General
-
Target
bcdb6f903d091cb844238510062f17f9c16d96959b1e2bf511de0e869ebbc815
-
Size
680KB
-
Sample
220305-xcwbvsghh8
-
MD5
d8c45725b2b0654be969ea1366e1994e
-
SHA1
38feb428aa76ce397b33865cfd26a39bdbe3166c
-
SHA256
bcdb6f903d091cb844238510062f17f9c16d96959b1e2bf511de0e869ebbc815
-
SHA512
3975f885b650830c9300ba05c38f45869172d88bf8e20a270a9543dc30c75ef8c329f61c99caab8e1688df7f520fe7cdb06804586ba497ca9e73b7536e8fe8f1
Static task
static1
Behavioral task
behavioral1
Sample
bcdb6f903d091cb844238510062f17f9c16d96959b1e2bf511de0e869ebbc815.exe
Resource
win7-20220223-en
Behavioral task
behavioral2
Sample
bcdb6f903d091cb844238510062f17f9c16d96959b1e2bf511de0e869ebbc815.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\Recovery\12m121-HOW-TO-DECRYPT.txt
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7E446A02EB004011
http://decryptor.top/7E446A02EB004011
Extracted
sodinokibi
7
3
cymru.futbol
altocontatto.net
rvside.com
noda.com.ua
christianscholz.de
wallflowersandrakes.com
tanatek.com
pinthelook.com
tastevirginia.com
campinglaforetdetesse.com
poems-for-the-soul.ch
k-zubki.ru
selected-minds.de
smarttourism.academy
the5thquestion.com
sochi-okna23.ru
osn.ro
suitesartemis.gr
efficiencyconsulting.es
kickittickets.com
ntinasfiloxenia.gr
licensed-public-adjuster.com
lagschools.ng
bjornvanvulpen.nl
littlesaints.academy
bohrlochversicherung.info
bajova.sk
victorvictoria.com
mariannelemenestrel.com
thehovecounsellingpractice.co.uk
premier-iowa.com
from02pro.com
gardenpartner.pl
sellthewrightway.com
t3brothers.com
purepreprod4.com
drnelsonpediatrics.com
hostaletdelsindians.es
hvitfeldt.dk
brunoimmobilier.com
weddingceremonieswithtim.com
redctei.co
rokthetalk.com
klapanvent.ru
bcabattoirs.org
leatherjees.com
drvoip.com
parseport.com
zumrutkuyutemel.com
makingmillionaires.net
johnsonweekly.com
jollity.hu
andermattswisswatches.ch
ufovidmag.com
riffenmattgarage.ch
brinkdoepke.eu
bavovrienden.nl
cincinnatiphotocompany.org
spirello.nl
arabianmice.com
tothebackofthemoon.com
topvijesti.net
lunoluno.com
buonabitare.com
billyoart.com
acumenconsultingcompany.com
kenmccallum.com
craftstone.co.nz
dibli.store
miscbo.it
laylavalentine.com
speakaudible.com
projektparkiet.pl
hameghlim.com
bubbalucious.com
skoczynski.eu
bookingwheel.com
ivancacu.com
dinedrinkdetroit.com
diverfiestas.com.es
soundseeing.net
ninjaki.com
carmel-york.com
datatri.be
azerbaycanas.com
rivermusic.nl
1deals.com
sppdstats.com
pokemonturkiye.com
gatlinburgcottage.com
lapponiasafaris.com
citydogslife.com
hawaiisteelbuilding.com
the-cupboard.co.uk
bonitabeachassociation.com
epsondriversforwindows.com
xrresources.com
saint-malo-developpement.fr
stressreliefadvice.com
hypogenforensic.com
simpleitsolutions.ch
stanleyqualitysystems.com
initconf.com
proffteplo.com
fluzfluzrewards.com
profibersan.com
bellesiniacademy.org
heimdalbygg.no
racefietsenblog.nl
alattekniksipil.com
espaciopolitica.com
tramadolhealth.com
alltagsrassismus-entknoten.de
