General
-
Target
2024-01-24_f89c4e63b3ad5dcc550ca20afb4e8be3_revil_sodinokibi
-
Size
139KB
-
Sample
240124-y9s4fagghk
-
MD5
f89c4e63b3ad5dcc550ca20afb4e8be3
-
SHA1
63379dd5a69d289df9f52affcf9c0dfe100800fa
-
SHA256
0f58625addd69f66282924298d843f12f7c2dc2e4d6571952830b880c08cdfee
-
SHA512
438c307f53e14c75c43b998f066367ec7ccec3511422bb11c2695941c1aee89cc0fc5a46a975fd96b62d082e8547f04df0e6222c450b7cedea9633cabce8523f
-
SSDEEP
3072:wi8Iy8EytSLbi4eTMlwDCnuZgDZIxnWOcCU:B8IUykbnWJZgDMWOcCU
Behavioral task
behavioral1
Sample
2024-01-24_f89c4e63b3ad5dcc550ca20afb4e8be3_revil_sodinokibi.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-24_f89c4e63b3ad5dcc550ca20afb4e8be3_revil_sodinokibi.exe
Resource
win10v2004-20231222-en
Malware Config
Extracted
sodinokibi
8
27
tweedekansenloket.nl
adabible.org
magrinya.net
pankiss.ru
eksperdanismanlik.com
jax-interim-and-projectmanagement.com
motocrosshideout.com
apiarista.de
fla.se
kellengatton.com
letterscan.de
awaisghauri.com
forumsittard.nl
evsynthacademy.org
birthplacemag.com
epsondriversforwindows.com
slideevents.be
xtensifi.com
tecleados.com
triavlete.com
opt4cdi.com
ownidentity.com
livedeveloper.com
redpebblephotography.com
molade.nl
tesisatonarim.com
ebible.co
randyabrown.com
bendel-partner.de
whoopingcrane.com
3daywebs.com
spartamovers.com
heimdalbygg.no
wg-heiligenstadt.de
ziliak.com
imajyuku-sozoku.com
sprintcoach.com
iron-mine.ru
fysiotherapierijnmond.nl
biketruck.de
justaroundthecornerpetsit.com
techybash.com
topautoinsurers.net
andreaskildegaard.dk
precisetemp.com
cac2040.com
shortsalemap.com
photographycreativity.co.uk
envomask.com
haus-landliebe.de
jalkapuu.net
letsstopsmoking.co.uk
iexpert99.com
geoweb.software
avisioninthedesert.com
sarahspics.co.uk
hartofurniture.com
xn--ziinoapte-6ld.ro
scietech.academy
pro-gamer.pl
leijstrom.com
terraflair.de
ludoil.it
beandrivingschool.com.au
bratek-immobilien.de
concontactodirecto.com
theater-lueneburg.de
narca.net
thegrinningmanmusical.com
zdrowieszczecin.pl
denhaagfoodie.nl
ketomealprep.academy
finnergo.eu
craftingalegacy.com
billyoart.com
wrinstitute.org
rentingwell.com
oncarrot.com
bertbutter.nl
peninggibadan.co.id
alattekniksipil.com
jmmartinezilustrador.com
khtrx.com
interlinkone.com
ocduiblog.com
bajova.sk
qandmmusiccenter.com
nationnewsroom.com
powershell.su
mariamalmahdi.com
supercarhire.co.uk
zumrutkuyutemel.com
elitkeramika-shop.com.ua
unboxtherapy.site
min-virksomhed.dk
buerocenter-butzbach-werbemittel.de
martinipstudios.com
heuvelland-oaze.nl
1deals.com
broccolisoep.nl
sealgrinderpt.com
keyboardjournal.com
christopherhannan.com
dentallabor-luenen.de
wirmuessenreden.com
ncn.nl
avtoboss163.ru:443
reizenmetkinderen.be
angelika-schwarz.com
cymru.futbol
kuriero.pro
delegationhub.com
reputation-medical.online
xrresources.com
benchbiz.com
acibademmobil.com.tr
wordpress.idium.no
louiedager.com
dogsunlimitedguide.com
rarefoods.ro
pharmeko-group.com
drvoip.com
larchwoodmarketing.com
