General
-
Target
2809a1b475ef2118a5f6be8320f2015744bb5ce890241049c0055f9f2a3d373b
-
Size
206KB
-
Sample
220124-ct8cjaacf7
-
MD5
0220e281b135f0e32a2794fefe4e6aa9
-
SHA1
05227068220cc142487806cddb262561a84e7538
-
SHA256
2809a1b475ef2118a5f6be8320f2015744bb5ce890241049c0055f9f2a3d373b
-
SHA512
8e4d475bbea73f16d72079d329968aab1de73cf376f1a5988e7c5edd7824b23b29b8cb878da25e366fa98b69a4fe9fff30e912ad80172f51bab7c1bf0c008538
Static task
static1
Behavioral task
behavioral1
Sample
2809a1b475ef2118a5f6be8320f2015744bb5ce890241049c0055f9f2a3d373b.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
2809a1b475ef2118a5f6be8320f2015744bb5ce890241049c0055f9f2a3d373b.exe
Resource
win10-en-20211208
Malware Config
Extracted
C:\41n10w-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/73B88515419F2565
http://decryptor.cc/73B88515419F2565
Extracted
sodinokibi
16
2932
premier-iowa.com
turing.academy
physio-lang.de
rarefoods.ro
palmecophilippines.com
ddmgen.com
omnicademy.com
baita.ac
cmascd.com
nationnewsroom.com
belofloripa.be
babysitting-hk.helpergo.co
tages-geldvergleich.de
iactechnologies.net
line-x.co.uk
richardiv.com
goeppinger-teppichreinigung.de
dinecorp.com
hawthornsretirement.co.uk
kerstliedjeszingen.nl
ahgarage.com
endlessrealms.net
5thactors.com
myplaywin3.com
apogeeconseils.fr
jacquesgarcianoto.com
traitware.com
alnectus.com
eatyoveges.com
protoplay.ca
paardcentraal.nl
electricianul.com
gta-jjb.fr
ilveshistoria.com
testitjavertailut.net
phukienbepthanhdat.com
georgemuncey.com
invela.dk
pilotgreen.com
coachpreneuracademy.com
medicalsupportco.com
lyricalduniya.com
mustangmarketinggroup.com
uci-france.fr
sbit.ag
mrkluttz.com
tellthebell.website
agora-collectivites.com
rozmata.com
jefersonalessandro.com
campinglaforetdetesse.com
brinkdoepke.eu
kryddersnapsen.dk
chatterchatterchatter.com
bruut.online
buffdaddyblog.com
futurenetworking.com
suitesartemis.gr
universelle.fr
gardenpartner.pl
internestdigital.com
kosten-vochtbestrijding.be
mahikuchen.com
levencovka.ru
allinonecampaign.com
animation-pro.co.uk
geoweb.software
pubcon.com
tchernia-conseil.fr
ziliak.com
annida.it
distrifresh.com
yourcosmicbeing.com
rokthetalk.com
humanviruses.org
dibli.store
kryptos72.com
littlesaints.academy
mondolandscapes.com
carolynfriedlander.com
slotspinner.com
chomiksy.net
riffenmattgarage.ch
eurethicsport.eu
skinkeeper.li
donau-guides.eu
kenmccallum.com
lidkopingsnytt.nu
stressreliefadvice.com
comoserescritor.com
k-zubki.ru
gaearoyals.com
qandmmusiccenter.com
carmel-york.com
towelroot.co
bluetenreich-brilon.de
vapiano.fr
basindentistry.com
kellengatton.com
buzzneakers.com
santastoy.store
sveneulberg.de
m2graph.fr
perceptdecor.com
scentedlair.com
creohn.de
mieleshopping.it
schroederschoembs.com
tanatek.com
jobscore.com
licensed-public-adjuster.com
metriplica.academy
vvego.com
arthakapitalforvaltning.dk
deduktia.fi
mariannelemenestrel.com
hostastay.com
t3brothers.com
utilisacteur.fr