vitormmcosta.com
mac-computer-support-hamburg.de
verbouwingsdouche.nl
explora.nl
min-virksomhed.dk
devplus.be
yvesdoin-aquarelles.fr
invela.dk
lisa-poncon.fr
kroophold-sjaelland.dk
schlagbohrmaschinetests.com
oncarrot.com
cesep2019.com
bringmehope.org
skyscanner.ro
encounter-p.net
zealcon.ae
khtrx.com
akwaba-safaris.com
skyboundnutrition.co.uk
abulanov.com
phukienbepthanhdat.com
techybash.com
apiarista.de
cxcompany.com
fidelitytitleoregon.com
baikalflot.ru
irizar.com
photographycreativity.co.uk
arthakapitalforvaltning.dk
dennisverschuur.com
comoserescritor.com
lexced.com
innovationgames-brabant.nl
palmenhaus-erfurt.de
alnectus.com
mrmac.com
edvestors.org
brisbaneosteopathic.com.au
speiserei-hannover.de
fbmagazine.ru
betterce.com
ocduiblog.com
jobstomoveamerica.org
glas-kuck.de
bilius.dk
magrinya.net
ayudaespiritualtamara.com
tecleados.com
paardcentraal.nl
stage-infirmier.fr
docarefoundation.org
rolleepollee.com
magnetvisual.com
rentsportsequip.com
pankiss.ru
optigas.com
spacebel.be
publicompserver.de
medicalsupportco.com
jmmartinezilustrador.com
fysiotherapierijnmond.nl
bluelakevision.com
four-ways.com
11.in.ua
nationnewsroom.com
goeppinger-teppichreinigung.de
frankgoll.com
legundschiess.de
nepal-pictures.com
iactechnologies.net
metallbau-hartmann.eu
ledyoucan.com
log-barn.co.uk
dreamvoiceclub.org
hiddensee-buhne11.de
wasnederland.nl
jlgraphisme.fr
finnergo.eu
focuskontur.com
peppergreenfarmcatering.com.au
catchup-mag.com
clinic-beethovenstrasse-ag.ch
utilisacteur.fr
o2o-academy.com
stringnosis.academy
advancedeyecare.com
bumbipdeco.site
gavelmasters.com
der-stempelking.de
krishnabrawijaya.com
wineandgo.hu
muni.pe
guohedd.com
sveneulberg.de
direitapernambuco.com
sambaglow.com
dr-vita.de
mind2muscle.nl
colored-shelves.com
deduktia.fi
devus.de
biketruck.de
naukaip.ru
thestudio.academy
rizplakatjaya.com
factorywizuk.com
elitkeramika-shop.com.ua
pays-saint-flour.fr
catering.com
prometeyagro.com.ua
cotton-avenue.co.il
silkeight.com
skolaprome.eu
kuriero.pro
qwikcoach.com
jimprattmediations.com
istantidigitali.com
fanuli.com.au
ijsselbeton.nl
linearete.com
brannbornfastigheter.se
craftron.com
nevadaruralhousingstudies.org
xn--80addfr4ahr.dp.ua
dentalcircle.com
valiant-voice.com
parisschool.ru
richardiv.com
fotoslubna.com
malevannye.ru
gazelle-du-web.com
davedavisphotos.com
broccolisoep.nl
gratiocafeblog.wordpress.com
nykfdyrehospital.dk
thisprettyhair.com
cmeow.com
lollachiro.com
luvbec.com
grupoexin10.com
frameshift.it
coachpreneuracademy.com
alaskaremote.com
ykobbqchicken.ca
wordpress.idium.no
johnkoen.com
lovetzuchia.com
eventosvirtualesexitosos.com
mayprogulka.ru
auto-opel.ro
fixx-repair.com
queertube.net
theatre-embellie.fr
zorgboerderijravensbosch.nl
rishigangoly.com
teutoradio.de
look.academy
sshomme.com
oexebusiness.com
greeneyetattoo.com
jayfurnitureco.com
nvisionsigns.com
yourcosmicbeing.com
chainofhopeeurope.eu
boyfriendsgoal.site
ced-elec.com
cssp-mediation.org
