Static task
static1
Behavioral task
behavioral1
Sample
14d09a259f72569f309fdd7bc14519753d01016706c7b9335a215b2d0b64c632.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
14d09a259f72569f309fdd7bc14519753d01016706c7b9335a215b2d0b64c632.exe
Resource
win10-en-20211208
General
-
Target
14d09a259f72569f309fdd7bc14519753d01016706c7b9335a215b2d0b64c632
-
Size
164KB
-
MD5
7518ecf9cd7d3f204de349103bd95c54
-
SHA1
417df7e036285c9409affa1e9bef8634d8994869
-
SHA256
14d09a259f72569f309fdd7bc14519753d01016706c7b9335a215b2d0b64c632
-
SHA512
71a181e597a5d9eae8ccd22683b650039f2506ba502b44a2da4f786e8884a1538603df9ab57d19c78d9777cb8f643ec78439346c32611776984acc569dbaba32
-
SSDEEP
3072:FHixaVZFiOCDJtOicNDWEzZQjnS2C/vbgnB:FHigLF5CCj5zZQDV0bq
Malware Config
Extracted
sodinokibi
28
1155
awaitspain.com
domilivefurniture.com
cotton-avenue.co.il
datatri.be
fanuli.com.au
kelsigordon.com
jlwilsonbooks.com
charlesfrancis.photos
fi-institutionalfunds.com
techybash.com
avis.mantova.it
natturestaurante.com.br
ciga-france.fr
mollymccarthydesign.com
crestgood.com
haus-landliebe.de
advesa.com
so-sage.fr
cap29010.it
line-x.co.uk
pajagus.fr
qandmmusiccenter.com
vapiano.fr
ncjc.ca
onlinetvgroup.com
focuskontur.com
mediabolmong.com
eafx.pro
leijstrom.com
testitjavertailut.net
buerocenter-butzbach-werbemittel.de
elliemaccreative.wordpress.com
ox-home.com
saboboxtel.uk
watchsale.biz
phukienbepthanhdat.com
palmenhaus-erfurt.de
simpleitsolutions.ch
stitch-n-bitch.com
supercarhire.co.uk
chris-anne.com
memphishealthandwellness.com
mrcar.nl
cascinarosa33.it
fitnessblenderstory.com
bohrlochversicherung.info
m2graph.fr
laaisterplakky.nl
gatlinburgcottage.com
mieleshopping.it
sytzedevries.com
alattekniksipil.com
sololibrerie.it
activeterroristwarningcompany.com
tanatek.com
skoczynski.eu
fazagostar.co
arazi.eus
vvego.com
imajyuku-sozoku.com
saberconcrete.com
distrifresh.com
sochi-okna23.ru
springfieldplumbermo.com
kosten-vochtbestrijding.be
druktemakersheerenveen.nl
luvbec.com
tastevirginia.com
fla.se
cardsandloyalty.com
tilldeeke.de
g2mediainc.com
artcase.pl
9nar.com
smartercashsystem.com
direitapernambuco.com
broccolisoep.nl
fbmagazine.ru
leloupblanc.gr
stringnosis.academy
web865.com
tramadolhealth.com
hinotruckwreckers.com.au
groovedealers.ru
edvestors.org
primemarineengineering.com
rozmata.com
whoopingcrane.com
lollachiro.com
pourlabretagne.bzh
liepertgrafikweb.at
placermonticello.com
parseport.com
billscars.net
thehovecounsellingpractice.co.uk
amyandzac.com
onesynergyinternational.com
fotoeditores.com
aktivfriskcenter.se
dinecorp.com
finsahome.co.uk
jglconsultancy.com
hekecrm.com
rsidesigns.com
morgansconsult.com
andreaskildegaard.dk
ketomealprep.academy
augen-praxisklinik-rostock.de
kryddersnapsen.dk
worldproskitour.com
dreamvoiceclub.org
mediahub.co.nz
universelle.fr
monstarrsoccer.com
prometeyagro.com.ua
fridakids.com
motocrosshideout.com
manzel.tn
fysiotherapierijnmond.nl
daveystownhouse.com
cormanmarketing.com
aceroprime.com
