General
-
Target
3a1e623cc176e93e48c85e974eb75dd3971197dbe5a0e993e4fb3c8a8be223b8
-
Size
204KB
-
Sample
220124-cp6cdaabh6
-
MD5
4c5e2f8984375cefa93776c3ecf1ad28
-
SHA1
ea6b2c9e2d332d5274b3cfc2440aaa65cb684870
-
SHA256
3a1e623cc176e93e48c85e974eb75dd3971197dbe5a0e993e4fb3c8a8be223b8
-
SHA512
f8b86f4489ca21553c2845d1f17cfb761efb603c85d9e90d2db2d20508125d7dfbaa0e562e4c525de4074da49aeca30a7811dab76e87318024dd63c519ed3c92
Static task
static1
Behavioral task
behavioral1
Sample
3a1e623cc176e93e48c85e974eb75dd3971197dbe5a0e993e4fb3c8a8be223b8.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
3a1e623cc176e93e48c85e974eb75dd3971197dbe5a0e993e4fb3c8a8be223b8.exe
Resource
win10-en-20211208
Malware Config
Extracted
C:\4t13809n-readme.txt
ryuk
https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/2F06CA16A6FA31AC
http://decryptor.top/2F06CA16A6FA31AC
Extracted
sodinokibi
43
1738
pxsrl.it
jimprattmediations.com
suitesartemis.gr
werkzeugtrolley.net
catering.com
hensleymarketing.com
smartspeak.com
customroasts.com
rename.kz
deziplan.ru
raeoflightmusic.com
skooppi.fi
singletonfinancial.com
b3b.ch
aoyama.ac
cc-experts.de
kombi-dress.com
collegetennis.info
mariajosediazdemera.com
tellthebell.website
amyandzac.com
mollymccarthydesign.com
hvitfeldt.dk
hm-com.com
noda.com.ua
forskolinslimeffect.net
fta-media.com
xn--80abehgab4ak0ddz.xn--p1ai
mjk.digital
skolaprome.eu
charlottelhanna.com
bratek-immobilien.de
go.labibini.ch
opticahubertruiz.com
encounter-p.net
paradigmlandscape.com
bajova.sk
nuohous.com
parentsandkids.com
slotspinner.com
alwaysdc.com
loparnille.se
bagaholics.in
zaczytana.com
irizar.com
sshomme.com
gta-jjb.fr
motocrosshideout.com
jag.me
agriturismocastagneto.it
volta.plus
buerocenter-butzbach-werbemittel.de
cyberpromote.de
rentingwell.com
lgiwines.com
claudiakilian.de
directique.com
jobstomoveamerica.org
devus.de
therapybusinessacademy.com
mercadodelrio.com
christopherhannan.com
utilisacteur.fr
queertube.net
quitescorting.com
jdscenter.com
brisbaneosteopathic.com.au
oscommunity.de
sjtpo.org
peninggibadan.co.id
modamarfil.com
gratiocafeblog.wordpress.com
andreaskildegaard.dk
endlessrealms.net
unislaw-narty.pl
yournextshoes.com
mayprogulka.ru
reizenmetkinderen.be
solutionshosting.co.uk
greenrider.nl
craftingalegacy.com
leatherjees.com
aheadloftladders.co.uk
heimdalbygg.no
richardmaybury.co.uk
dr-vita.de
sellthewrightway.com
janellrardon.com
stralsund-ansichten.de
karelinjames.com
limmortelyouth.com
neonodi.be
sambaglow.com
veggienessa.com
theatre-embellie.fr
wademurray.com
ykobbqchicken.ca
amorbellezaysalud.com
bridalcave.com
adaduga.info
tilldeeke.de
goddardleadership.org
renderbox.ch
dmlcpa.com
jax-interim-and-projectmanagement.com
metcalfe.ca
direitapernambuco.com
katherinealy.com
advancedeyecare.com
whoopingcrane.com
fridakids.com
betterce.com
billigeflybilletter.dk
netadultere.fr
grancanariaregional.com
fysiotherapierijnmond.nl
itheroes.dk
jonnyhooley.com
designimage.ae
hawthornsretirement.co.uk
gosouldeep.com
babysitting-hk.helpergo.co
istantidigitali.com
