Static task
static1
Behavioral task
behavioral1
Sample
fe386e47f1a519c2645018890dde74eed8b4a1f1267ee9a53df9d91ac16805ff.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
fe386e47f1a519c2645018890dde74eed8b4a1f1267ee9a53df9d91ac16805ff.exe
Resource
win10-en-20211208
General
-
Target
fe386e47f1a519c2645018890dde74eed8b4a1f1267ee9a53df9d91ac16805ff
-
Size
164KB
-
MD5
d12654e946d5c4f17dd938c22a18e162
-
SHA1
eda500dfe8510f6c428a0241c07993311fa5a704
-
SHA256
fe386e47f1a519c2645018890dde74eed8b4a1f1267ee9a53df9d91ac16805ff
-
SHA512
1b669090608a418af4b4ec1c9b5e63ddc28f0a14001c59acfccd1c3fdff4a7227473f985d440be6df90917899168bbb1f8007decbc0c9eb7b4bfc19d58178af8
-
SSDEEP
3072:FHixaVZFiOCDJtOicNDWEzZpT3s2KhNj1B:FHigLF5CCj5zZpIHjD
Malware Config
Extracted
sodinokibi
28
1326
marcandy.com
dierenambulancealkmaar.nl
catering.com
c-sprop.com
simpleitsolutions.ch
cap29010.it
avisioninthedesert.com
rentsportsequip.com
rapid5kloan.org
donau-guides.eu
1deals.com
poems-for-the-soul.ch
letsstopsmoking.co.uk
soncini.ch
dinecorp.com
mesajjongeren.nl
wg-heiligenstadt.de
pisofare.co
whoopingcrane.com
breakluckrecords.com
enews-qca.com
optigas.com
rolleepollee.com
nykfdyrehospital.dk
mneti.ru
reygroup.pt
uci-france.fr
deduktia.fi
promus.ca
agriturismocastagneto.it
ntinasfiloxenia.gr
molade.nl
agencewho-aixenprovence.fr
nevadaruralhousingstudies.org
jefersonalessandro.com
richardmaybury.co.uk
rokthetalk.com
fta-media.com
catalyseurdetransformation.com
goodherbalhealth.com
schroederschoembs.com
klapanvent.ru
circlecitydj.com
collegetennis.info
legundschiess.de
guohedd.com
frankgoll.com
anchelor.com
endstarvation.com
bellesiniacademy.org
wordpress.idium.no
zuerich-umzug.ch
babysitting-hk.helpergo.co
ya-elka.ru
theboardroomafrica.com
angelika-schwarz.com
internalresults.com
stabilisateur.fr
nauticmarine.dk
mind2muscle.nl
texanscan.org
docarefoundation.org
tastevirginia.com
zumrutkuyutemel.com
satoblog.org
saint-malo-developpement.fr
nepal-pictures.com
slideevents.be
dnqa.co.uk
radishallgood.com
levencovka.ru
mensemetgesigte.co.za
profiz.com
5thactors.com
graygreenbiomedservices.com
edvestors.org
sppdstats.com
alabamaroofingllc.com
agora-collectivites.com
ocduiblog.com
spacebel.be
putzen-reinigen.com
mamajenedesigns.com
peppergreenfarmcatering.com.au
nvisionsigns.com
pokemonturkiye.com
latableacrepes-meaux.fr
apogeeconseils.fr
drvoip.com
mundo-pieces-auto.fr
2020hindsight.info
cmeow.com
airvapourbarrier.com
vitoriaecoturismo.com.br
deziplan.ru
pajagus.fr
bulyginnikitav.000webhostapp.com
photonag.com
stathmoulis.gr
napisat-pismo-gubernatoru.ru:443
lsngroupe.com
hnkns.com
mediogiro.com.ar
domaine-des-pothiers.com
bd2fly.com
chinowarehousespace.com
gosouldeep.com
hypogenforensic.com
avis.mantova.it
animation-pro.co.uk
mieleshopping.it
haard-totaal.nl
selected-minds.de
nbva.co.uk
four-ways.com
eatyoveges.com
mgimalta.com
naukaip.ru
5pointpt.com
encounter-p.net
fascaonline.com
finnergo.eu
schlagbohrmaschinetests.com