premier-iowa.com
goddardleadership.org
theatre-embellie.fr
arearugcleaningnyc.com
wordpress.idium.no
tchernia-conseil.fr
jonnyhooley.com
triplettagaite.fr
kamin-somnium.de
greatofficespaces.net
mustangmarketinggroup.com
hawthornsretirement.co.uk
smarttourism.academy
aheadloftladders.co.uk
welovecustomers.fr
baikalflot.ru
smartspeak.com
prodentalblue.com
jmmartinezilustrador.com
geoweb.software
goodherbalhealth.com
innersurrection.com
nykfdyrehospital.dk
descargandoprogramas.com
nalliasmali.net
zaczytana.com
mindsparkescape.com
nauticmarine.dk
victorvictoria.com
tages-geldvergleich.de
brannbornfastigheter.se
animalfood-online.de
lumturo.academy
masecologicos.com
geitoniatonaggelon.gr
mike.matthies.de
cleanroomequipment.ie
makingmillionaires.net
awaisghauri.com
yvesdoin-aquarelles.fr
ijsselbeton.nl
pinthelook.com
xn--80addfr4ahr.dp.ua
askstaffing.com
krishnabrawijaya.com
dr-vita.de
dibli.store
bellesiniacademy.org
avtoboss163.ru:443
terraflair.de
expohomes.com
tellthebell.website
thegrinningmanmusical.com
akcadagofis.com
clemenfoto.dk
bajova.sk
laylavalentine.com
teethinadaydentalimplants.com
outstandingminialbums.com
bayshoreelite.com
hostastay.com
mariajosediazdemera.com
ntinasfiloxenia.gr
comoserescritor.com
afbudsrejserallinclusive.dk
rivermusic.nl
cymru.futbol
atelierkomon.com
rapid5kloan.org
spartamovers.com
mikegoodfellow.co.uk
xtensifi.com
jaaphoekzema.nl
margaretmcshane.com
texanscan.org
polynine.com
protoplay.ca
logosindustries.com
scholarquotes.com
p-ride.live
cops4causes.org
silverbird.dk
billigeflybilletter.dk
latableacrepes-meaux.fr
jalkapuu.net
holocine.de
leansupremegarcinia.net
cssp-mediation.org
thisprettyhair.com
haard-totaal.nl
signamedia.de
elex.is
jayfurnitureco.com
ronielyn.com
molinum.pt
mjk.digital
achetrabalhos.com
dinedrinkdetroit.com
curtsdiscountguns.com
werkzeugtrolley.net
go.labibini.ch
solidhosting.nl
shrinkingplanet.com
azloans.com
blueridgeheritage.com
alabamaroofingllc.com
bjornvanvulpen.nl
mamajenedesigns.com
designimage.ae
lisa-poncon.fr
strauchs-wanderlust.info
loysonbryan.com
citydogslife.com
annida.it
mrmac.com
grafikstudio-visuell.de
envomask.com
hepishopping.com
adterium.com
nuohous.com
circuit-diagramz.com
forskolinslimeffect.net
barbaramcfadyenjewelry.com
rentsportsequip.com
ruggestar.ch
casinodepositors.com
clinic-beethovenstrasse-ag.ch
rossomattonecase.it
dcc-eu.com
soncini.ch
zorgboerderijravensbosch.nl
professionetata.com
tatyanakopieva.ru
yourcosmicbeing.com
computer-place.de
stressreliefadvice.com
ygallerysalonsoho.com:443
pureelements.nl
maxcube24.com.ua
diverfiestas.com.es
galatee-couture.com
breakluckrecords.com
smartworkplaza.com
rolleepollee.com
cuadc.org
drnelsonpediatrics.com
circlecitydj.com
andermattswisswatches.ch
brinkdoepke.eu
dantreranch.com
myfbateam.com
fta-media.com
globalcompliancenews.com
santastoy.store
jimprattmediations.com
mgimalta.com
goeppinger-teppichreinigung.de
sppdstats.com
mneti.ru
insane.agency
