General
-
Target
DomainName.zip
-
Size
98KB
-
Sample
231012-e724safb6t
-
MD5
cea56583a631a661e52e48025bf24ea2
-
SHA1
5b0bb61b6dee9736e374a54f7de6fcbc229828dc
-
SHA256
01e0a5cc0c30dbdddec8320e4a3e1984ccb296d50021fbd73c26a4b7a17cae58
-
SHA512
8fc299a87e144ca8ddbfc474055af54e4a3eb6e5c606ab8db1cf209cf64c556b4a4f5fcaa0f8eaa416a1ccf8eb664b75d68d9700c06d1ab695449cef406115c1
-
SSDEEP
1536:4JrUR4fPKH5oTR6YO8fa9LxqBhFxay4XQM8vjn6lDHu0Eqhm0FC0E7QPSn5/6nBU:EXK29TO0aPUkNXf8LnqDO0EqbuwS8BlG
Behavioral task
behavioral1
Sample
DomainName.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
DomainName.exe
Resource
win10v2004-20230915-en
Malware Config
Extracted
sodinokibi
$2a$10$mKbuAybjn4W3ipQCt6E7ROYxmL5SSZgUbPuA7PKUsPqJU10KB4bma
7114
withahmed.com
scenepublique.net
aglend.com.au
jyzdesign.com
nsec.se
cirugiauretra.es
gopackapp.com
tinyagency.com
crediacces.com
xn--rumung-bua.online
bowengroup.com.au
mastertechengineering.com
kmbshipping.co.uk
homng.net
fitnessingbyjessica.com
oldschoolfun.net
roygolden.com
sotsioloogia.ee
real-estate-experts.com
mir-na-iznanku.com
unetica.fr
carolinepenn.com
devlaur.com
vitalyscenter.es
rosavalamedahr.com
coffreo.biz
hexcreatives.co
tstaffing.nl
shonacox.com
eadsmurraypugh.com
reddysbakery.com
troegs.com
augenta.com
ausbeverage.com.au
skanah.com
ditog.fr
vibethink.net
penco.ie
vox-surveys.com
bogdanpeptine.ro
steampluscarpetandfloors.com
xn--vrftet-pua.biz
dekkinngay.com
readberserk.com
socialonemedia.com
insp.bi
danielblum.info
sw1m.ru
kamienny-dywan24.pl
wychowanieprzedszkolne.pl
aprepol.com
body-armour.online
mirjamholleman.nl
katiekerr.co.uk
compliancesolutionsstrategies.com
sahalstore.com
kaotikkustomz.com
id-et-d.fr
kadesignandbuild.co.uk
izzi360.com
deepsouthclothingcompany.com
galleryartfair.com
ino-professional.ru
solerluethi-allart.ch
cityorchardhtx.com
cheminpsy.fr
wari.com.pe
odiclinic.org
parks-nuernberg.de
rehabilitationcentersinhouston.net
dpo-as-a-service.com
ecpmedia.vn
paymybill.guru
herbstfeststaefa.ch
datacenters-in-europe.com
cursoporcelanatoliquido.online
klimt2012.info
humancondition.com
promesapuertorico.com
instatron.net
kosterra.com
celularity.com
executiveairllc.com
all-turtles.com
nestor-swiss.ch
shhealthlaw.com
thomasvicino.com
krlosdavid.com
igfap.com
liliesandbeauties.org
klusbeter.nl
galserwis.pl
delawarecorporatelaw.com
associationanalytics.com
asteriag.com
gmto.fr
miraclediet.fun
i-trust.dk
embracinghiscall.com
kath-kirche-gera.de
schoellhammer.com
smartypractice.com
latestmodsapks.com
pierrehale.com
rollingrockcolumbia.com
bridgeloanslenders.com
lenreactiv-shop.ru
miriamgrimm.de
kunze-immobilien.de
bierensgebakkramen.nl
johnsonfamilyfarmblog.wordpress.com
plantag.de
almosthomedogrescue.dog
dnepr-beskid.com.ua
remcakram.com
iphoneszervizbudapest.hu
echtveilig.nl
jusibe.com
hhcourier.com
songunceliptv.com
twohourswithlena.wordpress.com
wolf-glas-und-kunst.de
personalenhancementcenter.com
kedak.de
bookspeopleplaces.com
123vrachi.ru
amerikansktgodis.se
dramagickcom.wordpress.com
eglectonk.online
ohidesign.com
groupe-frayssinet.fr
1kbk.com.ua
adoptioperheet.fi
bhwlawfirm.com
faizanullah.com
piajeppesen.dk
fundaciongregal.org
seitzdruck.com
nosuchthingasgovernment.com
xn--thucmctc-13a1357egba.com
humanityplus.org
microcirc.net
carriagehousesalonvt.com
eco-southafrica.com
cimanchesterescorts.co.uk
mylovelybluesky.com
blog.solutionsarchitect.guru