cl0nazepamblog.com
greatofficespaces.net
napisat-pismo-gubernatoru.ru:443
levencovka.ru
pazarspor.org.tr
mediahub.co.nz
barbaramcfadyenjewelry.com
furland.ru
skidpiping.de
apogeeconseils.fr
pankiss.ru
focuskontur.com
centuryvisionglobal.com
gatlinburgcottage.com
csaballoons.com
the-cupboard.co.uk
rarefoods.ro
fla.se
sweetz.fr
pvandambv.nl
fsbforsale.com
kartuindonesia.com
thesilkroadny.com
vdolg24.online
deduktia.fi
midwestschool.org
hostastay.com
sbit.ag
cainlaw-okc.com
myfbateam.com
liveyourheartout.co
iron-mine.ru
baumfinancialservices.com
glas-kuck.de
dentalcircle.com
antesacademy.it
kamin-somnium.de
sveneulberg.de
pays-saint-flour.fr
wyreforest.net
imajyuku-sozoku.com
worldproskitour.com
ddmgen.com
kenmccallum.com
5pointpt.com
baptistdistinctives.org
palmenhaus-erfurt.de
naukaip.ru
awag-blog.de
pedmanson.com
pharmeko-group.com
tradenavigator.ch
narca.net
rizplakatjaya.com
yourhappyevents.fr
xn--80addfr4ahr.dp.ua
devplus.be
onlinetvgroup.com
sharonalbrightdds.com
ultimatelifesource.com
placermonticello.com
initconf.com
sytzedevries.com
ya-elka.ru
thegetawaycollective.com
floweringsun.org
ruggestar.ch
bruut.online
mieleshopping.it
tanatek.com
campinglaforetdetesse.com
broccolisoep.nl
skyscanner.ro
alattekniksipil.com
georgemuncey.com
jakubrybak.com
redctei.co
denverwynkoopdentist.com
dieetuniversiteit.nl
expohomes.com
pisofare.co
haard-totaal.nl
hiddensee-buhne11.de
biodentify.ai
fascaonline.com
lassocrm.com
specialtyhomeservicesllc.com
renehartman.nl
sppdstats.com
jeanmonti.com
tatyanakopieva.ru
gazelle-du-web.com
bendel-partner.de
nauticmarine.dk
fire-space.com
arazi.eus
atrgroup.it
lagschools.ng
epsondriversforwindows.com
saint-malo-developpement.fr
karmeliterviertel.com
humanviruses.org
saberconcrete.com
onesynergyinternational.com
theater-lueneburg.de
artvark.nl
onlinemarketingsurgery.co.uk
outstandingminialbums.com
signamedia.de
internalresults.com
tecleados.com
bjornvanvulpen.nl
c-sprop.com
nrgvalue.com
asiaartgallery.jp
mneti.ru
astrographic.com
allinonecampaign.com
framemyballs.com
bcabattoirs.org
from02pro.com
soncini.ch
duthler.nl
pubcon.com
affligemsehondenschool.be
eastgrinsteadwingchun.com
arabianmice.com
creohn.de
bellesiniacademy.org
ketomealprep.academy
mac-computer-support-hamburg.de
subyard.com
mensemetgesigte.co.za
medicalsupportco.com
tastevirginia.com
newonestop.com
amelielecompte.wordpress.com
watchsale.biz
matteoruzzaofficial.com
magnetvisual.com
bundan.com
bg.szczecin.pl
markseymourphotography.co.uk
palmecophilippines.com
sarahspics.co.uk
ox-home.com
avis.mantova.it
enews-qca.com
activeterroristwarningcompany.com
thepixelfairy.com
girlish.ae
jlgraphisme.fr
domilivefurniture.com
die-immo-agentur.de
fidelitytitleoregon.com
johnsonweekly.com
nepressurecleaning.com
docarefoundation.org
rhino-turf.com
espaciopolitica.com
stathmoulis.gr
happylublog.wordpress.com
breakluckrecords.com
rtc24.com
bookingwheel.com
arearugcleaningnyc.com
dierenambulancealkmaar.nl
ilveshistoria.com
pilotgreen.com
blucamp.com
stoneridgemontessori.com
hinotruckwreckers.com.au