epsondriversforwindows.com
ced-elec.com
2020hindsight.info
rvside.com
mazzaropi.com.br
encounter-p.net
licensed-public-adjuster.com
spectamarketingdigital.com.br
arthakapitalforvaltning.dk
artvark.nl
ddmgen.com
harleystreetspineclinic.com
turing.academy
furland.ru
luvinsburger.fr
ilveshistoria.com
kerstliedjeszingen.nl
myplaywin3.com
production-stills.co.uk
angeleyezstripclub.com
limmortelyouth.com
delegationhub.com
c-sprop.com
zealcon.ae
wasnederland.nl
redpebblephotography.com
nourella.com
look.academy
funworx.de
xn--billigafrgpatroner-stb.se
sycamoregreenapts.com
vitormmcosta.com
mslp.org
mind2muscle.nl
hypogenforensic.com
metcalfe.ca
muni.pe
utilisacteur.fr
ziliak.com
carolynfriedlander.com
b3b.ch
johnkoen.com
amco.net.au
rizplakatjaya.com
paradigmlandscape.com
kompresory-opravy.com
jollity.hu
oraweb.net
anchelor.com
test-teleachat.fr
skyscanner.ro
profibersan.com
kuriero.pro
sveneulberg.de
bilius.dk
kenmccallum.com
efficiencyconsulting.es
metallbau-hartmann.eu
jakubrybak.com
liveyourheartout.co
slideevents.be
bodet150ans.com
perfectgrin.com
iron-mine.ru
biblica.com
kdbrh.com
ceocenters.com
lidkopingsnytt.nu
xn--ziinoapte-6ld.ro
jdscenter.com
promus.ca
pixelhealth.net
xrresources.com
gratiocafeblog.wordpress.com
jag.me
electricianul.com
azerbaycanas.com
leadforensics.com
amorbellezaysalud.com
xn--80abehgab4ak0ddz.xn--p1ai
epicjapanart.com
rhino-storage.co.uk
latteswithleslie.com
schlagbohrmaschinetests.com
duthler.nl
subyard.com
lassocrm.com
grupoexin10.com
wirmuessenreden.com
zinnystar.com
lexced.com
bertbutter.nl
valiant-voice.com
elitkeramika-shop.com.ua
ludoil.it
hospitalitytrainingsolutions.co.uk
theater-lueneburg.de
innovationgames-brabant.nl
neonodi.be
oscommunity.de
glende-pflanzenparadies.de
auto-opel.ro
basindentistry.com
breathebettertolivebetter.com
cmeow.com
leopoldineroux.com
schluesseldienste-hannover.de
unexplored.gr
letsstopsmoking.co.uk
parentsandkids.com
imagine-entertainment.com
studionumerik.fr
georgemuncey.com
patriotcleaning.net
donau-guides.eu
dennisverschuur.com
beauty-traveller.com
pokemonturkiye.com
inewsstar.com
purepreprod4.com
startuplive.org
agenceassemble.fr
pansionatblago.ru
jax-interim-and-projectmanagement.com
rubyaudiology.com
sweetz.fr
chorusconsulting.net
cainlaw-okc.com
klapanvent.ru
o90.dk
thesilkroadny.com
baumfinancialservices.com
mondolandscapes.com
5thactors.com
jacquesgarcianoto.com
hotjapaneselesbian.com
altitudeboise.com
nevadaruralhousingstudies.org
angelika-schwarz.com
deduktia.fi
richardkershawwines.co.za
ocduiblog.com
log-barn.co.uk
bavovrienden.nl
espaciopolitica.com
hm-com.com
webforsites.com
kartuindonesia.com
sambaglow.com
wrinstitute.org
topautoinsurers.net
kellengatton.com
shortysspices.com
richardiv.com
toranjtuition.org
reizenmetkinderen.be
sber-biznes.com
gaearoyals.com
chatberlin.de
skyboundnutrition.co.uk
ravage-webzine.nl
markseymourphotography.co.uk
gosouldeep.com
topvijesti.net
advancedeyecare.com
goodboyscustom.com
