarineengineering.com
xn--80abehgab4ak0ddz.xn--p1ai
vipcarrental.ae
bluemarinefoundation.com
sprintcoach.com
parseport.com
blueridgeheritage.com
cardsandloyalty.com
skyscanner.ro
karelinjames.com
angelsmirrorus.com
lashandbrowenvy.com
ykobbqchicken.ca
walterman.es
voice2biz.com
pourlabretagne.bzh
antesacademy.it
cotton-avenue.co.il
apiarista.de
cc-experts.de
craftron.com
alisodentalcare.com
astrographic.com
phukienbepthanhdat.com
mayprogulka.ru
nepressurecleaning.com
profiz.com
ox-home.com
pharmeko-group.com
digitale-elite.de
zorgboerderijravensbosch.nl
ddmgen.com
gbk-tp1.de
sunsolutions.es
wademurray.com
rapid5kloan.org
etgdogz.de
circlecitydj.com
druktemakersheerenveen.nl
acb-gruppe.ch
happycatering.de
ziliak.com
specialtyhomeservicesllc.com
skolaprome.eu
krishnabrawijaya.com
min-virksomhed.dk
metcalfe.ca
andreaskildegaard.dk
wrinstitute.org
drnelsonpediatrics.com
activeterroristwarningcompany.com
mariannelemenestrel.com
bcabattoirs.org
chainofhopeeurope.eu
mensemetgesigte.co.za
lassocrm.com
collegetennis.info
ingresosextras.online
verbouwingsdouche.nl
diverfiestas.com.es
spartamovers.com
sycamoregreenapts.com
flossmoordental.com
mikegoodfellow.co.uk
baumfinancialservices.com
prometeyagro.com.ua
professionetata.com
parentsandkids.com
grupoexin10.com
biblica.com
skinkeeper.li
matthieupetel.fr
mamajenedesigns.com
cincinnatiphotocompany.org
iexpert99.com
osn.ro
gaearoyals.com
brinkdoepke.eu
craftingalegacy.com
easydental.ae
katherinealy.com
angelika-schwarz.com
eastgrinsteadwingchun.com
oro.ae
ced-elec.com
belofloripa.be
pinkxgayvideoawards.com
jobstomoveamerica.org
patriotcleaning.net
berdonllp.com
cp-bap.de
dierenambulancealkmaar.nl
vitormmcosta.com
ygallerysalonsoho.com:443
adedesign.com
mahikuchen.com
pureelements.nl
fazagostar.co
pansionatblago.ru
abulanov.com
der-stempelking.de
boloria.de
log-barn.co.uk
limmortelyouth.com
taulunkartano.fi
alabamaroofingllc.com
tages-geldvergleich.de
lapponiasafaris.com
fluzfluzrewards.com
poems-for-the-soul.ch
rentsportsequip.com
bcmets.info
5pointpt.com
interlinkone.com
alwaysdc.com
forumsittard.nl
suitesartemis.gr
dantreranch.com
awaitspain.com
fbmagazine.ru
onlinetvgroup.com
belinda.af
christianscholz.de
testitjavertailut.net
jandhpest.com
radishallgood.com
grancanariaregional.com
haus-landliebe.de
catchup-mag.com
wallflowersandrakes.com
diakonie-weitramsdorf-sesslach.de
martinipstudios.com
midwestschool.org
c-sprop.com
zdrowieszczecin.pl
subquercy.fr
inewsstar.com
11.in.ua
line-x.co.uk
hvitfeldt.dk
ronaldhendriks.nl
denverwynkoopdentist.com
startuplive.org
rs-danmark.dk
lunoluno.com
selected-minds.de
oraweb.net
akcadagofis.com
palmecophilippines.com
traitware.com
santastoy.store
111firstdelray.com
drvoip.com
thesilkroadny.com
production-stills.co.uk
stralsund-ansichten.de
georgemuncey.com
rivermusic.nl
zuerich-umzug.ch
piestar.com
leloupblanc.gr
aberdeenartwalk.org
nieuwsindeklas.be
zealcon.ae
liverpoolabudhabi.ae
redpebblephotography.com
bellesiniacademy.org