verbouwingsdouche.nl
ronielyn.com
albcleaner.fr
latteswithleslie.com
janellrardon.com
bubbalucious.com
gurutechnologies.net
dennisverschuur.com
michal-s.co.il
greeneyetattoo.com
rishigangoly.com
g2mediainc.com
heimdalbygg.no
aciscomputers.com
volta.plus
lmmont.sk
csaballoons.com
bringmehope.org
oexebusiness.com
aheadloftladders.co.uk
globalskills.pt
duthler.nl
holocine.de
bg.szczecin.pl
pureelements.nl
bohrlochversicherung.info
onesynergyinternational.com
lifeinbreaths.com
zumrutkuyutemel.com
specialtyhomeservicesllc.com
atrgroup.it
jdscenter.com
broccolisoep.nl
solutionshosting.co.uk
diverfiestas.com.es
billigeflybilletter.dk
valiant-voice.com
triavlete.com
innervisions-id.com
rossomattonecase.it
perfectgrin.com
premiumweb.com.ua:443
bodymindchallenger.com
patriotcleaning.net
zorgboerderijravensbosch.nl
ebible.co
putzen-reinigen.com
silkeight.com
mercadodelrio.com
thisprettyhair.com
wineandgo.hu
leatherjees.com
epicjapanart.com
laaisterplakky.nl
bajova.sk
efficiencyconsulting.es
wademurray.com
nbva.co.uk
kdbrh.com
adterium.com
domaine-des-pothiers.com
grafikstudio-visuell.de
insane.agency
saboboxtel.uk
der-stempelking.de
gavelmasters.com
eshop.design
veggienessa.com
3daywebs.com
lisa-poncon.fr
ikadomus.com
andreaskildegaard.dk
mbuildinghomes.com
factorywizuk.com
b3b.ch
happylublog.wordpress.com
irizar.com
johnstonmingmanning.com
dieetuniversiteit.nl
mac-computer-support-hamburg.de
signamedia.de
fta-media.com
maryairbnb.wordpress.com
drbenveniste.com
chris-anne.com
alexwenzel.de
acumenconsultingcompany.com
molade.nl
anchelor.com
kvetymichalovce.sk
alene.co
autoteamlast.de
osn.ro
alpesiberie.com
bayshoreelite.com
onlinetvgroup.com
nepal-pictures.com
pays-saint-flour.fr
belinda.af
four-ways.com
chatberlin.de
boomerslivinglively.com
amelielecompte.wordpress.com
magnetvisual.com
muller.nl
ruggestar.ch
jeanmonti.com
xn--ziinoapte-6ld.ro
wirmuessenreden.com
encounter-p.net
rtc24.com
grancanariaregional.com
finnergo.eu
ravage-webzine.nl
paradigmlandscape.com
phoenixcrane.com
omegamarbella.com
louiedager.com
rentingwell.com
interlinkone.com
catchup-mag.com
tradenavigator.ch
goodboyscustom.com
ced-elec.com
benchbiz.com
internalresults.com
dentalcircle.com
gazelle-du-web.com
natturestaurante.com.br
advanced-removals.co.uk
tastevirginia.com
zaczytana.com
reizenmetkinderen.be
the-cupboard.co.uk
singletonfinancial.com
muni.pe
jmmartinezilustrador.com
alaskaremote.com
test-teleachat.fr
mediogiro.com.ar
janmorgenstern.com
ykobbqchicken.ca
ijsselbeton.nl
pro-gamer.pl
carsten.sparen-it.de
aberdeenartwalk.org
slideevents.be
promus.ca
mediabolmong.com
photonag.com
thestudio.academy
globalcompliancenews.com
ludoil.it
auto-opel.ro
bertbutter.nl
centuryvisionglobal.com
paprikapod.com
evsynthacademy.org
metallbau-hartmann.eu
brisbaneosteopathic.com.au
liveyourheartout.co
blavait.fr
victorvictoria.com
istantidigitali.com
cl0nazepamblog.com
block-optic.com
spirello.nl
bodet150ans.com