ingresosextras.online
girlish.ae
radishallgood.com
proffteplo.com
jobscore.com
beandrivingschool.com.au
gardenpartner.pl
fluzfluzrewards.com
fann.ru
explora.nl
factoriareloj.com
atrgroup.it
juergenblaetz.de
wineandgo.hu
peninggibadan.co.id
frimec-international.es
lattalvor.com
pankiss.ru
schroederschoembs.com
der-stempelking.de
lgiwines.com
dogsunlimitedguide.com
ramirezprono.com
betterce.com
slotenmakerszwijndrecht.nl
centuryvisionglobal.com
tzn.nu
renehartman.nl
ykobbqchicken.ca
agendatwentytwenty.com
lookandseen.com
glennverschueren.be
die-immo-agentur.de
skidpiping.de
irizar.com
jefersonalessandro.com
vedsegaard.dk
solutionshosting.co.uk
cac2040.com
endlessrealms.net
corporacionrr.com
bluelakevision.com
pubcon.com
diakonie-weitramsdorf-sesslach.de
internestdigital.com
rattanwarehouse.co.uk
dentourage.com
denhaagfoodie.nl
golfclublandgoednieuwkerk.nl
galaniuklaw.com
marmarabasin.com
hiddensee-buhne11.de
from02pro.com
thestudio.academy
catalyseurdetransformation.com
zumrutkuyutemel.com
claudiakilian.de
billyoart.com
fsbforsale.com
kausette.com
volta.plus
fascaonline.com
jameswilliamspainting.com
stanleyqualitysystems.com
martinipstudios.com
concontactodirecto.com
banksrl.co.za
bubbalucious.com
alexwenzel.de
eos-horlogerie.com
speiserei-hannover.de
pro-gamer.pl
nepressurecleaning.com
yournextshoes.com
edrickennedymacfoy.com
schulz-moelln.de
craftstone.co.nz
boloria.de
itheroes.dk
lifeinbreaths.com
11.in.ua
customroasts.com
louiedager.com
heimdalbygg.no
enactusnhlstenden.com
hnkns.com
coachpreneuracademy.com
medicalsupportco.com
interlinkone.com
endstarvation.com
pilotgreen.com
magnetvisual.com
weddingceremonieswithtim.com
verbouwingsdouche.nl
eksperdanismanlik.com
mrkluttz.com
alltagsrassismus-entknoten.de
miscbo.it
a-zpaperwork.eu
blavait.fr
craftingalegacy.com
motocrossplace.co.uk
mercadodelrio.com
levencovka.ru
malevannye.ru
sharonalbrightdds.com
riffenmattgarage.ch
aoyama.ac
kroophold-sjaelland.dk
premiumweb.com.ua:443
keyboardjournal.com
bringmehope.org
fixx-repair.com
kiraribeaute-nani.com
unboxtherapy.site
eurethicsport.eu
the3-week-diet.net
landgoedspica.nl
drbenveniste.com
scentedlair.com
skolaprome.eu
ledyoucan.com
hom-frisor.dk
bundan.com
qrs-international.com
lashandbrowenvy.com
dentalcircle.com
ultimatelifesource.com
dentallabor-luenen.de
akwaba-safaris.com
mundo-pieces-auto.fr
bendel-partner.de
lyricalduniya.com
agrifarm.dk
chainofhopeeurope.eu
arabianmice.com
boomerslivinglively.com
paprikapod.com
albcleaner.fr
globalskills.pt
hoteltantra.com
biodentify.ai
poems-for-the-soul.ch
nbva.co.uk
the-cupboard.co.uk
bcabattoirs.org
livelai.com
janellrardon.com
aberdeenartwalk.org
egpu.fr
block-optic.com
deziplan.ru
patassociation.com
stralsund-ansichten.de
pharmeko-group.com
wallflowersandrakes.com
theboardroomafrica.com
hawaiisteelbuilding.com
3daywebs.com
lmmont.sk
ikzoekgod.be
eshop.design
marcandy.com
vdolg24.online
kemtron.fr
vipcarrental.ae
apogeeconseils.fr
airserviceunlimited.com