innersurrection.com
successcolony.com.ng
devplus.be
oncarrot.com
drbrianhweeks.com
utilisacteur.fr
ledyoucan.com
letterscan.de
finnergo.eu
yvesdoin-aquarelles.fr
publicompserver.de
kookooo.com
rtc24.com
azerbaycanas.com
perceptdecor.com
rarefoods.ro
bendel-partner.de
yournextshoes.com
lsngroupe.com
wyreforest.net
karmeliterviertel.com
circuit-diagramz.com
cuadc.org
chatterchatterchatter.com
cormanmarketing.com
airserviceunlimited.com
ebible.co
oththukaruva.com
boomerslivinglively.com
cyberpromote.de
paardcentraal.nl
deziplan.ru
dcc-eu.com
tbalp.co.uk
directique.com
hostingbangladesh.net
arearugcleaningnyc.com
blavait.fr
tastevirginia.com
casinodepositors.com
advance-refle.com
fta-media.com
kamin-somnium.de
cl0nazepamblog.com
aciscomputers.com
whoopingcrane.com
myplaywin3.com
aidanpublishing.co.uk
mazift.dk
pubcon.com
spirello.nl
9nar.com
cxcompany.com
bajova.sk
scotlandsroute66.co.uk
betterce.com
tieronechic.com
thehovecounsellingpractice.co.uk
kemtron.fr
vdolg24.online
k-v-f.de
maryairbnb.wordpress.com
trainiumacademy.com
enews-qca.com
evsynthacademy.org
bodymindchallenger.com
airvapourbarrier.com
kickittickets.com
mustangmarketinggroup.com
condormobile.fr
nginx.com
geoweb.software
3daywebs.com
stitch-n-bitch.com
altocontatto.net
wribrazil.com
hypogenforensic.com
bavovrienden.nl
redctei.co
domilivefurniture.com
ravage-webzine.nl
leopoldineroux.com
anchelor.com
hawthornsretirement.co.uk
randyabrown.com
valiant-voice.com
jimprattmediations.com
affligemsehondenschool.be
ijsselbeton.nl
outstandingminialbums.com
global-migrate.com
paradigmlandscape.com
mslp.org
teutoradio.de
lifeinbreaths.com
hensleymarketing.com
alexwenzel.de
mrkluttz.com
fotoeditores.com
molinum.pt
uncensoredhentaigif.com
levelseven.be
denhaagfoodie.nl
corporacionrr.com
tanatek.com
motocrosshideout.com
naukaip.ru
bychowo.pl
forskolinslimeffect.net
pays-saint-flour.fr
rino-gmbh.com
frankgoll.com
crestgood.com
rolleepollee.com
bohrlochversicherung.info
awaisghauri.com
hinotruckwreckers.com.au
csaballoons.com
letsstopsmoking.co.uk
tramadolhealth.com
pxsrl.it
omegamarbella.com
cleanroomequipment.ie
amyandzac.com
sweetz.fr
topvijesti.net
allinonecampaign.com
sellthewrightway.com
baptistdistinctives.org
teamsegeln.ch
ayudaespiritualtamara.com
peninggibadan.co.id
supercarhire.co.uk
foerderverein-vatterschule.de
neonodi.be
miscbo.it
martha-frets-ceramics.nl
saberconcrete.com
guohedd.com
four-ways.com
netadultere.fr
volta.plus
memphishealthandwellness.com
premier-iowa.com
scietech.academy
sber-biznes.com
goodboyscustom.com
triplettagaite.fr
metroton.ru
egpu.fr
agenceassemble.fr
hekecrm.com
adterium.com
eatyoveges.com
zinnystar.com
pokemonturkiye.com
p-ride.live
block-optic.com
soundseeing.net
awag-blog.de
brownswoodblog.com
rizplakatjaya.com
jefersonalessandro.com
cmascd.com
sshomme.com
sololibrerie.it
bluetenreich-brilon.de
justaroundthecornerpetsit.com
saboboxtel.uk
ya-elka.ru
dmlcpa.com
lagschools.ng
lesyeuxbleus.net
factorywizuk.com
campusce.com