logosindustries.com
ramirezprono.com
sellthewrightway.com
goddardleadership.org
guohedd.com
frimec-international.es
memphishealthandwellness.com
denverwynkoopdentist.com
kamin-somnium.de
dreamvoiceclub.org
innovationgames-brabant.nl
spartamovers.com
nauticmarine.dk
professionetata.com
bjornvanvulpen.nl
andrealuchesi.it
makingmillionaires.net
cp-bap.de
limounie.com
theater-lueneburg.de
mindfuelers.com
lashandbrowenvy.com
sololibrerie.it
primemarineengineering.com
andermattswisswatches.ch
buerocenter-butzbach-werbemittel.de
rapid5kloan.org
margaretmcshane.com
narca.net
cascinarosa33.it
fbmagazine.ru
kemtron.fr
betterce.com
dierenambulancealkmaar.nl
ketomealprep.academy
dayenne-styling.nl
chorusconsulting.net
letterscan.de
reygroup.pt
therapybusinessacademy.com
kickittickets.com
hepishopping.com
chainofhopeeurope.eu
baptistdistinctives.org
kristianboennelykke.dk
jandhpest.com
lattalvor.com
nrgvalue.com
satoblog.org
alwaysdc.com
rs-danmark.dk
birthplacemag.com
buonabitare.com
angelika-schwarz.com
zinnystar.com
gosouldeep.com
neonodi.be
flossmoordental.com
grupoexin10.com
selected-minds.de
racefietsenblog.nl
christopherhannan.com
drvoip.com
pharmeko-group.com
hensleymarketing.com
campusce.com
alcye.com
agriturismocastagneto.it
bellesiniacademy.org
anleggsregisteret.no
lagschools.ng
frankgoll.com
bescomedical.de
biblica.com
monstarrsoccer.com
whoopingcrane.com
elliemaccreative.wordpress.com
lovetzuchia.com
ilovefullcircle.com
alharsunindo.com
aslog.fr
jonnyhooley.com
placermonticello.com
almamidwifery.com
rentsportsequip.com
legundschiess.de
galaniuklaw.com
dnqa.co.uk
nginx.com
rvside.com
atelierkomon.com
innersurrection.com
studionumerik.fr
indiebizadvocates.org
agenceassemble.fr
supercarhire.co.uk
nutriwell.com.sg
sarahspics.co.uk
k-v-f.de
lassocrm.com
oscommunity.de
theintellect.edu.pk
cc-experts.de
welovecustomers.fr
teamsegeln.ch
5pointpt.com
voice2biz.com
arabianmice.com
charlesfrancis.photos
avisioninthedesert.com
chinowarehousespace.com
circuit-diagramz.com
haard-totaal.nl
nourella.com
ciga-france.fr
lesyeuxbleus.net
loparnille.se
adedesign.com
zealcon.ae
customroasts.com
pokemonturkiye.com
hotjapaneselesbian.com
otpusk.zp.ua
metroton.ru
sambaglow.com
jlwilsonbooks.com
ideamode.com
sytzedevries.com
agrifarm.dk
arearugcleaningnyc.com
shortsalemap.com
galatee-couture.com
sber-biznes.com
haus-landliebe.de
stathmoulis.gr
breakluckrecords.com
akwaba-safaris.com
renderbox.ch
marmarabasin.com
concontactodirecto.com
napisat-pismo-gubernatoru.ru:443
amorbellezaysalud.com
docarefoundation.org
weddingceremonieswithtim.com
go.labibini.ch
9nar.com
housesofwa.com
lexced.com
skoczynski.eu
precisetemp.com
ygallerysalonsoho.com:443
jobkiwi.com.ng
asiaartgallery.jp
lunoluno.com
peninggibadan.co.id
peppergreenfarmcatering.com.au
hawaiisteelbuilding.com
laylavalentine.com
oncarrot.com
linkbuilding.life
unislaw-narty.pl
catalyseurdetransformation.com
lumturo.academy
publicompserver.de