ventti.com.ar
fitovitaforum.com
selfoutlet.com
paulisdogshop.de
mooglee.com
lichencafe.com
brawnmediany.com
perbudget.com
collaborativeclassroom.org
4youbeautysalon.com
rostoncastings.co.uk
simulatebrain.com
iwr.nl
beaconhealthsystem.org
slupetzky.at
tophumanservicescourses.com
schoolofpassivewealth.com
trystana.com
joyeriaorindia.com
grelot-home.com
hebkft.hu
ilso.net
kostenlose-webcams.com
gaiam.nl
berlin-bamboo-bikes.org
imaginado.de
lorenacarnero.com
rafaut.com
officehymy.com
ravensnesthomegoods.com
danskretursystem.dk
aunexis.ch
kao.at
irinaverwer.com
olejack.ru
candyhouseusa.com
mank.de
leeuwardenstudentcity.nl
samnewbyjax.com
aniblinova.wordpress.com
poultrypartners.nl
cite4me.org
madinblack.com
heurigen-bauer.at
blossombeyond50.com
jameskibbie.com
planchaavapor.net
mercantedifiori.com
vyhino-zhulebino-24.ru
tennisclubetten.nl
1team.es
levdittliv.se
spylista.com
space.ua
gymnasedumanagement.com
centromarysalud.com
deoudedorpskernnoordwijk.nl
trapiantofue.it
courteney-cox.net
smogathon.com
blacksirius.de
tsklogistik.eu
artallnightdc.com
highlinesouthasc.com
tarotdeseidel.com
lillegrandpalais.com
cortec-neuro.com
takeflat.com
schraven.de
sevenadvertising.com
teresianmedia.org
evergreen-fishing.com
daniel-akermann-architektur-und-planung.ch
freie-baugutachterpraxis.de
architekturbuero-wagner.net
c-a.co.in
dr-tremel-rednitzhembach.de
oemands.dk
igorbarbosa.com
smessier.com
bouncingbonanza.com
tomoiyuma.com
porno-gringo.com
mrsfieldskc.com
birnam-wood.com
basisschooldezonnewijzer.nl
mooreslawngarden.com
stoeberstuuv.de
zewatchers.com
gonzalezfornes.es
darnallwellbeing.org.uk
roadwarrior.app
buroludo.nl
vickiegrayimages.com
devstyle.org
ateliergamila.com
abl1.net
crosspointefellowship.church
ilcdover.com
abogadosadomicilio.es
consultaractadenacimiento.com
ampisolabergeggi.it
drinkseed.com
gamesboard.info
irishmachineryauctions.com
smithmediastrategies.com
corona-handles.com
woodworkersolution.com
financescorecard.com
bricotienda.com
web.ion.ag
travelffeine.com
yourobgyn.net
baronloan.org
completeweddingkansas.com
bauertree.com
summitmarketingstrategies.com
manifestinglab.com
bimnapratica.com
liikelataamo.fi
fotoideaymedia.es
smalltownideamill.wordpress.com
daklesa.de
tomaso.gr
hrabritelefon.hr
onlybacklink.com
jobmap.at
shsthepapercut.com
faronics.com
ihr-news.jp
maureenbreezedancetheater.org
alhashem.net
manutouchmassage.com
atozdistribution.co.uk
fizzl.ru
celeclub.org
makeitcount.at
simpkinsedwards.co.uk
tenacitytenfold.com
mbxvii.com
starsarecircular.org
westdeptfordbuyrite.com
nhadatcanho247.com
torgbodenbollnas.se
ivivo.es
hotelsolbh.com.br
idemblogs.com
brigitte-erler.com
cranleighscoutgroup.org
pelorus.group
panelsandwichmadrid.es
mdk-mediadesign.de
eaglemeetstiger.de
jbbjw.com
evangelische-pfarrgemeinde-tuniberg.de
maryloutaylor.com
femxarxa.cat
fensterbau-ziegler.de
morawe-krueger.de
wacochamber.com
pointos.com
boldcitydowntown.com
teknoz.net
digivod.de
saka.gr
bradynursery.com
surespark.org.uk
comarenterprises.com
corendonhotels.com
hushavefritid.dk
chavesdoareeiro.com
goodgirlrecovery.com
coursio.com
parkcf.nl
micro-automation.de
xn--singlebrsen-vergleich-nec.com
bastutunnan.se
huissier-creteil.com
stemplusacademy.com
higadograsoweb.com
finde-deine-marke.de
plastidip.com.ar
2ekeus.nl
funjose.org.gt
jolly-events.com
webcodingstudio.com
knowledgemuseumbd.com
meusharklinithome.wordpress.com