oexebusiness.com
baptistdistinctives.org
vedsegaard.dk
albcleaner.fr
spartamovers.com
buerocenter-butzbach-werbemittel.de
acornishstudio.co.uk
csaballoons.com
casinodepositors.com
fixx-repair.com
asiaartgallery.jp
quitescorting.com
karelinjames.com
utilisacteur.fr
leloupblanc.gr
precisetemp.com
xn--ziinoapte-6ld.ro
amelielecompte.wordpress.com
enactusnhlstenden.com
bertbutter.nl
kelsigordon.com
the5thquestion.com
coachpreneuracademy.com
marmarabasin.com
bohrlochversicherung.info
fire-space.com
premiumweb.com.ua:443
tweedekansenloket.nl
mike.matthies.de
lunoluno.com
innervisions-id.com
site.markkit.com.br
tages-geldvergleich.de
electricianul.com
scentedlair.com
sarahspics.co.uk
randyabrown.com
amorbellezaysalud.com
cardsandloyalty.com
techybash.com
lumturo.academy
haus-landliebe.de
augen-praxisklinik-rostock.de
lisa-poncon.fr
jglconsultancy.com
indiebizadvocates.org
michaelfiegel.com
lexced.com
ygallerysalonsoho.com:443
tieronechic.com
smartspeak.com
ufovidmag.com
tramadolhealth.com
m2graph.fr
ziliak.com
craftingalegacy.com
betterce.com
digitale-elite.de
glennverschueren.be
buffdaddyblog.com
elex.is
davedavisphotos.com
k-zubki.ru
pixelhealth.net
dmlcpa.com
wyreforest.net
geoweb.software
gta-jjb.fr
veggienessa.com
smarttourism.academy
hospitalitytrainingsolutions.co.uk
yayasanprimaunggul.org
vapiano.fr
alexwenzel.de
arearugcleaningnyc.com
cincinnatiphotocompany.org
diverfiestas.com.es
banksrl.co.za
look.academy
spirello.nl
k-v-f.de
stoneridgemontessori.com
transifer.fr
schluesseldienste-hannover.de
supercarhire.co.uk
bodymindchallenger.com
affligemsehondenschool.be
devus.de
luvbec.com
bajova.sk
artvark.nl
jag.me
tutvracks.com
block-optic.com
tetameble.pl
acb-gruppe.ch
unboxtherapy.site
auto-opel.ro
lidkopingsnytt.nu
geitoniatonaggelon.gr
factoriareloj.com
fluzfluzrewards.com
epsondriversforwindows.com
linkbuilding.life
drnelsonpediatrics.com
hotelturbo.de
jayfurnitureco.com
eventosvirtualesexitosos.com
90nguyentuan.com
parksideseniorliving.net
oncarrot.com
daveystownhouse.com
littlesaints.academy
ketomealprep.academy
denverwynkoopdentist.com
kuriero.pro
kiraribeaute-nani.com
martinipstudios.com
letterscan.de
endlessrealms.net
jonnyhooley.com
krishnabrawijaya.com
arthakapitalforvaltning.dk
elliemaccreative.wordpress.com
kristianboennelykke.dk
scholarquotes.com
oraweb.net
suonenjoen.fi
signamedia.de
atma.nl
hekecrm.com
tecleados.com
dentourage.com
logosindustries.com
latteswithleslie.com
afbudsrejserallinclusive.dk
dentallabor-luenen.de
eurethicsport.eu
topautoinsurers.net
renderbox.ch
hostastay.com
kartuindonesia.com
corporacionrr.com
barbaramcfadyenjewelry.com
levelseven.be
kenmccallum.com
istantidigitali.com
9nar.com
iactechnologies.net
nutriwell.com.sg
kellengatton.com
bilius.dk
omegamarbella.com
kvetymichalovce.sk
tatyanakopieva.ru
bendel-partner.de
iexpert99.com
ceocenters.com
skinkeeper.li
amco.net.au
ikzoekgod.be
loysonbryan.com
cookinn.nl
bluemarinefoundation.com
iron-mine.ru