airserviceunlimited.com
yuanshenghotel.com
tramadolhealth.com
mayprogulka.ru
charlottelhanna.com
fazagostar.co
yournextshoes.com
datatri.be
directique.com
lollachiro.com
keyboardjournal.com
shrinkingplanet.com
the-beauty-guides.com
jimprattmediations.com
artcase.pl
advesa.com
easydental.ae
p-ride.live
xtensifi.com
alattekniksipil.com
plbinsurance.com
pxsrl.it
druktemakersheerenveen.nl
livedeveloper.com
ronaldhendriks.nl
frameshift.it
oraweb.net
limmortelyouth.com
mikegoodfellow.co.uk
descargandoprogramas.com
edvestors.org
karmeliterviertel.com
tecleados.com
bundan.com
werkzeugtrolley.net
qrs-international.com
rolleepollee.com
awag-blog.de
olry-cloisons.fr
bakingismyyoga.com
eafx.pro
redpebblephotography.com
expohomes.com
quitescorting.com
alabamaroofingllc.com
akcadagofis.com
unexplored.gr
askstaffing.com
look.academy
masecologicos.com
awaitspain.com
achetrabalhos.com
dentourage.com
2020hindsight.info
jollity.hu
ox-home.com
edrickennedymacfoy.com
floweringsun.org
lsngroupe.com
dentallabor-luenen.de
hostaletdelsindians.es
eyedoctordallas.com
renehartman.nl
ayudaespiritualtamara.com
auberives-sur-vareze.fr
hutchstyle.co.uk
fitnessblenderstory.com
molinum.pt
from02pro.com
furland.ru
beandrivingschool.com.au
ncn.nl
airvapourbarrier.com
jlgraphisme.fr
n-newmedia.de
pajagus.fr
billyoart.com
wyreforest.net
spectamarketingdigital.com.br
poems-for-the-soul.ch
johnsonweekly.com
shortysspices.com
cookinn.nl
wrinstitute.org
raeoflightmusic.com
aceroprime.com
theatre-embellie.fr
piestar.com
opticahubertruiz.com
forumsittard.nl
cainlaw-okc.com
alltagsrassismus-entknoten.de
smartercashsystem.com
myfbateam.com
itheroes.dk
brannbornfastigheter.se
parksideseniorliving.net
motocrossplace.co.uk
cleanroomequipment.ie
mazzaropi.com.br
ownidentity.com
moira-cristescu.com
iexpert99.com
a-zpaperwork.eu
voetbalhoogeveen.nl
fann.ru
julielusktherapy.com
sachainchiuk.com
bourchier.org
kartuindonesia.com
catering.com
mollymccarthydesign.com
linearete.com
startuplive.org
apmollerpension.com
bychowo.pl
1deals.com
awaisghauri.com
teethinadaydentalimplants.com
bonitabeachassociation.com
deziplan.ru
amyandzac.com
azerbaycanas.com
mensemetgesigte.co.za
delegationhub.com
sharonalbrightdds.com
vedsegaard.dk
palema.gr
tutvracks.com
greatofficespaces.net
profiz.com
fanuli.com.au
fotoeditores.com
salonlamar.nl
cssp-mediation.org
azloans.com
initconf.com
crestgood.com
mediahub.co.nz
acibademmobil.com.tr
magrinya.net
smartmind.net
wallflowersandrakes.com
glende-pflanzenparadies.de
watchsale.biz
parisschool.ru
log-barn.co.uk
nykfdyrehospital.dk
relevantonline.eu
ingresosextras.online
ninjaki.com
radishallgood.com
stabilisateur.fr
hm-com.com
pvandambv.nl
boyfriendsgoal.site
pisofare.co
photographycreativity.co.uk
fire-space.com
jalkapuu.net
sweetz.fr
pourlabretagne.bzh
global-migrate.com
clinic-beethovenstrasse-ag.ch
soncini.ch
wasnederland.nl
explora.nl
production-stills.co.uk
palmenhaus-erfurt.de