natturestaurante.com.br
trivselsguide.dk
fascaonline.com
soncini.ch
forumsittard.nl
wribrazil.com
mrcar.nl
janasfokus.com
leijstrom.com
mbuildinghomes.com
randyabrown.com
descargandoprogramas.com
tilldeeke.de
framemyballs.com
dayenne-styling.nl
martinipstudios.com
mieleshopping.it
the3-week-diet.net
olry-cloisons.fr
thiagoperez.com
dentallabor-luenen.de
uncensoredhentaigif.com
zdrowieszczecin.pl
galatee-couture.com
saboboxtel.uk
transifer.fr
geitoniatonaggelon.gr
hekecrm.com
geoweb.software
dmlcpa.com
kelsigordon.com
internestdigital.com
fla.se
eafx.pro
galaniuklaw.com
nginx.com
chris-anne.com
amyandzac.com
mesajjongeren.nl
mindsparkescape.com
photonag.com
augen-praxisklinik-rostock.de
factoriareloj.com
volta.plus
rhino-storage.co.uk
enactusnhlstenden.com
graygreenbiomedservices.com
concontactodirecto.com
bulyginnikitav.000webhostapp.com
jeanmonti.com
centuryvisionglobal.com
mensemetgesigte.co.za
angelika-schwarz.com
customroasts.com
avisioninthedesert.com
bluemarinefoundation.com
rarefoods.ro
cc-experts.de
tatyanakopieva.ru
azloans.com
rhino-turf.com
tesisatonarim.com
imagine-entertainment.com
animation-pro.co.uk
interlinkone.com
cyberpromote.de
tradenavigator.ch
aoyama.ac
kookooo.com
fridakids.com
citiscapes-art.com
dnqa.co.uk
mediogiro.com.ar
neonodi.be
lyricalduniya.com
easydental.ae
silverbird.dk
amelielecompte.wordpress.com
lovcase.com
happycatering.de
triavlete.com
hostastay.com
entdoctor-durban.com
designimage.ae
christopherhannan.com
eos-horlogerie.com
crestgood.com
agriturismocastagneto.it
acornishstudio.co.uk
raeoflightmusic.com
ciga-france.fr
futurenetworking.com
kryptos72.com
georgemuncey.com
wirmuessenreden.com
leopoldineroux.com
jandhpest.com
insane.agency
holocine.de
imajyuku-sozoku.com
vapiano.fr
smartmind.net
lsngroupe.com
pourlabretagne.bzh
mikegoodfellow.co.uk
hotjapaneselesbian.com
endstarvation.com
stabilisateur.fr
mediahub.co.nz
nicksrock.com
thegrinningmanmusical.com
otpusk.zp.ua
blueridgeheritage.com
2020hindsight.info
ziliak.com
tetameble.pl
mariajosediazdemera.com
cascinarosa33.it
basindentistry.com
fire-space.com
haus-landliebe.de
metriplica.academy
avis.mantova.it
apmollerpension.com
paprikapod.com
cp-bap.de
bcmets.info
metcalfe.ca
pureelements.nl
rozmata.com
spectamarketingdigital.com.br
funworx.de
gaearoyals.com
johnstonmingmanning.com
liveyourheartout.co
signededenroth.dk
singletonfinancial.com
forextimes.ru
solidhosting.nl
ingresosextras.online
voetbalhoogeveen.nl
111firstdelray.com
anchelor.com
ramirezprono.com
go.labibini.ch
jaaphoekzema.nl
nbva.co.uk
ncn.nl
midwestschool.org
smartworkplaza.com
berdonllp.com
evsynthacademy.org
rs-danmark.dk
baptistdistinctives.org
shrinkingplanet.com
onlinetvgroup.com
alisodentalcare.com
fsbforsale.com
csaballoons.com
happylublog.wordpress.com
ox-home.com
theintellect.edu.pk
leadforensics.com
barbaramcfadyenjewelry.com
chinowarehousespace.com
chomiksy.net
triplettagaite.fr
traitware.com
duthler.nl