lesyeuxbleus.net
go.labibini.ch
purepreprod4.com
larchwoodmarketing.com
rarefoods.ro
ykobbqchicken.ca
opticahubertruiz.com
galatee-couture.com
nexstagefinancial.com
pharmeko-group.com
kroophold-sjaelland.dk
thiagoperez.com
imajyuku-sozoku.com
speakaudible.com
rishigangoly.com
craftstone.co.nz
heimdalbygg.no
ilovefullcircle.com
ultimatelifesource.com
grupoexin10.com
p-ride.live
mediahub.co.nz
specialtyhomeservicesllc.com
kryddersnapsen.dk
concontactodirecto.com
fridakids.com
fbmagazine.ru
licensed-public-adjuster.com
ilveshistoria.com
direitapernambuco.com
innovationgames-brabant.nl
imaginekithomes.co.nz
aslog.fr
omnicademy.com
aberdeenartwalk.org
shortysspices.com
lapponiasafaris.com
lifeinbreaths.com
atrgroup.it
hm-com.com
xn--80addfr4ahr.dp.ua
tilldeeke.de
loparnille.se
trevi-vl.ru
web865.com
singletonfinancial.com
cymru.futbol
advanced-removals.co.uk
condormobile.fr
boomerslivinglively.com
silkeight.com
slotenmakerszwijndrecht.nl
nepressurecleaning.com
muni.pe
bagaholics.in
bcabattoirs.org
futurenetworking.com
neonodi.be
ced-elec.com
racefietsenblog.nl
neolaiamedispa.com
olry-cloisons.fr
laylavalentine.com
mazift.dk
unislaw-narty.pl
ideamode.com
mariannelemenestrel.com
die-immo-agentur.de
scotlandsroute66.co.uk
goodboyscustom.com
liveyourheartout.co
druktemakersheerenveen.nl
amyandzac.com
agrifarm.dk
innersurrection.com
craftron.com
matteoruzzaofficial.com
galaniuklaw.com
dr-vita.de
tbalp.co.uk
bourchier.org
bmw-i-pure-impulse.com
descargandoprogramas.com
cyberpromote.de
invela.dk
entdoctor-durban.com
eafx.pro
goddardleadership.org
distrifresh.com
groovedealers.ru
rentingwell.com
the3-week-diet.net
globalcompliancenews.com
aceroprime.com
oro.ae
hostaletdelsindians.es
dinedrinkdetroit.com
gurutechnologies.net
alnectus.com
domilivefurniture.com
sycamoregreenapts.com
wribrazil.com
aheadloftladders.co.uk
magrinya.net
yvesdoin-aquarelles.fr
xtensifi.com
eshop.design
sharonalbrightdds.com
directique.com
plbinsurance.com
vdolg24.online
sprintcoach.com
vvego.com
pvandambv.nl
nicksrock.com
skyscanner.ro
metallbau-hartmann.eu
pxsrl.it
hostingbangladesh.net
schulz-moelln.de
protoplay.ca
o2o-academy.com
aktivfriskcenter.se
mollymccarthydesign.com
silverbird.dk
pays-saint-flour.fr
shortsalemap.com
worldproskitour.com
kryptos72.com
fotoeditores.com
bringmehope.org
saboboxtel.uk
testitjavertailut.net
livelai.com
mindfuelers.com
oportowebdesign.com
carolynfriedlander.com
noda.com.ua
kausette.com
hawaiisteelbuilding.com
leadforensics.com
brisbaneosteopathic.com.au
skolaprome.eu
ronaldhendriks.nl
agenceassemble.fr
paardcentraal.nl
physio-lang.de
easydental.ae
golfclublandgoednieuwkerk.nl
cssp-mediation.org
jeanmonti.com
funworx.de
business-basic.de
ownidentity.com
datatri.be
mrmac.com
baita.ac
voetbalhoogeveen.nl
hoteltantra.com
framemyballs.com
akwaba-safaris.com
boloria.de
sytzedevries.com
altitudeboise.com
floweringsun.org
rhino-turf.com
christopherhannan.com
nieuwsindeklas.be
bychowo.pl