fatfreezingmachines.com
marietteaernoudts.nl
purposeadvisorsolutions.com
psc.de
bunburyfreightservices.com.au
transliminaltribe.wordpress.com
apprendrelaudit.com
simpliza.com
jeanlouissibomana.com
praxis-foerderdiagnostik.de
denovofoodsgroup.com
dlc.berlin
naturalrapids.com
extraordinaryoutdoors.com
pay4essays.net
hairstylesnow.site
destinationclients.fr
partnertaxi.sk
sportverein-tambach.de
kaminscy.com
zonamovie21.net
fransespiegels.nl
despedidascostablanca.es
allfortheloveofyou.com
upmrkt.co
anybookreader.de
ausair.com.au
finediningweek.pl
talentwunder.com
veybachcenter.de
balticdermatology.lt
kikedeoliveira.com
wellplast.se
crowcanyon.com
fotoscondron.com
supportsumba.nl
live-your-life.jp
behavioralmedicinespecialists.com
bbsmobler.se
midmohandyman.com
transportesycementoshidalgo.es
strategicstatements.com
pmc-services.de
bigler-hrconsulting.ch
ladelirante.fr
tanzschule-kieber.de
tandartspraktijkhartjegroningen.nl
promalaga.es
longislandelderlaw.com
freie-gewerkschaften.de
mardenherefordshire-pc.gov.uk
cafemattmeera.com
bildungsunderlebnis.haus
sauschneider.info
clos-galant.com
bouldercafe-wuppertal.de
firstpaymentservices.com
schmalhorst.de
myhostcloud.com
bloggyboulga.net
xn--fnsterputssollentuna-39b.se
oslomf.no
coding-marking.com
pcp-nc.com
noesis.tech
operaslovakia.sk
stupbratt.no
people-biz.com
antenanavi.com
puertamatic.es
christinarebuffetcourses.com
ki-lowroermond.nl
stefanpasch.me
juneauopioidworkgroup.org
baustb.de
pt-arnold.de
spacecitysisters.org
faroairporttransfers.net
bee4win.com
fairfriends18.de
nacktfalter.de
kojinsaisei.info
wien-mitte.co.at
autopfand24.de
imperfectstore.com
international-sound-awards.com
mylolis.com
baylegacy.com
onlyresultsmarketing.com
sexandfessenjoon.wordpress.com
creamery201.com
danubecloud.com
charlesreger.com
waermetauscher-berechnen.de
blood-sports.net
pomodori-pizzeria.de
cactusthebrand.com
heidelbergartstudio.gallery
conexa4papers.trade
modamilyon.com
foretprivee.ca
lapmangfpt.info.vn
answerstest.ru
theclubms.com
helikoptervluchtnewyork.nl
craftleathermnl.com
sairaku.net
calxplus.eu
parking.netgateway.eu
fax-payday-loans.com
testzandbakmetmening.online
modelmaking.nl
gporf.fr
rumahminangberdaya.com
myhealth.net.au
houseofplus.com
nandistribution.nl
bordercollie-nim.nl
allentownpapershow.com
sagadc.com
visiativ-industry.fr
vancouver-print.ca
qlog.de
skiltogprint.no
classycurtainsltd.co.uk
campus2day.de
autodemontagenijmegen.nl
simoneblum.de
dareckleyministries.com
mezhdu-delom.ru
facettenreich27.de
whittier5k.com
caribbeansunpoker.com
centuryrs.com
hmsdanmark.dk
makeurvoiceheard.com
karacaoglu.nl
naswrrg.org
launchhubl.com
handi-jack-llc.com
asiluxury.com
agence-chocolat-noir.com
groupe-cets.com
alten-mebel63.ru
thedresserie.com
gastsicht.de
farhaani.com
hihaho.com
acomprarseguidores.com
osterberg.fi
id-vet.com
saarland-thermen-resort.com
lightair.com
thee.network
luxurytv.jp
podsosnami.ru
iyengaryogacharlotte.com
syndikat-asphaltfieber.de
lbcframingelectrical.com
qualitus.com
linnankellari.fi
raschlosser.de
wsoil.com.sg
icpcnj.org
jvanvlietdichter.nl
anthonystreetrimming.com
philippedebroca.com
caffeinternet.it
hotelzentral.at
rota-installations.co.uk
muamuadolls.com
aco-media.nl
devok.info
htchorst.nl
lukeshepley.wordpress.com
gemeentehetkompas.nl
psa-sec.de
winrace.no
spinheal.ru
bingonearme.org
alsace-first.com
mousepad-direkt.de