outstandingminialbums.com
prodentalblue.com
omegamarbella.com
n-newmedia.de
tages-geldvergleich.de
gurutechnologies.net
walterman.es
annenymus.com
molinum.pt
hostingbangladesh.net
denverwynkoopdentist.com
oportowebdesign.com
nepressurecleaning.com
secrets-clubs.co.uk
marmarabasin.com
claudiakilian.de
worldproskitour.com
buffdaddyblog.com
neolaiamedispa.com
a-zpaperwork.eu
qrs-international.com
testitjavertailut.net
matteoruzzaofficial.com
subyard.com
jefersonalessandro.com
hepishopping.com
mjk.digital
topautoinsurers.net
tweedekansenloket.nl
mneti.ru
inewsstar.com
cl0nazepamblog.com
mike.matthies.de
awaisghauri.com
edrickennedymacfoy.com
jobkiwi.com.ng
expohomes.com
hospitalitytrainingsolutions.co.uk
keuken-prijs.nl
frimec-international.es
bodet150ans.com
agendatwentytwenty.com
lifeinbreaths.com
ebible.co
justaroundthecornerpetsit.com
brownswoodblog.com
witraz.pl
wademurray.com
stathmoulis.gr
artvark.nl
perceptdecor.com
primemarineengineering.com
thenalpa.com
professionetata.com
smartspeak.com
maryairbnb.wordpress.com
test-teleachat.fr
buerocenter-butzbach-werbemittel.de
adterium.com
alpesiberie.com
drbenveniste.com
jax-interim-and-projectmanagement.com
kryddersnapsen.dk
rentingwell.com
paradigmlandscape.com
polynine.com
beandrivingschool.com.au
eyedoctordallas.com
kafkacare.com
gsconcretecoatings.com
carolynfriedlander.com
mslp.org
druktemakersheerenveen.nl
scentedlair.com
aquacheck.co.za
webforsites.com
baita.ac
diakonie-weitramsdorf-sesslach.de
kristianboennelykke.dk
placermonticello.com
gosouldeep.com
richardkershawwines.co.za
bagaholics.in
kemtron.fr
enews-qca.com
bridalcave.com
goodboyscustom.com
onlinemarketingsurgery.co.uk
nieuwsindeklas.be
dierenambulancealkmaar.nl
m2graph.fr
buzzneakers.com
domaine-des-pothiers.com
toranjtuition.org
itheroes.dk
netadultere.fr
chatberlin.de
mazift.dk
shortsalemap.com
perfectgrin.com
avtoboss163.ru:443
chatterchatterchatter.com
leloupblanc.gr
jdscenter.com
koncept-m.ru
fann.ru
affligemsehondenschool.be
awag-blog.de
redpebblephotography.com
directique.com
albcleaner.fr
switch-made.com
achetrabalhos.com
myfbateam.com
kiraribeaute-nani.com
envomask.com
sycamoregreenapts.com
mrkluttz.com
birthplacemag.com
o90.dk
jacquesgarcianoto.com
thepixelfairy.com
bluetenreich-brilon.de
belinda.af
springfieldplumbermo.com
breathebettertolivebetter.com
mindfuelers.com
welovecustomers.fr
lumturo.academy
scietech.academy
thesilkroadny.com
leansupremegarcinia.net
finsahome.co.uk
ketomealprep.academy
eastgrinsteadwingchun.com
b3b.ch
terraflair.de
energosbit-rp.ru
dantreranch.com
xn--ziinoapte-6ld.ro
renderbox.ch
andreaskildegaard.dk
cardsandloyalty.com
matthieupetel.fr
zuerich-umzug.ch
andrealuchesi.it
cops4causes.org
belofloripa.be
opt4cdi.com
mamajenedesigns.com
zwemofficial.nl
90nguyentuan.com
larchwoodmarketing.com
furland.ru
manzel.tn
asiaartgallery.jp
catalyseurdetransformation.com
ceocenters.com
globalskills.pt
hnkns.com
nauticmarine.dk
bourchier.org