loparnille.se
perceptdecor.com
drvoip.com
traitware.com
paardcentraal.nl
acb-gruppe.ch
sbit.ag
satoblog.org
lagschools.ng
acumenconsultingcompany.com
midwestschool.org
ronaldhendriks.nl
naukaip.ru
nxtstg.org
axisoflove.org:443
devus.de
thenalpa.com
sachainchiuk.com
christopherhannan.com
cesep2019.com
anleggsregisteret.no
jobstomoveamerica.org
eastgrinsteadwingchun.com
martha-frets-ceramics.nl
innervisions-id.com
voice2biz.com
silkeight.com
stabilisateur.fr
eventosvirtualesexitosos.com
easydental.ae
bd2fly.com
hostaletdelsindians.es
astrographic.com
spacebel.be
handyman-silkeborg.dk
jobkiwi.com.ng
sunsolutions.es
redctei.co
ownidentity.com
precisetemp.com
heuvelland-oaze.nl
bakingismyyoga.com
rarefoods.ro
nicksrock.com
therapybusinessacademy.com
ncn.nl
bruut.online
aquacheck.co.za
brownswoodblog.com
parksideseniorliving.net
omnicademy.com
gta-jjb.fr
rentingwell.com
fotoslubna.com
stathmoulis.gr
t3brothers.com
kvetymichalovce.sk
mac-computer-support-hamburg.de
rename.kz
adaduga.info
buffdaddyblog.com
frankgoll.com
dmlcpa.com
cincinnatiphotocompany.org
opticahubertruiz.com
factorywizuk.com
profiz.com
penumbuhrambutkeiskei.com
cmascd.com
charlottelhanna.com
scotlandsroute66.co.uk
successcolony.com.ng
nrgvalue.com
scietech.academy
internalresults.com
bookingwheel.com
raeoflightmusic.com
autoteamlast.de
adabible.org
mensemetgesigte.co.za
yourhappyevents.fr
mangimirossana.it
pedmanson.com
tutvracks.com
lovcase.com
alwaysdc.com
julielusktherapy.com
projektparkiet.pl
aslog.fr
mazift.dk
moira-cristescu.com
littlesaints.academy
kryptos72.com
wg-heiligenstadt.de
bescomedical.de
transifer.fr
baptistdistinctives.org
asiaartgallery.jp
keuken-prijs.nl
rhino-turf.com
modamarfil.com
guohedd.com
suonenjoen.fi
avisioninthedesert.com
nvisionsigns.com
berdonllp.com
shortsalemap.com
wademurray.com
yuanshenghotel.com
carsten.sparen-it.de
fidelitytitleoregon.com
pvandambv.nl
stagefxinc.com
nieuwsindeklas.be
richardmaybury.co.uk
randyabrown.com
hotelturbo.de
brunoimmobilier.com
powershell.su
tieronechic.com
oro.ae
netadultere.fr
justaroundthecornerpetsit.com
christianscholz.de
ebible.co
foerderverein-vatterschule.de
banukumbak.com
janasfokus.com
mesajjongeren.nl
bonitabeachassociation.com
livedeveloper.com
housesofwa.com
piestar.com
nepal-pictures.com
creohn.de
karmeliterviertel.com
birthplacemag.com
floweringsun.org
bourchier.org
liverpoolabudhabi.ae
k-zubki.ru
dayenne-styling.nl
theintellect.edu.pk
evsynthacademy.org
voetbalhoogeveen.nl
palema.gr
mariannelemenestrel.com
larchwoodmarketing.com
rtc24.com
acibademmobil.com.tr
imaginekithomes.co.nz
eatyoveges.com
graygreenbiomedservices.com
dierenambulancealkmaar.nl
uncensoredhentaigif.com
limounie.com
thiagoperez.com
cxcompany.com
matteoruzzaofficial.com
gsconcretecoatings.com
advanced-removals.co.uk
craftron.com
humanviruses.org
witraz.pl
animation-pro.co.uk
qwikcoach.com
cookinn.nl
nexstagefinancial.com
adedesign.com
four-ways.com
directique.com