hannah-fink.de
nijaplay.com
retroearthstudio.com
unim.su
vannesteconstruct.be
littlebird.salon
pridoxmaterieel.nl
croftprecision.co.uk
thailandholic.com
corola.es
comparatif-lave-linge.fr
stoeferlehalle.de
35-40konkatsu.net
geoffreymeuli.com
systemate.dk
milltimber.aberdeen.sch.uk
noskierrenteria.com
marathonerpaolo.com
helenekowalsky.com
mountsoul.de
latribuessentielle.com
sla-paris.com
tetinfo.in
polzine.net
smokeysstoves.com
haar-spange.com
verbisonline.com
marchand-sloboda.com
revezlimage.com
iyahayki.nl
hardinggroup.com
huehnerauge-entfernen.de
365questions.org
siliconbeach-realestate.com
tongdaifpthaiphong.net
waynela.com
seminoc.com
quickyfunds.com
xn--logopdie-leverkusen-kwb.de
tandartspraktijkheesch.nl
exenberger.at
oneplusresource.org
zenderthelender.com
ahouseforlease.com
frontierweldingllc.com
urclan.net
dw-css.de
gw2guilds.org
prochain-voyage.net
yassir.pro
you-bysia.com.au
airconditioning-waalwijk.nl
erstatningsadvokaterne.dk
iwelt.de
kingfamily.construction
csgospeltips.se
camsadviser.com
corelifenutrition.com
wasmachtmeinfonds.at
milestoneshows.com
polychromelabs.com
marketingsulweb.com
lubetkinmediacompanies.com
pubweb.carnet.hr
presseclub-magdeburg.de
lebellevue.fr
stacyloeb.com
zzyjtsgls.com
colorofhorses.com
deko4you.at
julis-lsa.de
monark.com
joseconstela.com
enovos.de
paradicepacks.com
braffinjurylawfirm.com
mymoneyforex.com
sofavietxinh.com
journeybacktolife.com
wraithco.com
socstrp.org
licor43.de
ceid.info.tr
theshungiteexperience.com.au
flexicloud.hk
filmstreamingvfcomplet.be
jsfg.com
leda-ukraine.com.ua
bayoga.co.uk
sportiomsportfondsen.nl
autodujos.lt
lascuola.nl
theapifactory.com
zimmerei-deboer.de
xn--fn-kka.no
dubnew.com
stampagrafica.es
epwritescom.wordpress.com
lescomtesdemean.be
architecturalfiberglass.org
servicegsm.net
loprus.pl
stopilhan.com
cwsitservices.co.uk
entopic.com
alfa-stroy72.com
pickanose.com
craigvalentineacademy.com
love30-chanko.com
andersongilmour.co.uk
atmos-show.com
vorotauu.ru
worldhealthbasicinfo.com
geisterradler.de
dubscollective.com
beautychance.se
victoriousfestival.co.uk
opatrovanie-ako.sk
thewellnessmimi.com
limassoldriving.com
nvwoodwerks.com
babcockchurch.org
dr-pipi.de
nancy-informatique.fr
321play.com.hk
softsproductkey.com
solhaug.tk
suncrestcabinets.ca
stoneys.ch
baptisttabernacle.com
mountaintoptinyhomes.com
hugoversichert.de
ungsvenskarna.se
ivfminiua.com
restaurantesszimmer.de
hvccfloorcare.com
wurmpower.at
thefixhut.com
spectrmash.ru
pivoineetc.fr
mrxermon.de
fibrofolliculoma.info
berliner-versicherungsvergleich.de
zweerscreatives.nl
mmgdouai.fr
pcprofessor.com
ianaswanson.com
team-montage.dk
layrshift.eu
ftf.or.at
craigmccabe.fun
gadgetedges.com
luckypatcher-apkz.com
qualitaetstag.de
radaradvies.nl
importardechina.info
calabasasdigest.com
lapinvihreat.fi
hellohope.com
vermoote.de
work2live.de
dutchcoder.nl
boompinoy.com
durganews.com
norovirus-ratgeber.de
senson.fi
delchacay.com.ar
forestlakeuca.org.au
assurancesalextrespaille.fr
euro-trend.pl
lionware.de
antiaginghealthbenefits.com
12starhd.online
bristolaeroclub.co.uk
abitur-undwieweiter.de
fannmedias.com
abuelos.com
mediaclan.info
jacquin-maquettes.com
dontpassthepepper.com
kevinjodea.com
offroadbeasts.com
zervicethai.co.th
blogdecachorros.com
sabel-bf.com
citymax-cr.com
shiftinspiration.com
plotlinecreative.com
8449nohate.org
outcomeisincome.com
spsshomeworkhelp.com