trainiumacademy.com
jlwilsonbooks.com
lovcase.com
thegrinningmanmusical.com
shrinkingplanet.com
ayudaespiritualtamara.com
keyboardjournal.com
broccolisoep.nl
rino-gmbh.com
rvside.com
leopoldineroux.com
housesofwa.com
foerderverein-vatterschule.de
gratiocafeblog.wordpress.com
blueridgeheritage.com
zwemofficial.nl
switch-made.com
rubyaudiology.com
bavovrienden.nl
publicompserver.de
lattalvor.com
epicjapanart.com
lovetzuchia.com
signededenroth.dk
altocontatto.net
traitware.com
min-virksomhed.dk
sellthewrightway.com
glas-kuck.de
birthplacemag.com
aciscomputers.com
morgansconsult.com
bluetenreich-brilon.de
ravage-webzine.nl
universelle.fr
jaaphoekzema.nl
hameghlim.com
inewsstar.com
adterium.com
blucamp.com
kickittickets.com
pureelements.nl
andreaskildegaard.dk
chris-anne.com
mursall.de
stagefxinc.com
dieetuniversiteit.nl
t3brothers.com
relevantonline.eu
kafkacare.com
humanviruses.org
speiserei-hannover.de
envomask.com
internestdigital.com
angeleyezstripclub.com
wasnederland.nl
thisprettyhair.com
sololibrerie.it
queertube.net
penumbuhrambutkeiskei.com
bundan.com
netadultere.fr
bookingwheel.com
a-zpaperwork.eu
ruggestar.ch
stringnosis.academy
justaroundthecornerpetsit.com
cp-bap.de
placermonticello.com
energosbit-rp.ru
breathebettertolivebetter.com
burg-zelem.de
autoteamlast.de
palmecophilippines.com
citydogslife.com
glende-pflanzenparadies.de
sunsolutions.es
alisodentalcare.com
zdrowieszczecin.pl
nginx.com
charlottelhanna.com
blavait.fr
elitkeramika-shop.com.ua
cuadc.org
ddmgen.com
lassocrm.com
billigeflybilletter.dk
jdscenter.com
sshomme.com
mediabolmong.com
astrographic.com
rechtenplicht.be
mazzaropi.com.br
tchernia-conseil.fr
kemtron.fr
bescomedical.de
fsbforsale.com
palema.gr
rossomattonecase.it
skooppi.fi
factorywizuk.com
catchup-mag.com
ncjc.ca
wallflowersandrakes.com
pourlabretagne.bzh
mahikuchen.com
handyman-silkeborg.dk
myplaywin3.com
forextimes.ru
biodentify.ai
frimec-international.es
mrcar.nl
qwikcoach.com
hawthornsretirement.co.uk
brownswoodblog.com
grancanariaregional.com
kompresory-opravy.com
janmorgenstern.com
leatherjees.com
georgemuncey.com
stitch-n-bitch.com
lgiwines.com
greenrider.nl
parseport.com
aidanpublishing.co.uk
tellthebell.website
moira-cristescu.com
malevannye.ru
zinnystar.com
fanuli.com.au
etgdogz.de
sambaglow.com
rhino-storage.co.uk
metcalfe.ca
webforsites.com
orchardbrickwork.com
jimprattmediations.com
alattekniksipil.com
leansupremegarcinia.net
dentalcircle.com
akcadagofis.com
hepishopping.com
pazarspor.org.tr
frameshift.it
3daywebs.com
forskolinslimeffect.net
cotton-avenue.co.il
pansionatblago.ru
cmascd.com
livedeveloper.com
awaitspain.com
stralsund-ansichten.de
metroton.ru
designimage.ae
eastgrinsteadwingchun.com
delegationhub.com
awag-blog.de
biketruck.de
theintellect.edu.pk
computer-place.de
sachainchiuk.com
monstarrsoccer.com
martha-frets-ceramics.nl
midwestschool.org
hvitfeldt.dk
reputation-medical.online
bayshoreelite.com
adaduga.info
harleystreetspineclinic.com