nginx.com
apmollerpension.com
ivancacu.com
publicompserver.de
thepixelfairy.com
n-newmedia.de
bychowo.pl
catering.com
iactechnologies.net
skooppi.fi
suitesartemis.gr
glas-kuck.de
blucamp.com
citiscapes-art.com
boyfriendsgoal.site
90nguyentuan.com
wyreforest.net
zuerich-umzug.ch
tecleados.com
mbuildinghomes.com
abulanov.com
domaine-des-pothiers.com
mariamalmahdi.com
greeneyetattoo.com
sprintcoach.com
bridalcave.com
digitale-elite.de
letterscan.de
ayudaespiritualtamara.com
optigas.com
agriturismocastagneto.it
fire-space.com
hartofurniture.com
janmorgenstern.com
speakaudible.com
malzomattalar.com
molade.nl
quitescorting.com
sarahspics.co.uk
narca.net
kickittickets.com
khtrx.com
agencewho-aixenprovence.fr
altocontatto.net
soundseeing.net
o2o-academy.com
otpusk.zp.ua
unislaw-narty.pl
framemyballs.com
dieetuniversiteit.nl
energosbit-rp.ru
sellthewrightway.com
lunoluno.com
ilovefullcircle.com
brisbaneosteopathic.com.au
forumsittard.nl
tetameble.pl
hvitfeldt.dk
teamsegeln.ch
veggienessa.com
hutchstyle.co.uk
entdoctor-durban.com
smartmind.net
gurutechnologies.net
initconf.com
atma.nl
5pointpt.com
onlinemarketingsurgery.co.uk
metroton.ru
enews-qca.com
maryairbnb.wordpress.com
jandhpest.com
tesisatonarim.com
brighthillgroup.com
vitoriaecoturismo.com.br
etgdogz.de
futurenetworking.com
osn.ro
acornishstudio.co.uk
nutriwell.com.sg
koncept-m.ru
davedavisphotos.com
ahgarage.com
ya-elka.ru
kristianboennelykke.dk
uci-france.fr
aidanpublishing.co.uk
pisofare.co
ikadomus.com
walterman.es
condormobile.fr
bcmets.info
switch-made.com
parisschool.ru
napisat-pismo-gubernatoru.ru:443
belofloripa.be
chomiksy.net
jeanmonti.com
stoneridgemontessori.com
carmel-york.com
chinowarehousespace.com
johnstonmingmanning.com
pazarspor.org.tr
secrets-clubs.co.uk
levelseven.be
katherinealy.com
yayasanprimaunggul.org
triavlete.com
signededenroth.dk
kombi-dress.com
sshomme.com
singletonfinancial.com
stage-infirmier.fr
oexebusiness.com
colored-shelves.com
bumbipdeco.site
skinkeeper.li
muller.nl
triplettabordeaux.fr
buzzneakers.com
almamidwifery.com
legundschiess.de
magrinya.net
gazelle-du-web.com
opt4cdi.com
renderbox.ch
happycatering.de
neolaiamedispa.com
csaballoons.com
matthieupetel.fr
karelinjames.com
iexpert99.com
towelroot.co
linearete.com
leatherjees.com
taulunkartano.fi
alnectus.com
belinda.af
racefietsenblog.nl
cl0nazepamblog.com
alene.co
finnergo.eu
mediogiro.com.ar
babysitting-hk.helpergo.co
bagaholics.in
flossmoordental.com
buonabitare.com
mayprogulka.ru
mindfuelers.com
zwemofficial.nl
k-v-f.de
dnqa.co.uk
frameshift.it
hostingbangladesh.net
wribrazil.com
jlgraphisme.fr
the-beauty-guides.com
rokthetalk.com
bratek-immobilien.de
phoenixcrane.com
plbinsurance.com
business-basic.de
happylublog.wordpress.com
pinkxgayvideoawards.com
michaelfiegel.com
invela.dk
specialtyhomeservicesllc.com
bmw-i-pure-impulse.com
peppergreenfarmcatering.com.au
spirello.nl
indiebizadvocates.org
rishigangoly.com
pxsrl.it
eyedoctordallas.com