argenblogs.com.ar
danholzmann.com
buymedical.biz
jorgobe.at
micahkoleoso.de
familypark40.com
glennroberts.co.nz
nativeformulas.com
elimchan.com
triactis.com
ncid.bc.ca
nataschawessels.com
diversiapsicologia.es
controldekk.com
agence-referencement-naturel-geneve.net
lykkeliv.net
extensionmaison.info
cuppacap.com
nakupunafoundation.org
peterstrobos.com
shiresresidential.com
geekwork.pl
rerekatu.com
broseller.com
marcuswhitten.site
neuschelectrical.co.za
bundabergeyeclinic.com.au
nachhilfe-unterricht.com
advizewealth.com
boisehosting.net
dezatec.es
desert-trails.com
ai-spt.jp
ligiercenter-sachsen.de
zieglerbrothers.de
mepavex.nl
nicoleaeschbachorg.wordpress.com
educar.org
pmcimpact.com
hiddencitysecrets.com.au
platformier.com
gasolspecialisten.se
uimaan.fi
n1-headache.com
shadebarandgrillorlando.com
bodyforwife.com
abogadoengijon.es
blumenhof-wegleitner.at
stemenstilte.nl
noixdecocom.fr
tanzprojekt.com
austinlchurch.com
maineemploymentlawyerblog.com
cursosgratuitosnainternet.com
amylendscrestview.com
quizzingbee.com
christ-michael.net
haremnick.com
allamatberedare.se
bargningharnosand.se
coastalbridgeadvisors.com
ulyssemarketing.com
uranus.nl
kariokids.com
refluxreducer.com
pinkexcel.com
werkkring.nl
dirittosanitario.biz
webmaster-peloton.com
insidegarage.pl
div-vertriebsforschung.de
alysonhoward.com
bafuncs.org
narcert.com
stormwall.se
arteservicefabbro.com
gantungankunciakrilikbandung.com
southeasternacademyofprosthodontics.org
solinegraphic.com
theadventureedge.com
kindersitze-vergleich.de
rocketccw.com
thenewrejuveme.com
autofolierung-lu.de
tuuliautio.fi
allure-cosmetics.at
videomarketing.pro
new.devon.gov.uk
bockamp.com
urmasiimariiuniri.ro
x-ray.ca
sachnendoc.com
portoesdofarrobo.com
deprobatehelp.com
sterlingessay.com
verytycs.com
quemargrasa.net
ziegler-praezisionsteile.de
ledmes.ru
herbayupro.com
effortlesspromo.com
better.town
makeflowers.ru
esope-formation.fr
bxdf.info
romeguidedvisit.com
ncuccr.org
global-kids.info
baumkuchenexpo.jp
oncarrot.com
advokathuset.dk
em-gmbh.ch
falcou.fr
d1franchise.com
besttechie.com
darrenkeslerministries.com
bestbet.com
patrickfoundation.net
stallbyggen.se
villa-marrakesch.de
body-guards.it
xlarge.at
ostheimer.at
xoabigail.com
krcove-zily.eu
garage-lecompte-rouen.fr
koken-voor-baby.nl
dutchbrewingcoffee.com
brandl-blumen.de
slashdb.com
sojamindbody.com
ikads.org
creative-waves.co.uk
commonground-stories.com
punchbaby.com
backstreetpub.com
judithjansen.com
girlillamarketing.com
grupocarvalhoerodrigues.com.br
dsl-ip.de
polymedia.dk
artotelamsterdam.com
myzk.site
themadbotter.com
gratispresent.se
ora-it.de
analiticapublica.es
zimmerei-fl.de
associacioesportivapolitg.cat
lefumetdesdombes.com
aurum-juweliere.de
testcoreprohealthuk.com
profectis.de
walkingdeadnj.com
asgestion.com
simplyblessedbykeepingitreal.com
happyeasterimages.org
lecantou-coworking.com
DupontSellsHomes.com
kampotpepper.gives
praxis-management-plus.de
mindpackstudios.com
minipara.com
vibehouse.rw
symphonyenvironmental.com
parebrise-tla.fr
waywithwords.net
otto-bollmann.de
greenpark.ch
precisionbevel.com
mariposapropaneaz.com
securityfmm.com
naturavetal.hr
directwindowco.com
norpol-yachting.com
highimpactoutdoors.net
iviaggisonciliegie.it
employeesurveys.com
leather-factory.co.jp
sloverse.com
modestmanagement.com
woodleyacademy.org
zflas.com
tanciu.com
interactcenter.org
resortmtn.com