cssp-mediation.org
catering.com
bilius.dk
customroasts.com
nexstagefinancial.com
levencovka.ru
distrifresh.com
johnstonmingmanning.com
buonabitare.com
animation-pro.co.uk
broccolisoep.nl
agencewho-aixenprovence.fr
reizenmetkinderen.be
slotspinner.com
internestdigital.com
housesofwa.com
julielusktherapy.com
ufovidmag.com
latteswithleslie.com
webforsites.com
sbit.ag
imajyuku-sozoku.com
singletonfinancial.com
anleggsregisteret.no
davedavisphotos.com
aceroprime.com
bumbipdeco.site
gurutechnologies.net
claudiakilian.de
jlwilsonbooks.com
xtensifi.com
altitudeboise.com
molade.nl
mindsparkescape.com
mrcar.nl
dinedrinkdetroit.com
explora.nl
liepertgrafikweb.at
subyard.com
kryddersnapsen.dk
juergenblaetz.de
bruut.online
charlottelhanna.com
jayfurnitureco.com
janasfokus.com
ultimatelifesource.com
reputation-medical.online
transifer.fr
albcleaner.fr
polynine.com
augen-praxisklinik-rostock.de
nationnewsroom.com
bratek-immobilien.de
opt4cdi.com
harleystreetspineclinic.com
fanuli.com.au
ninjaki.com
topautoinsurers.net
oscommunity.de
worldproskitour.com
mieleshopping.it
fsbforsale.com
lattalvor.com
ilovefullcircle.com
werkzeugtrolley.net
atma.nl
test-teleachat.fr
auberives-sur-vareze.fr
ramirezprono.com
voetbalhoogeveen.nl
arabianmice.com
paprikapod.com
smarttourism.academy
shortsalemap.com
turing.academy
rhino-storage.co.uk
theater-lueneburg.de
luvbec.com
buffdaddyblog.com
zwemofficial.nl
epsondriversforwindows.com
xrresources.com
skidpiping.de
qandmmusiccenter.com
cascinarosa33.it
docarefoundation.org
theintellect.edu.pk
jacquesgarcianoto.com
malevannye.ru
atelierkomon.com
bundan.com
onesynergyinternational.com
johnkoen.com
placermonticello.com
kompresory-opravy.com
qwikcoach.com
markseymourphotography.co.uk
sarahspics.co.uk
sytzedevries.com
liveyourheartout.co
fskhjalmar.se
2020hindsight.info
jlgraphisme.fr
linearete.com
smartmind.net
stagefxinc.com
acornishstudio.co.uk
laaisterplakky.nl
jollity.hu
wasnederland.nl
magrinya.net
phoenixcrane.com
donau-guides.eu
focuskontur.com
alltagsrassismus-entknoten.de
graygreenbiomedservices.com
satoblog.org
ntinasfiloxenia.gr
plbinsurance.com
matteoruzzaofficial.com
funworx.de
teethinadaydentalimplants.com
ronielyn.com
thegetawaycollective.com
stressreliefadvice.com
stoneridgemontessori.com
mariajosediazdemera.com
bescomedical.de
geitoniatonaggelon.gr
xn--billigafrgpatroner-stb.se
lisa-poncon.fr
palema.gr
queertube.net
babysitting-hk.helpergo.co
lgiwines.com
basindentistry.com
nevadaruralhousingstudies.org
jobkiwi.com.ng
jmmartinezilustrador.com
fla.se
texanscan.org
renderbox.ch
tothebackofthemoon.com
uci-france.fr
o90.dk
muni.pe
boyfriendsgoal.site
bodet150ans.com
neolaiamedispa.com
orchardbrickwork.com
globalskills.pt
itheroes.dk
colored-shelves.com
nxtstg.org
almamidwifery.com
invela.dk
annenymus.com
eshop.design
jakubrybak.com
kristianboennelykke.dk
galaniuklaw.com
mediahub.co.nz
silkeight.com
enactusnhlstenden.com
quitescorting.com
cymru.futbol
lookandseen.com