kellengatton.com
hostingbangladesh.net
lifeinbreaths.com
cssp-mediation.org
profibersan.com
nicksrock.com
finnergo.eu
3daywebs.com
lookandseen.com
hnkns.com
qwikcoach.com
achetrabalhos.com
goeppinger-teppichreinigung.de
gbk-tp1.de
makingmillionaires.net
yayasanprimaunggul.org
edvestors.org
drbrianhweeks.com
vedsegaard.dk
liepertgrafikweb.at
perceptdecor.com
texanscan.org
latableacrepes-meaux.fr
ronielyn.com
denhaagfoodie.nl
pro-gamer.pl
projektparkiet.pl
kiraribeaute-nani.com
schroederschoembs.com
mediogiro.com.ar
maxcube24.com.ua
zumrutkuyutemel.com
memphishealthandwellness.com
craftron.com
o90.dk
kuriero.pro
tzn.nu
tchernia-conseil.fr
pinthelook.com
ciga-france.fr
eshop.design
fbmagazine.ru
omegamarbella.com
levelseven.be
scotlandsroute66.co.uk
pokemonturkiye.com
ownidentity.com
fanuli.com.au
glennverschueren.be
parisschool.ru
casinodepositors.com
mundo-pieces-auto.fr
wg-heiligenstadt.de
endstarvation.com
brannbornfastigheter.se
hartofurniture.com
mondolandscapes.com
bohrlochversicherung.info
agenceassemble.fr
successcolony.com.ng
charlesfrancis.photos
rsidesigns.com
vitoriaecoturismo.com.br
nvisionsigns.com
schulz-moelln.de
amco.net.au
dentourage.com
spartamovers.com
suonenjoen.fi
carmel-york.com
reygroup.pt
agencewho-aixenprovence.fr
afbudsrejserallinclusive.dk
avtoboss163.ru:443
frankgoll.com
indiebizadvocates.org
explora.nl
ahgarage.com
lovetzuchia.com
jameswilliamspainting.com
the5thquestion.com
clemenfoto.dk
rozmata.com
ideamode.com
internestdigital.com
bluemarinefoundation.com
julielusktherapy.com
buffdaddyblog.com
web865.com
cotton-avenue.co.il
imaginekithomes.co.nz
pajagus.fr
thegrinningmanmusical.com
hypogenforensic.com
martinipstudios.com
nepal-pictures.com
acumenconsultingcompany.com
wallflowersandrakes.com
cesep2019.com
voetbalhoogeveen.nl
scentedlair.com
basindentistry.com
triavlete.com
khtrx.com
ziliak.com
stanleyqualitysystems.com
haus-landliebe.de
mamajenedesigns.com
goodherbalhealth.com
manzel.tn
testitjavertailut.net
hekecrm.com
justaroundthecornerpetsit.com
thestudio.academy
keuken-prijs.nl
bubbalucious.com
peppergreenfarmcatering.com.au
chinowarehousespace.com
burg-zelem.de
teethinadaydentalimplants.com
condormobile.fr
aktivfriskcenter.se
patassociation.com
bodymindchallenger.com
angeleyezstripclub.com
imagine-entertainment.com
k-zubki.ru
gardenpartner.pl
cormanmarketing.com
husetsanitas.dk
davedavisphotos.com
efficiencyconsulting.es
verbouwingsdouche.nl
jglconsultancy.com
cxcompany.com
circlecitydj.com
boloria.de
tramadolhealth.com
pinkxgayvideoawards.com
mediabolmong.com
hutchstyle.co.uk
jayfurnitureco.com
transifer.fr
dcc-eu.com
fazagostar.co
greeneyetattoo.com
askstaffing.com
animalfood-online.de
corporacionrr.com
tbalp.co.uk
alharsunindo.com
donau-guides.eu
speakaudible.com
graygreenbiomedservices.com
hoteltantra.com
chorusconsulting.net
forextimes.ru
santastoy.store
wordpress.idium.no
agendatwentytwenty.com
scietech.academy
evsynthacademy.org
kafkacare.com
startuplive.org
legundschiess.de
switch-made.com
carolynfriedlander.com
andrealuchesi.it