verifort-capital.de
ceres.org.au
crowd-patch.co.uk
saxtec.com
milsing.hr
art2gointerieurprojecten.nl
itelagen.com
caribdoctor.org
jadwalbolanet.info
seproc.hn
pocket-opera.de
conasmanagement.de
phantastyk.com
vdberg-autoimport.nl
pawsuppetlovers.com
memaag.com
rozemondcoaching.nl
tinkoff-mobayl.ru
balticdentists.com
jandaonline.com
ouryoungminds.wordpress.com
thedad.com
waveneyrivercentre.co.uk
antonmack.de
harpershologram.wordpress.com
nmiec.com
liveottelut.com
tulsawaterheaterinstallation.com
charlottepoudroux-photographie.fr
y-archive.com
truenyc.co
filmvideoweb.com
greenfieldoptimaldentalcare.com
naturstein-hotte.de
satyayoga.de
evologic-technologies.com
hkr-reise.de
ymca-cw.org.uk
todocaracoles.com
cleliaekiko.online
rieed.de
oneheartwarriors.at
yousay.site
mooshine.com
lachofikschiet.nl
hypozentrum.com
no-plans.com
sandd.nl
run4study.com
webhostingsrbija.rs
ftlc.es
nuzech.com
notmissingout.com
101gowrie.com
hatech.io
streamerzradio1.site
copystar.co.uk
pasivect.co.uk
labobit.it
slimidealherbal.com
theduke.de
pv-design.de
dushka.ua
dinslips.se
lusak.at
lapinlviasennus.fi
apolomarcas.com
fayrecreations.com
physiofischer.de
actecfoundation.org
logopaedie-blomberg.de
sinal.org
lmtprovisions.com
wmiadmin.com
chaotrang.com
homesdollar.com
harveybp.com
4net.guru
bsaship.com
theletter.company
moveonnews.com
chandlerpd.com
koko-nora.dk
pferdebiester.de
kamahouse.net
alvinschwartz.wordpress.com
vloeren-nu.nl
thomas-hospital.de
intecwi.com
edrcreditservices.nl
centrospgolega.com
tradiematepro.com.au
ralister.co.uk
globedivers.wordpress.com
coding-machine.com
kirkepartner.dk
teczowadolina.bytom.pl
psnacademy.in
connectedace.com
toponlinecasinosuk.co.uk
levihotelspa.fi
drfoyle.com
first-2-aid-u.com
eraorastudio.com
sporthamper.com
carrybrands.nl
brevitempore.net
bigbaguettes.eu
iqbalscientific.com
upplandsspar.se
foryourhealth.live
jerling.de
kidbucketlist.com.au
kojima-shihou.com
ctrler.cn
kissit.ca
lloydconstruction.com
aarvorg.com
edelman.jp
expandet.dk
tecnojobsnet.com
sportsmassoren.com
figura.team
smhydro.com.pl
dr-seleznev.com
chefdays.de
campusoutreach.org
notsilentmd.org
navyfederalautooverseas.com
gasbarre.com
innote.fi
castillobalduz.es
www1.proresult.no
malychanieruchomoscipremium.com
degroenetunnel.com
admos-gleitlager.de
insigniapmg.com
adultgamezone.com
montrium.com
toreria.es
appsformacpc.com
thaysa.com
denifl-consulting.at
sanaia.com
richard-felix.co.uk
katketytaanet.fi
oceanastudios.com
urist-bogatyr.ru
renergysolution.com
drnice.de
ontrailsandboulevards.com
live-con-arte.de
musictreehouse.net
jobcenterkenya.com
markelbroch.com
rebeccarisher.com
sweering.fr
proudground.org
vesinhnha.com.vn
schlafsack-test.net
pogypneu.sk
jiloc.com
smale-opticiens.nl
hashkasolutindo.com
maxadams.london
binder-buerotechnik.at
abogadosaccidentetraficosevilla.es
sarbatkhalsafoundation.org
elpa.se
fitnessbazaar.com
plv.media
ussmontanacommittee.us
ra-staudte.de
triggi.de
blgr.be
otsu-bon.com
mediaacademy-iraq.org
cerebralforce.net
ecopro-kanto.com
smart-light.co.uk
mrtour.site
mytechnoway.com
mbfagency.com
deschl.net
boosthybrid.com.au
trackyourconstruction.com
xtptrack.com
ilive.lt
kafu.ch
vanswigchemdesign.com
chrissieperry.com
maratonaclubedeportugal.com
drugdevice.org
vihannesporssi.fi
commercialboatbuilding.com
aselbermachen.com
synlab.lt
biortaggivaldelsa.com
friendsandbrgrs.com
digi-talents.com