wrinstitute.org
billyoart.com
jollity.hu
rizplakatjaya.com
jobscore.com
smartmind.net
louiedager.com
fazagostar.co
girlish.ae
diakonie-weitramsdorf-sesslach.de
gatlinburgcottage.com
dibli.store
gbk-tp1.de
almamidwifery.com
flossmoordental.com
limounie.com
photographycreativity.co.uk
hutchstyle.co.uk
cl0nazepamblog.com
evsynthacademy.org
mac-computer-support-hamburg.de
heuvelland-oaze.nl
biblica.com
margaretmcshane.com
chatterchatterchatter.com
cormanmarketing.com
werkzeugtrolley.net
alltagsrassismus-entknoten.de
prometeyagro.com.ua
luvinsburger.fr
bruut.online
cc-experts.de
from02pro.com
terraflair.de
raeoflightmusic.com
patriotcleaning.net
karmeliterviertel.com
angelsmirrorus.com
yourcosmicbeing.com
o90.dk
annenymus.com
alwaysdc.com
the-cupboard.co.uk
azloans.com
bubbalucious.com
hiddensee-buhne11.de
paprikapod.com
verbouwingsdouche.nl
valiant-voice.com
furland.ru
smartworkplaza.com
motocrossplace.co.uk
malzomattalar.com
mjk.digital
outstandingminialbums.com
dogsunlimitedguide.com
so-sage.fr
triplettagaite.fr
globalskills.pt
centuryvisionglobal.com
projektparkiet.pl
landgoedspica.nl
watchsale.biz
miscbo.it
juergenblaetz.de
adabible.org
tesisatonarim.com
jax-interim-and-projectmanagement.com
welovecustomers.fr
suitesartemis.gr
arabianmice.com
paradigmlandscape.com
myfbateam.com
opt4cdi.com
solutionshosting.co.uk
nrgvalue.com
thepixelfairy.com
egpu.fr
avtoboss163.ru:443
jandhpest.com
maryairbnb.wordpress.com
stanleyqualitysystems.com
patassociation.com
duthler.nl
antesacademy.it
wirmuessenreden.com
theater-lueneburg.de
modamarfil.com
rename.kz
ciga-france.fr
aquacheck.co.za
linearete.com
customroasts.com
imagine-entertainment.com
soundseeing.net
jlgraphisme.fr
ahgarage.com
oscommunity.de
liverpoolabudhabi.ae
advesa.com
arazi.eus
theatre-embellie.fr
xrresources.com
jameswilliamspainting.com
yuanshenghotel.com
abulanov.com
chainofhopeeurope.eu
animalfood-online.de
fi-institutionalfunds.com
basindentistry.com
bonitabeachassociation.com
grafikstudio-visuell.de
michal-s.co.il
onesynergyinternational.com
pedmanson.com
hom-frisor.dk
cascinarosa33.it
polynine.com
johnstonmingmanning.com
otpusk.zp.ua
manzel.tn
dantreranch.com
insane.agency
laaisterplakky.nl
xn--80abehgab4ak0ddz.xn--p1ai
koncept-m.ru
perfectgrin.com
perceptdecor.com
itheroes.dk
kamin-somnium.de
pro-gamer.pl
johnkoen.com
tradenavigator.ch
denhaagfoodie.nl
tothebackofthemoon.com
strauchs-wanderlust.info
alcye.com
line-x.co.uk
campusescalade.com
rozmata.com
gardenpartner.pl
ronielyn.com
bcmets.info
artcase.pl
bodet150ans.com
successcolony.com.ng
lagschools.ng
jmmartinezilustrador.com
irizar.com
teamsegeln.ch
redctei.co
uncensoredhentaigif.com
sbit.ag
drbrianhweeks.com
expohomes.com
baikalflot.ru
devplus.be
skyboundnutrition.co.uk
natturestaurante.com.br
crestgood.com
b3b.ch
creohn.de
makingmillionaires.net
janellrardon.com
curtsdiscountguns.com
achetrabalhos.com
triplettabordeaux.fr
greeneyetattoo.com
triavlete.com
dcc-eu.com