ygallerysalonsoho.com:443
christianscholz.de
eurethicsport.eu
atma.nl
neolaiamedispa.com
factorywizuk.com
clinic-beethovenstrasse-ag.ch
yourcosmicbeing.com
mursall.de
xn--ziinoapte-6ld.ro
advesa.com
signededenroth.dk
awaitspain.com
smartmind.net
ncjc.ca
aslog.fr
thisprettyhair.com
digitale-elite.de
brunoimmobilier.com
mrmac.com
p-ride.live
handyman-silkeborg.dk
mslp.org
patriotcleaning.net
g2mediainc.com
animation-pro.co.uk
oncarrot.com
selected-minds.de
four-ways.com
rentsportsequip.com
penumbuhrambutkeiskei.com
5thactors.com
acibademmobil.com.tr
sochi-okna23.ru
luvinsburger.fr
jalkapuu.net
andermattswisswatches.ch
line-x.co.uk
studionumerik.fr
nevadaruralhousingstudies.org
purepreprod4.com
osn.ro
grafikstudio-visuell.de
baikalflot.ru
descargandoprogramas.com
bertbutter.nl
alltagsrassismus-entknoten.de
theintellect.edu.pk
phukienbepthanhdat.com
martha-frets-ceramics.nl
90nguyentuan.com
envomask.com
galatee-couture.com
kristianboennelykke.dk
kryddersnapsen.dk
soundseeing.net
1deals.com
oraweb.net
xtensifi.com
oportowebdesign.com
rubyaudiology.com
photonag.com
orchardbrickwork.com
juergenblaetz.de
plbinsurance.com
log-barn.co.uk
fluzfluzrewards.com
silverbird.dk
lyricalduniya.com
xn--billigafrgpatroner-stb.se
palema.gr
kdbrh.com
campusce.com
nieuwsindeklas.be
atelierkomon.com
mustangmarketinggroup.com
leopoldineroux.com
kickittickets.com
bourchier.org
kemtron.fr
mgimalta.com
ntinasfiloxenia.gr
luvbec.com
akcadagofis.com
geoweb.software
insane.agency
richardkershawwines.co.za
gurutechnologies.net
yuanshenghotel.com
jmmartinezilustrador.com
hotelturbo.de
111firstdelray.com
diverfiestas.com.es
auto-opel.ro
innovationgames-brabant.nl
ludoil.it
craftstone.co.nz
happycatering.de
alene.co
letterscan.de
catalyseurdetransformation.com
acb-gruppe.ch
chatberlin.de
tages-geldvergleich.de
innersurrection.com
welovecustomers.fr
linkbuilding.life
techybash.com
bayshoreelite.com
hawaiisteelbuilding.com
monstarrsoccer.com
so-sage.fr
lsngroupe.com
sber-biznes.com
cp-bap.de
smartworkplaza.com
kompresory-opravy.com
aceroprime.com
kelsigordon.com
drbenveniste.com
egpu.fr
stringnosis.academy
perfectgrin.com
rishigangoly.com
mindfuelers.com
chainofhopeeurope.eu
goodboyscustom.com
powershell.su
airvapourbarrier.com
dnqa.co.uk
taulunkartano.fi
bodet150ans.com
unboxtherapy.site
aberdeenartwalk.org
spectamarketingdigital.com.br
dreamvoiceclub.org
johnkoen.com
albcleaner.fr
bavovrienden.nl
foerderverein-vatterschule.de
muller.nl
dantreranch.com
michaelfiegel.com
ced-elec.com
masecologicos.com
qandmmusiccenter.com
shortysspices.com
marcandy.com
aquacheck.co.za
kryptos72.com
yvesdoin-aquarelles.fr
maryairbnb.wordpress.com
abulanov.com
bringmehope.org
altocontatto.net
frameshift.it
rs-danmark.dk
vapiano.fr
relevantonline.eu
buonabitare.com
schlagbohrmaschinetests.com
business-basic.de
marmarabasin.com
skyboundnutrition.co.uk
subquercy.fr
paardcentraal.nl
turing.academy
morgansconsult.com
aidanpublishing.co.uk
moira-cristescu.com
lashandbrowenvy.com
leijstrom.com
krishnabrawijaya.com
dogsunlimitedguide.com