hokagestore.com
d2marketing.co.uk
bargningavesta.se
burkert-ideenreich.de
tigsltd.com
jasonbaileystudio.com
artige.com
atalent.fi
myteamgenius.com
turkcaparbariatrics.com
aminaboutique247.com
igrealestate.com
schutting-info.nl
mediaplayertest.net
catholicmusicfest.com
sipstroysochi.ru
jakekozmor.com
projetlyonturin.fr
michaelsmeriglioracing.com
lange.host
dublikator.com
aodaichandung.com
bouquet-de-roses.com
heliomotion.com
edgewoodestates.org
nurturingwisdom.com
rksbusiness.com
accountancywijchen.nl
henricekupper.com
havecamerawilltravel2017.wordpress.com
whyinterestingly.ru
easytrans.com.au
nokesvilledentistry.com
vetapharma.fr
slwgs.org
milanonotai.it
petnest.ir
ccpbroadband.com
zso-mannheim.de
fiscalsort.com
cuspdental.com
ncs-graphic-studio.com
carlosja.com
yamalevents.com
bigasgrup.com
justinvieira.com
tips.technology
siluet-decor.ru
ruralarcoiris.com
abogados-en-alicante.es
mikeramirezcpa.com
sobreholanda.com
tonelektro.nl
newyou.at
chatizel-paysage.fr
hoteledenpadova.it
the-domain-trader.com
slimani.net
lynsayshepherd.co.uk
boulderwelt-muenchen-west.de
kaliber.co.jp
smejump.co.th
jenniferandersonwriter.com
parkstreetauto.net
trulynolen.co.uk
imadarchid.com
lucidinvestbank.com
biapi-coaching.fr
maasreusel.nl
newstap.com.ng
the-virtualizer.com
beyondmarcomdotcom.wordpress.com
argos.wityu.fund
tux-espacios.com
kuntokeskusrok.fi
stingraybeach.com
cyntox.com
spargel-kochen.de
macabaneaupaysflechois.com
pixelarttees.com
walter-lemm.de
xltyu.com
anteniti.com
forskolorna.org
deltacleta.cat
mdacares.com
mirkoreisser.de
botanicinnovations.com
manijaipur.com
bptdmaluku.com
pasvenska.se
hairnetty.wordpress.com
seagatesthreecharters.com
kisplanning.com.au
mapawood.com
tastewilliamsburg.com
rushhourappliances.com
seevilla-dr-sturm.at
bodyfulls.com
pier40forall.org
edv-live.de
greenko.pl
c2e-poitiers.com
serce.info.pl
ecoledansemulhouse.fr
spd-ehningen.de
rimborsobancario.net
kalkulator-oszczednosci.pl
healthyyworkout.com
sanyue119.com
tampaallen.com
rhinosfootballacademy.com
merzi.info
aakritpatel.com
blewback.com
americafirstcommittee.org
mrsplans.net
vietlawconsultancy.com
i-arslan.de
homecomingstudio.com
strandcampingdoonbeg.com
vitavia.lt
huesges-gruppe.de
cnoia.org
kenhnoithatgo.com
leoben.at
ogdenvision.com
-
net
false
-
pid
$2a$10$mKbuAybjn4W3ipQCt6E7ROYxmL5SSZgUbPuA7PKUsPqJU10KB4bma
-
prc
oracle
klnagent
mydesktopqos
infopath
BackupExtender
powerpnt
outlook
BackupAgent
Smc
sql
ccSvcHst
BackupUpdater
Rtvscan
winword
kavfsscs
ocssd
isqlplussvc
visio
ShadowProtectSvc
tbirdconfig
TSSchBkpService
dbeng50
ccSetMgr
agntsvc
Sage.NA.AT_AU.SysTray
dbsnmp
thebat
onenote
AmitiAvSrv
wordpad
msaccess
avgadmsv
thunderbird
BackupMaint
Microsoft.exchange.store.worker.exe
CarboniteUI
excel
SPBBCSvc
LogmeInBackupService
encsvc
ocomm
sqbcoreservice
NSCTOP
mydesktopservice
kavfs
kavfswp
ocautoupds
mspub
xfssvccon
DLOAdminSvcu
synctime
lmibackupvssservice
firefox
steam
dlomaintsvcu
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). =========Attention!!!========= Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. ============================== [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
7114
-
svc
Telemetryserver
"Sophos AutoUpdate Service"
sophos
Altaro.Agent.exe
mysqld
MSSQL$MSGPMR
"SophosFIM"
"Sophos Web Control Service"
SQLWriter
svcGenericHost
AltiBack
"SQLServer Analysis Services (MSSQLSERVER)"