atrgroup.it
thegetawaycollective.com
monstarrsoccer.com
physio-lang.de
pubcon.com
lookandseen.com
scotlandsroute66.co.uk
rapid5kloan.org
agora-collectivites.com
katherinealy.com
kellengatton.com
afbudsrejserallinclusive.dk
yuanshenghotel.com
radishallgood.com
dentourage.com
kosten-vochtbestrijding.be
amco.net.au
fskhjalmar.se
parksideseniorliving.net
penumbuhrambutkeiskei.com
angeleyezstripclub.com
yourhappyevents.fr
muller.nl
denhaagfoodie.nl
goddardleadership.org
metroton.ru
logosindustries.com
iron-mine.ru
hoteltantra.com
phoenixcrane.com
hom-frisor.dk
askstaffing.com
salonlamar.nl
globalcompliancenews.com
vdolg24.online
quitescorting.com
palmecophilippines.com
creohn.de
unislaw-narty.pl
lmmont.sk
alene.co
cuadc.org
supercarhire.co.uk
molade.nl
ilovefullcircle.com
kerstliedjeszingen.nl
therapybusinessacademy.com
pajagus.fr
web865.com
groovedealers.ru
jonnyhooley.com
margaretmcshane.com
agrifarm.dk
cookinn.nl
autoteamlast.de
clemenfoto.dk
omnicademy.com
hartofurniture.com
trainiumacademy.com
elliemaccreative.wordpress.com
livelai.com
innersurrection.com
grancanariaregional.com
agenceassemble.fr
billscars.net
piestar.com
arearugcleaningnyc.com
global-migrate.com
skinkeeper.li
hm-com.com
blucamp.com
reputation-medical.online
artcase.pl
circuit-diagramz.com
palema.gr
elex.is
dinecorp.com
luvinsburger.fr
werkzeugtrolley.net
xn--80abehgab4ak0ddz.xn--p1ai
limmortelyouth.com
bruut.online
charlottelhanna.com
unexplored.gr
wg-heiligenstadt.de
relevantonline.eu
corporacionrr.com
campusce.com
veggienessa.com
kombi-dress.com
protoplay.ca
aciscomputers.com
activeterroristwarningcompany.com
burg-zelem.de
nxtstg.org
levelseven.be
sealgrinderpt.com
gbk-tp1.de
mondolandscapes.com
onesynergyinternational.com
5pointpt.com
lashandbrowenvy.com
business-basic.de
aktivfriskcenter.se
unboxtherapy.site
slotenmakerszwijndrecht.nl
ultimatelifesource.com
rsidesigns.com
schroederschoembs.com
strauchs-wanderlust.info
teamsegeln.ch
michal-s.co.il
mgimalta.com
adedesign.com
sweetz.fr
foerderverein-vatterschule.de
sbit.ag
hutchstyle.co.uk
etgdogz.de
so-sage.fr
aceroprime.com
lidkopingsnytt.nu
schulz-moelln.de
circlecitydj.com
laaisterplakky.nl
ncjc.ca
kdbrh.com
janellrardon.com
lattalvor.com
sjtpo.org
amorbellezaysalud.com
suonenjoen.fi
epicjapanart.com
towelroot.co
benchbiz.com
curtsdiscountguns.com
alexwenzel.de
nuohous.com
patassociation.com
nrgvalue.com
pazarspor.org.tr
motocrossplace.co.uk
patriotcleaning.net
endlessrealms.net
turing.academy
gta-jjb.fr
specialtyhomeservicesllc.com
nutriwell.com.sg
aheadloftladders.co.uk
rtc24.com
acibademmobil.com.tr
pedmanson.com
pvandambv.nl
glennverschueren.be
internalresults.com
pisofare.co
vipcarrental.ae
bakingismyyoga.com
charlesfrancis.photos
haard-totaal.nl
alabamaroofingllc.com
ideamode.com
ravage-webzine.nl
smartercashsystem.com
digitale-elite.de
liverpoolabudhabi.ae
operativadigital.com
latteswithleslie.com
apogeeconseils.fr
powershell.su
napisat-pismo-gubernatoru.ru:443