axisoflove.org:443
liverpoolabudhabi.ae
advance-refle.com
mindsparkescape.com
oththukaruva.com
belinda.af
stagefxinc.com
boyfriendsgoal.site
metroton.ru
look.academy
a-zpaperwork.eu
jobscore.com
salonlamar.nl
triplettabordeaux.fr
bd2fly.com
littlesaints.academy
augen-praxisklinik-rostock.de
nourella.com
cmeow.com
pourlabretagne.bzh
alisodentalcare.com
trainiumacademy.com
professionetata.com
production-stills.co.uk
akwaba-safaris.com
comoserescritor.com
domaine-des-pothiers.com
promus.ca
billscars.net
alabamaroofingllc.com
ocduiblog.com
rechtenplicht.be
kvetymichalovce.sk
strauchs-wanderlust.info
daveystownhouse.com
citiscapes-art.com
hospitalitytrainingsolutions.co.uk
eatyoveges.com
bilius.dk
jobkiwi.com.ng
mrcar.nl
rapid5kloan.org
arthakapitalforvaltning.dk
riffenmattgarage.ch
zealcon.ae
jefersonalessandro.com
airserviceunlimited.com
dinedrinkdetroit.com
hom-frisor.dk
letsstopsmoking.co.uk
mbuildinghomes.com
rokthetalk.com
cleanroomequipment.ie
rivermusic.nl
flossmoordental.com
adabible.org
redpebblephotography.com
michal-s.co.il
stabilisateur.fr
wasnederland.nl
koncept-m.ru
k-v-f.de
bychowo.pl
randyabrown.com
nalliasmali.net
globalcompliancenews.com
glende-pflanzenparadies.de
victorvictoria.com
ebible.co
malzomattalar.com
citydogslife.com
bonitabeachassociation.com
dennisverschuur.com
smartercashsystem.com
larchwoodmarketing.com
omnicademy.com
eksperdanismanlik.com
drvoip.com
biketruck.de
sunsolutions.es
radishallgood.com
adedesign.com
ceocenters.com
mazzaropi.com.br
bakingismyyoga.com
bmw-i-pure-impulse.com
forumsittard.nl
buzzneakers.com
factoriareloj.com
ilovefullcircle.com
distrifresh.com
traitware.com
jaaphoekzema.nl
vipcarrental.ae
fi-institutionalfunds.com
voice2biz.com
cap29010.it
solidhosting.nl
klapanvent.ru
towelroot.co
bescomedical.de
lapponiasafaris.com
kroophold-sjaelland.dk
parksideseniorliving.net
heuvelland-oaze.nl
terraflair.de
lexced.com
invela.dk
dayenne-styling.nl
nutriwell.com.sg
universelle.fr
racefietsenblog.nl
simpleitsolutions.ch
interlinkone.com
skoczynski.eu
operativadigital.com
supercarhire.co.uk
wirmuessenreden.com
qrs-international.com
brownswoodblog.com
t3brothers.com
saboboxtel.uk
putzen-reinigen.com
prodentalblue.com
fixx-repair.com
eos-horlogerie.com
nbva.co.uk
proffteplo.com
bluelakevision.com
grupoexin10.com
catchup-mag.com
autoteamlast.de
lollachiro.com
the-beauty-guides.com
teutoradio.de
bluetenreich-brilon.de
cincinnatiphotocompany.org
speiserei-hannover.de
ufovidmag.com
hotjapaneselesbian.com
toranjtuition.org
olry-cloisons.fr
ravage-webzine.nl
artcase.pl
sealgrinderpt.com
guohedd.com
ninjaki.com
leloupblanc.gr
druktemakersheerenveen.nl
myplaywin3.com
valiant-voice.com
baita.ac
azerbaycanas.com
block-optic.com
gavelmasters.com
datatri.be
tothebackofthemoon.com
avisioninthedesert.com
bumbipdeco.site
latteswithleslie.com
physio-lang.de
alaskaremote.com
aciscomputers.com
mikegoodfellow.co.uk
frimec-international.es
agora-collectivites.com
dibli.store
n-newmedia.de
walterman.es
spacebel.be
zorgboerderijravensbosch.nl