teutoradio.de
artvark.nl
dinedrinkdetroit.com
slotenmakerszwijndrecht.nl
onlinemarketingsurgery.co.uk
bookingwheel.com
enactusnhlstenden.com
computer-place.de
egpu.fr
pansionatblago.ru
dcc-eu.com
cymru.futbol
bratek-immobilien.de
mind2muscle.nl
aoyama.ac
gsconcretecoatings.com
lapponiasafaris.com
factoriareloj.com
geitoniatonaggelon.gr
boloria.de
ntinasfiloxenia.gr
entdoctor-durban.com
michaelfiegel.com
thegrinningmanmusical.com
signededenroth.dk
motocrosshideout.com
avis.mantova.it
billscars.net
landgoedspica.nl
goodherbalhealth.com
endstarvation.com
funworx.de
trivselsguide.dk
larchwoodmarketing.com
affligemsehondenschool.be
nalliasmali.net
agencewho-aixenprovence.fr
mazift.dk
fla.se
hostingbangladesh.net
netadultere.fr
tieronechic.com
walterman.es
projektparkiet.pl
nepressurecleaning.com
lgiwines.com
nvisionsigns.com
gbk-tp1.de
uncensoredhentaigif.com
toranjtuition.org
kuriero.pro
campusescalade.com
mindsparkescape.com
site.markkit.com.br
90nguyentuan.com
mesajjongeren.nl
bcmets.info
tbalp.co.uk
johnkoen.com
ceocenters.com
biketruck.de
direitapernambuco.com
texanscan.org
so-sage.fr
advancedeyecare.com
yourhappyevents.fr
nevadaruralhousingstudies.org
sycamoregreenapts.com
trainiumacademy.com
worldproskitour.com
miscbo.it
nieuwsindeklas.be
cotton-avenue.co.il
oportowebdesign.com
finsahome.co.uk
adabible.org
ufovidmag.com
wribrazil.com
sppdstats.com
smartspeak.com
focuskontur.com
skyscanner.ro
janasfokus.com
tetameble.pl
silverbird.dk
sjtpo.org
letsstopsmoking.co.uk
taulunkartano.fi
handyman-silkeborg.dk
fskhjalmar.se
ya-elka.ru
devus.de
wordpress.idium.no
rechtenplicht.be
blucamp.com
harleystreetspineclinic.com
heuvelland-oaze.nl
fixx-repair.com
bavovrienden.nl
beauty-traveller.com
stitch-n-bitch.com
rivermusic.nl
saberconcrete.com
stanleyqualitysystems.com
the3-week-diet.net
vipcarrental.ae
latableacrepes-meaux.fr
trevi-vl.ru
rename.kz
cmeow.com
jobstomoveamerica.org
jakubrybak.com
dogsunlimitedguide.com
yvesdoin-aquarelles.fr
leadforensics.com
parseport.com
banukumbak.com
cardsandloyalty.com
skooppi.fi
naukaip.ru
schulz-moelln.de
kookooo.com
proffteplo.com
o90.dk
mjk.digital
acornishstudio.co.uk
prodentalblue.com
midwestschool.org
agendatwentytwenty.com
speiserei-hannover.de
malzomattalar.com
stoneridgemontessori.com
cincinnatiphotocompany.org
sunsolutions.es
adaduga.info
diakonie-weitramsdorf-sesslach.de
parentsandkids.com
collegetennis.info
lookandseen.com
mundo-pieces-auto.fr
techybash.com
bcabattoirs.org
husetsanitas.dk
lovcase.com
daveystownhouse.com
angelsmirrorus.com
eksperdanismanlik.com
webforsites.com
barbaramcfadyenjewelry.com
suonenjoen.fi
scotlandsroute66.co.uk
successcolony.com.ng
tilldeeke.de
stagefxinc.com
business-basic.de
martha-frets-ceramics.nl
energosbit-rp.ru
hnkns.com
patassociation.com
jglconsultancy.com
bridalcave.com
citydogslife.com
luvinsburger.fr
pankiss.ru
sprintcoach.com
cuadc.org
thenalpa.com
alisodentalcare.com