electricianul.com
opticahubertruiz.com
aberdeenartwalk.org
julielusktherapy.com
antesacademy.it
cainlaw-okc.com
fotoeditores.com
markseymourphotography.co.uk
rino-gmbh.com
xn--billigafrgpatroner-stb.se
k-v-f.de
greatofficespaces.net
ownidentity.com
boloria.de
premiumweb.com.ua:443
eksperdanismanlik.com
bescomedical.de
ddmgen.com
narca.net
bg.szczecin.pl
animalfood-online.de
iexpert99.com
greenrider.nl
jglconsultancy.com
rechtenplicht.be
dcc-eu.com
airserviceunlimited.com
kompresory-opravy.com
baumfinancialservices.com
angelsmirrorus.com
pixelhealth.net
ygallerysalonsoho.com:443
richardmaybury.co.uk
cmascd.com
memphishealthandwellness.com
skidpiping.de
saberconcrete.com
fazagostar.co
adaduga.info
letsstopsmoking.co.uk
satoblog.org
lassocrm.com
brighthillgroup.com
stoneridgemontessori.com
advanced-removals.co.uk
scholarquotes.com
pilotgreen.com
distrifresh.com
wrinstitute.org
eshop.design
airvapourbarrier.com
dieetuniversiteit.nl
p-ride.live
bratek-immobilien.de
agencewho-aixenprovence.fr
tieronechic.com
block-optic.com
sunsolutions.es
axisoflove.org:443
lgiwines.com
cap29010.it
yayasanprimaunggul.org
xtensifi.com
mahikuchen.com
vitoriaecoturismo.com.br
jakubrybak.com
rossomattonecase.it
rattanwarehouse.co.uk
schluesseldienste-hannover.de
breakluckrecords.com
mustangmarketinggroup.com
mediabolmong.com
casinodepositors.com
kausette.com
annida.it
handyman-silkeborg.dk
sololibrerie.it
jameswilliamspainting.com
promus.ca
banukumbak.com
advance-refle.com
computer-place.de
goodherbalhealth.com
rename.kz
tzn.nu
zaczytana.com
successcolony.com.ng
pro-gamer.pl
jlwilsonbooks.com
eatyoveges.com
letterscan.de
donau-guides.eu
banksrl.co.za
bodymindchallenger.com
c-sprop.com
rubyaudiology.com
ikadomus.com
bmw-i-pure-impulse.com
campusescalade.com
startuplive.org
housesofwa.com
ruggestar.ch
hensleymarketing.com
blavait.fr
nexstagefinancial.com
ya-elka.ru
egpu.fr
bychowo.pl
theboardroomafrica.com
die-immo-agentur.de
alharsunindo.com
subquercy.fr
limounie.com
landgoedspica.nl
flossmoordental.com
5thactors.com
taulunkartano.fi
plbinsurance.com
janmorgenstern.com
sachainchiuk.com
billigeflybilletter.dk
mollymccarthydesign.com
babysitting-hk.helpergo.co
awaitspain.com
stitch-n-bitch.com
indiebizadvocates.org
sprintcoach.com
bendel-partner.de
slotspinner.com
oththukaruva.com
the-beauty-guides.com
renehartman.nl
reizenmetkinderen.be
akcadagofis.com
triplettabordeaux.fr
voice2biz.com
texanscan.org
jag.me
keyboardjournal.com
drbrianhweeks.com
atma.nl
teethinadaydentalimplants.com
altitudeboise.com
alcye.com
husetsanitas.dk
modamarfil.com
vedsegaard.dk
3daywebs.com
adabible.org
karelinjames.com
boomerslivinglively.com
mursall.de
stralsund-ansichten.de
alwaysdc.com
mazzaropi.com.br
skooppi.fi
glende-pflanzenparadies.de
tbalp.co.uk
maxcube24.com.ua
reygroup.pt
deziplan.ru
bundan.com
bd2fly.com
cormanmarketing.com
harleystreetspineclinic.com
allinonecampaign.com
biodentify.ai
masecologicos.com