rattanwarehouse.co.uk
stitch-n-bitch.com
eafx.pro
almamidwifery.com
thiagoperez.com
phoenixcrane.com
apiarista.de
linearete.com
ikzoekgod.be
molade.nl
janasfokus.com
jacquesgarcianoto.com
satoblog.org
opt4cdi.com
boomerslivinglively.com
paprikapod.com
edrickennedymacfoy.com
margaretmcshane.com
11.in.ua
wrinstitute.org
alcye.com
breathebettertolivebetter.com
zdrowieszczecin.pl
lattalvor.com
laaisterplakky.nl
tetameble.pl
livedeveloper.com
pansionatblago.ru
mazift.dk
futurenetworking.com
harleystreetspineclinic.com
licensed-public-adjuster.com
delegationhub.com
benchbiz.com
finsahome.co.uk
rhino-storage.co.uk
zwemofficial.nl
keyboardjournal.com
zuerich-umzug.ch
secrets-clubs.co.uk
livelai.com
johnstonmingmanning.com
laylavalentine.com
mrkluttz.com
tieronechic.com
global-migrate.com
belofloripa.be
motocrossplace.co.uk
shrinkingplanet.com
mesajjongeren.nl
annenymus.com
photographycreativity.co.uk
leadforensics.com
ramirezprono.com
triplettagaite.fr
weddingceremonieswithtim.com
piestar.com
parseport.com
2020hindsight.info
alexwenzel.de
test-teleachat.fr
coachpreneuracademy.com
cmascd.com
cookinn.nl
circuit-diagramz.com
landgoedspica.nl
uci-france.fr
ikadomus.com
natturestaurante.com.br
beauty-traveller.com
colored-shelves.com
alnectus.com
muni.pe
berdonllp.com
reputation-medical.online
fann.ru
tesisatonarim.com
cascinarosa33.it
nykfdyrehospital.dk
acornishstudio.co.uk
wribrazil.com
lovcase.com
elex.is
nexstagefinancial.com
hameghlim.com
wineandgo.hu
iexpert99.com
uncensoredhentaigif.com
mangimirossana.it
tweedekansenloket.nl
prometeyagro.com.ua
innervisions-id.com
lisa-poncon.fr
leansupremegarcinia.net
protoplay.ca
theboardroomafrica.com
min-virksomhed.dk
slideevents.be
geitoniatonaggelon.gr
publicompserver.de
housesofwa.com
campusescalade.com
rossomattonecase.it
logosindustries.com
der-stempelking.de
thehovecounsellingpractice.co.uk
webforsites.com
gsconcretecoatings.com
silkeight.com
ronaldhendriks.nl
brinkdoepke.eu
mike.matthies.de
banukumbak.com
cac2040.com
otpusk.zp.ua
mind2muscle.nl
premiumweb.com.ua:443
profiz.com
sachainchiuk.com
billyoart.com
dentallabor-luenen.de
holocine.de
site.markkit.com.br
bcmets.info
rvside.com
rolleepollee.com
primemarineengineering.com
springfieldplumbermo.com
birthplacemag.com
kosten-vochtbestrijding.be
cymru.futbol
lunoluno.com
elitkeramika-shop.com.ua
louiedager.com
jandhpest.com
cops4causes.org
poems-for-the-soul.ch
elliemaccreative.wordpress.com
loysonbryan.com
trivselsguide.dk
malevannye.ru
nxtstg.org
iactechnologies.net
9nar.com
ncn.nl
eventosvirtualesexitosos.com
azloans.com
hepishopping.com
ledyoucan.com
apmollerpension.com
curtsdiscountguns.com
alpesiberie.com
tutvracks.com
diakonie-weitramsdorf-sesslach.de
jlwilsonbooks.com
auberives-sur-vareze.fr
sprintcoach.com
hostaletdelsindians.es
optigas.com
metriplica.academy
nationnewsroom.com
annida.it
globalskills.pt
teamsegeln.ch
slotenmakerszwijndrecht.nl
the3-week-diet.net
cardsandloyalty.com
zinnystar.com
brighthillgroup.com
dinecorp.com
xrresources.com
ayudaespiritualtamara.com
mariamalmahdi.com