agora-collectivites.com
burg-zelem.de
salonlamar.nl
physio-lang.de
trivselsguide.dk
the5thquestion.com
lovetzuchia.com
noda.com.ua
bluetenreich-brilon.de
allinonecampaign.com
gavelmasters.com
collegetennis.info
tradenavigator.ch
ninjaki.com
awag-blog.de
photonag.com
selected-minds.de
saint-malo-developpement.fr
omegamarbella.com
operativadigital.com
campinglaforetdetesse.com
pays-saint-flour.fr
hensleymarketing.com
benchbiz.com
teutoradio.de
gbk-tp1.de
auberives-sur-vareze.fr
newonestop.com
bodymindchallenger.com
palmecophilippines.com
bluemarinefoundation.com
alisodentalcare.com
111firstdelray.com
hameghlim.com
annenymus.com
putzen-reinigen.com
cp-bap.de
husetsanitas.dk
rs-danmark.dk
sealgrinderpt.com
catchup-mag.com
antesacademy.it
campusce.com
affligemsehondenschool.be
oththukaruva.com
zdrowieszczecin.pl
metriplica.academy
thegetawaycollective.com
min-virksomhed.dk
subquercy.fr
drbrianhweeks.com
orchardbrickwork.com
apiarista.de
alaskaremote.com
olry-cloisons.fr
trevi-vl.ru
site.markkit.com.br
queertube.net
alcye.com
reygroup.pt
cyberpromote.de
bulyginnikitav.000webhostapp.com
sjtpo.org
lsngroupe.com
oportowebdesign.com
mahikuchen.com
tweedekansenloket.nl
devplus.be
fskhjalmar.se
rino-gmbh.com
alharsunindo.com
tothebackofthemoon.com
bg.szczecin.pl
linkbuilding.life
docarefoundation.org
campusescalade.com
slotspinner.com
kookooo.com
angelsmirrorus.com
tbalp.co.uk
advance-refle.com
forextimes.ru
chatterchatterchatter.com
biketruck.de
photographycreativity.co.uk
reputation-medical.online
rechtenplicht.be
ufovidmag.com
aciscomputers.com
cc-experts.de
trainiumacademy.com
1deals.com
michal-s.co.il
nationnewsroom.com
lesyeuxbleus.net
airvapourbarrier.com
istantidigitali.com
ideamode.com
lapponiasafaris.com
kafkacare.com
johnsonweekly.com
greenrider.nl
oncarrot.com
alpesiberie.com
baita.ac
mursall.de
amelielecompte.wordpress.com
denverwynkoopdentist.com
andrealuchesi.it
relevantonline.eu
global-migrate.com
grancanariaregional.com
-
net
true
-
pid
28
-
prc
dbsnmp
sql
msaccess
xfssvccon
wordpa
firefox
outlook
powerpnt
synctime
infopath
sqbcoreservice
ocssd
tbirdconfig
mydesktopqos
mydesktopservice
encsvc
steam
visio
dbeng50
winword
mspub
oracle
thebat
isqlplussvc
excel
ocautoupds
thunderbird
agntsvc
onenote
ocomm
-
ransom_oneliner
All of your files are encrypted! Find {EXT}Wannadie.txt and follow instructions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
1155
-
svc
vss
sophos
memtas
backup
svc$
mepocs
sql
veeam
Signatures
-
Sodinokibi family
-
Sodinokibi/Revil sample 1 IoCs
Processes:
resource yara_rule sample family_sodinokobi
Files
-
14d09a259f72569f309fdd7bc14519753d01016706c7b9335a215b2d0b64c632.exe windows x86
c88f20b29592f2107a629e815db6afae
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetErrorMode
Sections
.text Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 57KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.g6z Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