cainlaw-okc.com
campinglaforetdetesse.com
adedesign.com
kookooo.com
auberives-sur-vareze.fr
matthieupetel.fr
charlesfrancis.photos
andermattswisswatches.ch
fskhjalmar.se
mayprogulka.ru
teethinadaydentalimplants.com
edrickennedymacfoy.com
onlinemarketingsurgery.co.uk
dennisverschuur.com
circuit-diagramz.com
beauty-traveller.com
goeppinger-teppichreinigung.de
log-barn.co.uk
qrs-international.com
zealcon.ae
azerbaycanas.com
eksperdanismanlik.com
advancedeyecare.com
kerstliedjeszingen.nl
nalliasmali.net
pilotgreen.com
magnetvisual.com
prodentalblue.com
sveneulberg.de
volta.plus
mindsparkescape.com
bakingismyyoga.com
jakubrybak.com
aoyama.ac
bluelakevision.com
ikadomus.com
salonlamar.nl
thehovecounsellingpractice.co.uk
khtrx.com
atelierkomon.com
kdbrh.com
ledyoucan.com
wineandgo.hu
victorvictoria.com
narca.net
turing.academy
zaczytana.com
piestar.com
nationnewsroom.com
hotjapaneselesbian.com
voice2biz.com
carmel-york.com
startuplive.org
belofloripa.be
operativadigital.com
sochi-okna23.ru
finsahome.co.uk
baumfinancialservices.com
osn.ro
rtc24.com
bumbipdeco.site
solidhosting.nl
clemenfoto.dk
medicalsupportco.com
trivselsguide.dk
wademurray.com
rs-danmark.dk
allinonecampaign.com
production-stills.co.uk
eos-horlogerie.com
der-stempelking.de
sber-biznes.com
gavelmasters.com
taulunkartano.fi
phukienbepthanhdat.com
gazelle-du-web.com
yourhappyevents.fr
apmollerpension.com
pubcon.com
nuohous.com
spectamarketingdigital.com.br
maxcube24.com.ua
annida.it
metriplica.academy
ijsselbeton.nl
lashandbrowenvy.com
alaskaremote.com
mslp.org
global-migrate.com
cxcompany.com
alpesiberie.com
profibersan.com
dreamvoiceclub.org
berdonllp.com
peninggibadan.co.id
ludoil.it
espaciopolitica.com
cesep2019.com
111firstdelray.com
eyedoctordallas.com
johnsonweekly.com
zorgboerderijravensbosch.nl
rivermusic.nl
tanatek.com
subyard.com
unexplored.gr
katherinealy.com
holocine.de
mikegoodfellow.co.uk
mustangmarketinggroup.com
drbenveniste.com
smartercashsystem.com
acumenconsultingcompany.com
askstaffing.com
stressreliefadvice.com
forumsittard.nl
agendatwentytwenty.com
vipcarrental.ae
toranjtuition.org
fotoslubna.com
boyfriendsgoal.site
lookandseen.com
newonestop.com
fann.ru
xn--billigafrgpatroner-stb.se
skidpiping.de
towelroot.co
fitnessblenderstory.com
fysiotherapierijnmond.nl
ingresosextras.online
advance-refle.com
beandrivingschool.com.au
alene.co
benchbiz.com
nxtstg.org
cleanroomequipment.ie
mariajosediazdemera.com
skoczynski.eu
premier-iowa.com
topvijesti.net
memphishealthandwellness.com
liepertgrafikweb.at
oththukaruva.com
thestudio.academy
masecologicos.com
claudiakilian.de
bratek-immobilien.de
mrkluttz.com
brighthillgroup.com
fidelitytitleoregon.com
onlinetvgroup.com
janasfokus.com
qandmmusiccenter.com
airserviceunlimited.com
hinotruckwreckers.com.au
cops4causes.org
subquercy.fr
santastoy.store
phoenixcrane.com
rattanwarehouse.co.uk
molinum.pt
yournextshoes.com
keuken-prijs.nl
g2mediainc.com
professionetata.com