sycamoregreenapts.com
sololibrerie.it
magrinya.net
crestgood.com
enactusnhlstenden.com
galaniuklaw.com
richardiv.com
fitnessblenderstory.com
advanced-removals.co.uk
fotoeditores.com
oexebusiness.com
oro.ae
vitormmcosta.com
miscbo.it
awaisghauri.com
beandrivingschool.com.au
inewsstar.com
polynine.com
o2o-academy.com
blueridgeheritage.com
blavait.fr
chris-anne.com
pureelements.nl
ivancacu.com
unexplored.gr
epicjapanart.com
mahikuchen.com
scholarquotes.com
eyedoctordallas.com
stage-infirmier.fr
concontactodirecto.com
cuadc.org
m2graph.fr
lesyeuxbleus.net
computer-place.de
witraz.pl
jollity.hu
thenalpa.com
groovedealers.ru
spirello.nl
kerstliedjeszingen.nl
anleggsregisteret.no
bulyginnikitav.000webhostapp.com
agrifarm.dk
carsten.sparen-it.de
pixelhealth.net
funworx.de
anchelor.com
electricianul.com
banksrl.co.za
matthieupetel.fr
angelsmirrorus.com
angelika-schwarz.com
metallbau-hartmann.eu
vvego.com
chomiksy.net
etgdogz.de
premier-iowa.com
topvijesti.net
molinum.pt
lidkopingsnytt.nu
schluesseldienste-hannover.de
nginx.com
energosbit-rp.ru
mariannelemenestrel.com
lmmont.sk
kausette.com
ingresosextras.online
chatterchatterchatter.com
entdoctor-durban.com
trevi-vl.ru
fskhjalmar.se
limounie.com
ijsselbeton.nl
precisetemp.com
smarttourism.academy
rino-gmbh.com
altitudeboise.com
stressreliefadvice.com
kookooo.com
janmorgenstern.com
golfclublandgoednieuwkerk.nl
lumturo.academy
easydental.ae
topautoinsurers.net
adterium.com
shortsalemap.com
biblica.com
gaearoyals.com
skinkeeper.li
drnelsonpediatrics.com
fotoslubna.com
-
net
true
-
pid
43
-
ransom_oneliner
---=== Sodinokibi Ransomware ===--- All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. I suggest you read about us on the Internet, we are known as "Sodinokibi Ransomware". For example, this article: https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread Pay attention to that: "How Much Data Is Decrypted with a Ransomware Decryptor? In Q2 2019, victims who paid for a decryptor recovered 92% of their encrypted data. This statistic varied dramatically depending on the ransomware type. For example, Ryuk ransomware has a relatively low data recovery rate, at ~ 87%, while Sodinokibi was close to 100%. " Now you have a guarantee that your files will be returned 100 %. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
1738
-
svc
sql
backup
sophos
mepocs
vss
svc$
veeam
memtas
Extracted
C:\2hukfbj-readme.txt
ryuk
https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/ABFCEDCB79C4CC69
http://decryptor.top/ABFCEDCB79C4CC69
Targets
-
-
Target
3a1e623cc176e93e48c85e974eb75dd3971197dbe5a0e993e4fb3c8a8be223b8
-
Size
204KB
-
MD5
4c5e2f8984375cefa93776c3ecf1ad28
-
SHA1
ea6b2c9e2d332d5274b3cfc2440aaa65cb684870
-
SHA256
3a1e623cc176e93e48c85e974eb75dd3971197dbe5a0e993e4fb3c8a8be223b8
-
SHA512
f8b86f4489ca21553c2845d1f17cfb761efb603c85d9e90d2db2d20508125d7dfbaa0e562e4c525de4074da49aeca30a7811dab76e87318024dd63c519ed3c92
-
Modifies system executable filetype association
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-