thiagoperez.com
tetameble.pl
tesisatonarim.com
finsahome.co.uk
otpusk.zp.ua
smartercashsystem.com
hiddensee-buhne11.de
nvisionsigns.com
greeneyetattoo.com
morgansconsult.com
nepal-pictures.com
floweringsun.org
hoteltantra.com
sjtpo.org
5thactors.com
scholarquotes.com
nalliasmali.net
sealgrinderpt.com
jax-interim-and-projectmanagement.com
autoteamlast.de
gratiocafeblog.wordpress.com
palmenhaus-erfurt.de
gavelmasters.com
mindfuelers.com
speiserei-hannover.de
kellengatton.com
go.labibini.ch
fridakids.com
golfclublandgoednieuwkerk.nl
breakluckrecords.com
furland.ru
energosbit-rp.ru
sppdstats.com
delegationhub.com
ludoil.it
chinowarehousespace.com
cookinn.nl
towelroot.co
mazzaropi.com.br
xn--80addfr4ahr.dp.ua
rename.kz
janellrardon.com
istantidigitali.com
edrickennedymacfoy.com
husetsanitas.dk
bmw-i-pure-impulse.com
marcandy.com
atrgroup.it
mbuildinghomes.com
jalkapuu.net
zumrutkuyutemel.com
alpesiberie.com
optigas.com
stathmoulis.gr
suonenjoen.fi
fysiotherapierijnmond.nl
edvestors.org
acumenconsultingcompany.com
dentallabor-luenen.de
agrifarm.dk
renehartman.nl
trivselsguide.dk
humanviruses.org
ciga-france.fr
andrealuchesi.it
richardmaybury.co.uk
entdoctor-durban.com
nutriwell.com.sg
kosten-vochtbestrijding.be
yourcosmicbeing.com
k-zubki.ru
gsconcretecoatings.com
bjornvanvulpen.nl
die-immo-agentur.de
citydogslife.com
reygroup.pt
t3brothers.com
imagine-entertainment.com
mrmac.com
livedeveloper.com
elex.is
patassociation.com
o2o-academy.com
amco.net.au
thenalpa.com
schroederschoembs.com
simpleitsolutions.ch
pilotgreen.com
lyricalduniya.com
drbenveniste.com
-
net
true
-
pid
19
-
prc
visio
mydesktopservice
synctime
thebat64
isqlplussvc
dbsnmp
thunderbird
onenote
mspub
thebat
agntsvc
steam
xfssvccon
ocssd
mydesktopqos
sqlbrowser
ocautoupds
tbirdconfig
ocomm
msaccess
sqlwriter
wordpad
mysqld
dbeng50
excel
mysqld_opt
msftesql
infopath
sqlservr
sqlagent
firefoxconfig
powerpnt
mysqld_nt
winword
sqbcoreservice
outlook
encsvc
oracle
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
29
-
svc
sophos
veeam
backup
vss
sql
svc$
mepocs
memtas
Signatures
-
Sodinokibi family
-
Sodinokibi/Revil sample 1 IoCs
Processes:
resource yara_rule sample family_sodinokobi
Files
-
448931d68d6614de83899a8f15f504af8f65f3a9543c74dcb8601fca7c6dffab.exe windows x86
9014e39262404e977fd8e4e75cce30e6
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
EnterCriticalSection
LeaveCriticalSection
SetErrorMode
GetStdHandle
CreateFileW
WriteFile
OutputDebugStringW
QueryPerformanceCounter
QueryPerformanceFrequency
HeapAlloc
HeapFree
GetProcessHeap
InitializeCriticalSection
DeleteCriticalSection
ExitProcess
GetCurrentThread
GetProcAddress
SetThreadAffinityMask
lstrlenW
LoadLibraryA
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
WriteConsoleW
IsProcessorFeaturePresent
Sections
.text Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 57KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.kmh Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