BackupExecAgentAccelerator
"StorageCraft ImageReady"
SQLTELEMETRY
AzureADConnectAuthenticationAgent
ntrtscan
ds_notifier
TeamViewer
"StorageCraft Raw Agent"
"StorageCraft Shadow Copy Provider"
SQLTELEMETRY$SQLEXPRESS
VeeamHvIntegrationSvc
AltiCTProxy
MsDtsServer130
ViprePPLSvc
McAfeeFramework
MSSQL$QM
"swi_service"
"ThreadLocker"
ofcservice
AUService
sophossps
AzureADConnectHealthSyncMonitor
Altaro.OffsiteServer.UI.Service.exe
"SAVAdminService"
ds_monitor
ALTIVRM
SSASTELEMETRY
TmCCSF
MsDtsServer110
"Sophos MCS Client"
TMBMServer
SBAMSvc
mfewc
"Sophos System Protection Service"
MSSQLFDLauncher$TESTBACKUP02DEV
VeeamDeploymentService
masvc
backup
MSSQL$SQLEXPRESS
AltiPhoneServ
MSSQLServerOLAPService
SSISTELEMETRY130
VeeamEndpointBackupSvc
mepocs
Altaro.UI.Service.exe
"ds_agent"
HuntressUpdater
MSSQLFDLauncher
"Sophos File Scanner Service"
SQLAgent$MSGPMR
ADSync
KaseyaAgent
ReportServer
MSSQLFDLauncher$SQLEXPRESS
MSSQL$HPWJA
KaseyaAgentEndpoint
VeeamTransportSvc
"ds_monitor"
mfevtp
MSSQLTESTBACKUP02DEV
SQLTELEMETRY$MSGPMR
ThreadLocker
MSSQLServerADHelper100
veeam
tmlisten
AzureADConnectHealthSyncInsights
"swi_filter"
MsDtsServer120
ProtectedStorage
VeeamDeploySvc
memtas
ds_agent
VeeamMountSvc
HuntressAgent
SQLAgent$SQLEXPRESS
bedbg
MSSQLSERVER
"ofcservice"
VipreAAPSvc
"Sophos Endpoint Defense Service"
KACHIPS906995744173948
DsSvc
MSSQLLaunchpad$SQLEXPRESS
msseces
macmnsvc
LTService
Code42Service
Altaro.HyperV.WAN.RemoteService.exe
LTSvcMon
MSSQL$SQLEXPRESSADV
"SAVService"
Altaro.OffsiteServer.Service.exe
"Sage 100cloud Advanced 2020 (9920)"
Altaro.SubAgent.exe
mfemms
"TeamViewer"
"SQLServer Reporting Services (MSSQLSERVER)"
VSS
sql
Altaro.SubAgent.N2.exe
"SQLServer Integration Services 12.0"
SQLSERVERAGENT
vss
"Sophos Safestore Service"
klnagent
"Sage.NA.AT_AU.Service"
MBAMService
"Sophos Health Service"
SQLBrowser
MySQL
"ProtectedStorage"
"Sophos Clean Service"
"Sage 100c Advanced 2017 (9917)"
"SntpService"
VeeamNFSSvc
KAVFS
SQLEXPRESSADV
KAENDCHIPS906995744173948
sppsvc
Amsp
psqlWGE
Microsoft.exchange.store.worker.exe
kavfsscs
"Amsp"
sqlservr
Altaro.DedupService.exe
svc$
"ds_notifier"
"Sophos Device Control Service"
AzureADConnectAgentUpdater
AltiFTPUploader
"Sophos MCS Agent"
Extracted
C:\Users\3b61kze1-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/671E6736B5450D98
http://decoder.re/671E6736B5450D98
Extracted
C:\Recovery\75853c-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D8E91A9E20C05975
http://decoder.re/D8E91A9E20C05975
Targets
-
-
Target
DomainName.exe
-
Size
160KB
-
MD5
6023d7082c077af7f45ac812a576f113
-
SHA1
74033be723ac674bc8244cd33410f778ae275ddf
-
SHA256
9cf2bb3ba92b075e1a53d6a03461bc5d656a744e891683d20650c4e4515b9201
-
SHA512
46100b5053a7f2a42d9fd05791996f6e0289cd5c0a2e47c1a911ed190e00745c4ac733a937a4e06068118673b72a1c189c73423995d177777b38ed7a98ce3627
-
SSDEEP
1536:JxqjQ+P04wsmJC6pzK88ICS4Aer9DIPcG5zXbwMcClFyFfjRto2+i0BH8A4krBJC:sr85CuZE0cOzbwMflEBPoq/LPrlA0
-
Detect Neshta payload
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies system executable filetype association
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Event Triggered Execution
1Change Default File Association
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Event Triggered Execution
1Change Default File Association
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1