studionumerik.fr
lesyeuxbleus.net
oscommunity.de
linkbuilding.life
ronaldhendriks.nl
dogsunlimitedguide.com
peninggibadan.co.id
mercadodelrio.com
mariamalmahdi.com
levencovka.ru
pansionatblago.ru
hinotruckwreckers.com.au
whoopingcrane.com
advesa.com
latableacrepes-meaux.fr
beauty-traveller.com
bayshoreelite.com
loparnille.se
oraweb.net
eurethicsport.eu
almamidwifery.com
biblica.com
kvetymichalovce.sk
myplaywin3.com
fi-institutionalfunds.com
universelle.fr
uci-france.fr
moira-cristescu.com
livedeveloper.com
innervisions-id.com
precisetemp.com
michaelfiegel.com
solutionshosting.co.uk
slideevents.be
signamedia.de
vvego.com
girlish.ae
delegationhub.com
nourella.com
ludoil.it
qandmmusiccenter.com
parentsandkids.com
fta-media.com
sarahspics.co.uk
auberives-sur-vareze.fr
loysonbryan.com
profiz.com
trevi-vl.ru
astrographic.com
newonestop.com
9nar.com
ahgarage.com
g2mediainc.com
ronielyn.com
aidanpublishing.co.uk
juergenblaetz.de
forskolinslimeffect.net
collegetennis.info
daveystownhouse.com
ikzoekgod.be
production-stills.co.uk
carsten.sparen-it.de
santastoy.store
spartamovers.com
hotelturbo.de
sharonalbrightdds.com
chorusconsulting.net
stagefxinc.com
kartuindonesia.com
craftingalegacy.com
cleanroomequipment.ie
oro.ae
anleggsregisteret.no
fitnessblenderstory.com
sytzedevries.com
nalliasmali.net
zinnystar.com
pinkxgayvideoawards.com
shortysspices.com
jalkapuu.net
martha-frets-ceramics.nl
hawthornsretirement.co.uk
watchsale.biz
morgansconsult.com
heuvelland-oaze.nl
bertbutter.nl
humanviruses.org
kamin-somnium.de
karmeliterviertel.com
putzen-reinigen.com
floweringsun.org
marcandy.com
atelierkomon.com
tutvracks.com
site.markkit.com.br
sber-biznes.com
arazi.eus
acb-gruppe.ch
ilveshistoria.com
imaginekithomes.co.nz
condormobile.fr
jobscore.com
cac2040.com
louiedager.com
domilivefurniture.com
pharmeko-group.com
motocrosshideout.com
theater-lueneburg.de
wyreforest.net
aslog.fr
grafikstudio-visuell.de
malzomattalar.com
mangimirossana.it
line-x.co.uk
pxsrl.it
liepertgrafikweb.at
orchardbrickwork.com
yournextshoes.com
mundo-pieces-auto.fr
golfclublandgoednieuwkerk.nl
tellthebell.website
tchernia-conseil.fr
-
net
true
-
pid
7
-
prc
mysql.exe
-
ransom_oneliner
You are infected! Read {EXT}-HOW-TO-DECRYPT.txt!
-
ransom_template
--=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
3
Extracted
C:\odt\u92765k2h-HOW-TO-DECRYPT.txt
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/32990CD05EE208D9
http://decryptor.top/32990CD05EE208D9
Targets
-
-
Target
bcdb6f903d091cb844238510062f17f9c16d96959b1e2bf511de0e869ebbc815
-
Size
680KB
-
MD5
d8c45725b2b0654be969ea1366e1994e
-
SHA1
38feb428aa76ce397b33865cfd26a39bdbe3166c
-
SHA256
bcdb6f903d091cb844238510062f17f9c16d96959b1e2bf511de0e869ebbc815
-
SHA512
3975f885b650830c9300ba05c38f45869172d88bf8e20a270a9543dc30c75ef8c329f61c99caab8e1688df7f520fe7cdb06804586ba497ca9e73b7536e8fe8f1
Score10/10-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-