davedavisphotos.com
pinthelook.com
fidelitytitleoregon.com
stage-infirmier.fr
thiagoperez.com
stringnosis.academy
zdrowieszczecin.pl
drbrianhweeks.com
baumfinancialservices.com
dmlcpa.com
matthieupetel.fr
nuohous.com
secrets-clubs.co.uk
hameghlim.com
denhaagfoodie.nl
cac2040.com
craftstone.co.nz
colored-shelves.com
juergenblaetz.de
girlish.ae
brunoimmobilier.com
dr-vita.de
unboxtherapy.site
neolaiamedispa.com
stralsund-ansichten.de
etgdogz.de
martinipstudios.com
liverpoolabudhabi.ae
livelai.com
pedmanson.com
framemyballs.com
maxcube24.com.ua
domilivefurniture.com
foerderverein-vatterschule.de
khtrx.com
rsidesigns.com
o2o-academy.com
rizplakatjaya.com
terraflair.de
cesep2019.com
pazarspor.org.tr
altitudeboise.com
tesisatonarim.com
penumbuhrambutkeiskei.com
marcandy.com
blueridgeheritage.com
brownswoodblog.com
krishnabrawijaya.com
matteoruzzaofficial.com
jayfurnitureco.com
gratiocafeblog.wordpress.com
modamarfil.com
bmw-i-pure-impulse.com
c-sprop.com
triplettagaite.fr
imagine-entertainment.com
luvbec.com
designimage.ae
elitkeramika-shop.com.ua
glas-kuck.de
fysiotherapierijnmond.nl
antesacademy.it
nexstagefinancial.com
imaginekithomes.co.nz
baikalflot.ru
liepertgrafikweb.at
tothebackofthemoon.com
fsbforsale.com
thesilkroadny.com
mike.matthies.de
golfclublandgoednieuwkerk.nl
vitoriaecoturismo.com.br
bilius.dk
xn--80abehgab4ak0ddz.xn--p1ai
fridakids.com
ncjc.ca
clemenfoto.dk
circlecitydj.com
oro.ae
rhino-storage.co.uk
apiarista.de
metcalfe.ca
ocduiblog.com
hartofurniture.com
thepixelfairy.com
enews-qca.com
mgimalta.com
switch-made.com
axisoflove.org:443
saint-malo-developpement.fr
leansupremegarcinia.net
cxcompany.com
envomask.com
springfieldplumbermo.com
leopoldineroux.com
koncept-m.ru
zuerich-umzug.ch
vitormmcosta.com
strauchs-wanderlust.info
witraz.pl
die-immo-agentur.de
xrresources.com
mneti.ru
bluemarinefoundation.com
polynine.com
animalfood-online.de
digitale-elite.de
hiddensee-buhne11.de
ikzoekgod.be
skolaprome.eu
optigas.com
iron-mine.ru
craftingalegacy.com
justaroundthecornerpetsit.com
corporacionrr.com
groovedealers.ru
klapanvent.ru
min-virksomhed.dk
topvijesti.net
hvitfeldt.dk
burg-zelem.de
skidpiping.de
aidanpublishing.co.uk
imajyuku-sozoku.com
ivancacu.com
eos-horlogerie.com
advance-refle.com
sshomme.com
tzn.nu
gatlinburgcottage.com
solidhosting.nl
sealgrinderpt.com
drnelsonpediatrics.com
hom-frisor.dk
bluelakevision.com
kausette.com
jag.me
pixelhealth.net
tweedekansenloket.nl
inewsstar.com
epsondriversforwindows.com
condormobile.fr
cops4causes.org
leloupblanc.gr
kompresory-opravy.com
karelinjames.com
morgansconsult.com
zwemofficial.nl
hekecrm.com
rattanwarehouse.co.uk
espaciopolitica.com
biodentify.ai
mamajenedesigns.com
forskolinslimeffect.net
claudiakilian.de
markseymourphotography.co.uk
bendel-partner.de
powershell.su
subyard.com
schluesseldienste-hannover.de
jaaphoekzema.nl
fluzfluzrewards.com
bumbipdeco.site
queertube.net
transifer.fr
aktivfriskcenter.se