motocrosshideout.com
11.in.ua
richardiv.com
weddingceremonieswithtim.com
dayenne-styling.nl
pankiss.ru
palmenhaus-erfurt.de
n-newmedia.de
ramirezprono.com
activeterroristwarningcompany.com
tzn.nu
markseymourphotography.co.uk
brannbornfastigheter.se
pinkxgayvideoawards.com
richardkershawwines.co.za
husetsanitas.dk
chomiksy.net
bridalcave.com
studionumerik.fr
cac2040.com
walterman.es
julielusktherapy.com
ox-home.com
alharsunindo.com
sjtpo.org
christianscholz.de
lollachiro.com
thegetawaycollective.com
axisoflove.org:443
witraz.pl
hensleymarketing.com
redpebblephotography.com
comoserescritor.com
mondolandscapes.com
lmmont.sk
belinda.af
jobstomoveamerica.org
jobkiwi.com.ng
happylublog.wordpress.com
therapybusinessacademy.com
ncn.nl
focuskontur.com
limmortelyouth.com
kosten-vochtbestrijding.be
primemarineengineering.com
teutoradio.de
chorusconsulting.net
mercadodelrio.com
stage-infirmier.fr
hartofurniture.com
thenalpa.com
vitormmcosta.com
anleggsregisteret.no
gaearoyals.com
parisschool.ru
campusce.com
efficiencyconsulting.es
happycatering.de
ninjaki.com
nourella.com
gsconcretecoatings.com
mariamalmahdi.com
brinkdoepke.eu
buzzneakers.com
jacquesgarcianoto.com
banukumbak.com
rsidesigns.com
acibademmobil.com.tr
sweetz.fr
test-teleachat.fr
thesilkroadny.com
riffenmattgarage.ch
apiarista.de
pinthelook.com
clinic-beethovenstrasse-ag.ch
jalkapuu.net
awaisghauri.com
the-beauty-guides.com
ebible.co
colored-shelves.com
proffteplo.com
mbuildinghomes.com
springfieldplumbermo.com
mangimirossana.it
brunoimmobilier.com
chatberlin.de
powershell.su
sealgrinderpt.com
bg.szczecin.pl
leijstrom.com
initconf.com
parentsandkids.com
interlinkone.com
kombi-dress.com
reizenmetkinderen.be
explora.nl
citiscapes-art.com
fla.se
buonabitare.com
bjornvanvulpen.nl
saberconcrete.com
slotspinner.com
renehartman.nl
carsten.sparen-it.de
scietech.academy
ivancacu.com
andrealuchesi.it
greatofficespaces.net
lyricalduniya.com
muller.nl
secrets-clubs.co.uk
billscars.net
-
net
true
-
pid
28
-
prc
onenote
synctime
steam
winword
infopath
mydesktopqos
oracle
powerpnt
outlook
mspub
excel
mydesktopservice
ocomm
dbeng50
sql
wordpa
thunderbird
thebat
dbsnmp
firefox
xfssvccon
isqlplussvc
ocautoupds
tbirdconfig
visio
ocssd
encsvc
sqbcoreservice
msaccess
agntsvc
-
ransom_oneliner
All of your files are encrypted! Find {EXT}Wannadie.txt and follow instructions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
1326
-
svc
sophos
mepocs
sql
svc$
vss
memtas
veeam
backup
Signatures
-
Sodinokibi family
-
Sodinokibi/Revil sample 1 IoCs
Processes:
resource yara_rule sample family_sodinokobi
Files
-
fe386e47f1a519c2645018890dde74eed8b4a1f1267ee9a53df9d91ac16805ff.exe windows x86
c88f20b29592f2107a629e815db6afae
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetErrorMode
Sections
.text Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 57KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.g6z Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