simpleitsolutions.ch
yayasanprimaunggul.org
rubyaudiology.com
richardmaybury.co.uk
banksrl.co.za
forextimes.ru
casinodepositors.com
hospitalitytrainingsolutions.co.uk
afbudsrejserallinclusive.dk
fascaonline.com
fi-institutionalfunds.com
cormanmarketing.com
vdolg24.online
devplus.be
scholarquotes.com
mrcar.nl
opt4cdi.com
pinkxgayvideoawards.com
bagaholics.in
operativadigital.com
berdonllp.com
katherinealy.com
malevannye.ru
activeterroristwarningcompany.com
acb-gruppe.ch
amco.net.au
eastgrinsteadwingchun.com
111firstdelray.com
nicksrock.com
schlagbohrmaschinetests.com
smarttourism.academy
mursall.de
manzel.tn
fotoslubna.com
craftron.com
xn--80addfr4ahr.dp.ua
oththukaruva.com
kroophold-sjaelland.dk
rino-gmbh.com
dantreranch.com
christianscholz.de
randyabrown.com
wg-heiligenstadt.de
richardkershawwines.co.za
scietech.academy
mrmac.com
augen-praxisklinik-rostock.de
graygreenbiomedservices.com
kombi-dress.com
mariamalmahdi.com
mangimirossana.it
hypogenforensic.com
soundseeing.net
bd2fly.com
curtsdiscountguns.com
citiscapes-art.com
altocontatto.net
noda.com.ua
newonestop.com
keuken-prijs.nl
hotelturbo.de
speakaudible.com
glennverschueren.be
thegetawaycollective.com
web865.com
the5thquestion.com
brighthillgroup.com
cyberpromote.de
triplettabordeaux.fr
orchardbrickwork.com
hinotruckwreckers.com.au
mariajosediazdemera.com
bulyginnikitav.000webhostapp.com
leijstrom.com
ledyoucan.com
hoteltantra.com
astrographic.com
rhino-turf.com
thehovecounsellingpractice.co.uk
tatyanakopieva.ru
sochi-okna23.ru
eventosvirtualesexitosos.com
atma.nl
purepreprod4.com
qwikcoach.com
jax-interim-and-projectmanagement.com
11.in.ua
cap29010.it
spacebel.be
subquercy.fr
kelsigordon.com
loysonbryan.com
jameswilliamspainting.com
nxtstg.org
redctei.co
mslp.org
angeleyezstripclub.com
profibersan.com
xn--billigafrgpatroner-stb.se
arazi.eus
levelseven.be
annenymus.com
avtoboss163.ru:443
kafkacare.com
skyboundnutrition.co.uk
prometeyagro.com.ua
happycatering.de
abulanov.com
smartworkplaza.com
elex.is
reputation-medical.online
topautoinsurers.net
aquacheck.co.za
breathebettertolivebetter.com
ultimatelifesource.com
outstandingminialbums.com
kiraribeaute-nani.com
theboardroomafrica.com
greenrider.nl
-
net
false
-
pid
16
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
2932
Extracted
C:\wp8b39-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3918789EF4C00089
http://decryptor.cc/3918789EF4C00089
Targets
-
-
Target
2809a1b475ef2118a5f6be8320f2015744bb5ce890241049c0055f9f2a3d373b
-
Size
206KB
-
MD5
0220e281b135f0e32a2794fefe4e6aa9
-
SHA1
05227068220cc142487806cddb262561a84e7538
-
SHA256
2809a1b475ef2118a5f6be8320f2015744bb5ce890241049c0055f9f2a3d373b
-
SHA512
8e4d475bbea73f16d72079d329968aab1de73cf376f1a5988e7c5edd7824b23b29b8cb878da25e366fa98b69a4fe9fff30e912ad80172f51bab7c1bf0c008538
-
Modifies system executable filetype association
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-