citiscapes-art.com
ddmgen.com
efficiencyconsulting.es
frankgoll.com
jlwilsonbooks.com
fanuli.com.au
so-sage.fr
stathmoulis.gr
lassocrm.com
profibersan.com
purepreprod4.com
drnelsonpediatrics.com
cxcompany.com
nourella.com
biodentify.ai
ronielyn.com
ivancacu.com
agriturismocastagneto.it
loparnille.se
aktivfriskcenter.se
sharonalbrightdds.com
metallbau-hartmann.eu
happylublog.wordpress.com
gatlinburgcottage.com
simpleitsolutions.ch
muller.nl
kausette.com
fire-space.com
tzn.nu
fitnessblenderstory.com
skoczynski.eu
xn--80addfr4ahr.dp.ua
suonenjoen.fi
xn--80abehgab4ak0ddz.xn--p1ai
alaskaremote.com
malzomattalar.com
aquacheck.co.za
martha-frets-ceramics.nl
lifeinbreaths.com
brunoimmobilier.com
go.labibini.ch
jaaphoekzema.nl
cascinarosa33.it
startuplive.org
mamajenedesigns.com
encounter-p.net
deduktia.fi
proffteplo.com
opticahubertruiz.com
hekecrm.com
jayfurnitureco.com
shortysspices.com
leatherjees.com
fotoslubna.com
levencovka.ru
metroton.ru
directique.com
unexplored.gr
nutriwell.com.sg
cainlaw-okc.com
gsconcretecoatings.com
nauticmarine.dk
pinthelook.com
andrealuchesi.it
babysitting-hk.helpergo.co
paprikapod.com
dentourage.com
vipcarrental.ae
log-barn.co.uk
happycatering.de
alcye.com
humanviruses.org
adterium.com
ramirezprono.com
90nguyentuan.com
skolaprome.eu
9nar.com
grafikstudio-visuell.de
christianscholz.de
buffdaddyblog.com
nginx.com
scentedlair.com
cl0nazepamblog.com
corporacionrr.com
victorvictoria.com
perceptdecor.com
jacquesgarcianoto.com
kerstliedjeszingen.nl
tetameble.pl
zorgboerderijravensbosch.nl
stagefxinc.com
fridakids.com
nbva.co.uk
angelsmirrorus.com
bakingismyyoga.com
fixx-repair.com
silkeight.com
testitjavertailut.net
pedmanson.com
xn--billigafrgpatroner-stb.se
triplettagaite.fr
rsidesigns.com
jdscenter.com
artcase.pl
arazi.eus
aciscomputers.com
kookooo.com
ahgarage.com
airvapourbarrier.com
burg-zelem.de
foerderverein-vatterschule.de
globalcompliancenews.com
phoenixcrane.com
sachainchiuk.com
goodboyscustom.com
pays-saint-flour.fr
premiumweb.com.ua:443
smarttourism.academy
belofloripa.be
osn.ro
energosbit-rp.ru
matteoruzzaofficial.com
mrcar.nl
istantidigitali.com
guohedd.com
liverpoolabudhabi.ae
mindsparkescape.com
dcc-eu.com
maryairbnb.wordpress.com
cc-experts.de
etgdogz.de
nepressurecleaning.com
hostastay.com
rvside.com
charlottelhanna.com
gavelmasters.com
sellthewrightway.com
dantreranch.com
imaginekithomes.co.nz
putzen-reinigen.com
cormanmarketing.com
qrs-international.com
thisprettyhair.com
scotlandsroute66.co.uk
ronaldhendriks.nl
kamin-somnium.de
digitale-elite.de
blueridgeheritage.com
limmortelyouth.com
agendatwentytwenty.com
bluemarinefoundation.com
parisschool.ru
activeterroristwarningcompany.com
ikadomus.com
dmlcpa.com
klapanvent.ru
rtc24.com
innervisions-id.com
webforsites.com
kryptos72.com
dibli.store
chinowarehousespace.com
alpesiberie.com
mrkluttz.com
janmorgenstern.com
forextimes.ru
midwestschool.org
fskhjalmar.se
ledyoucan.com
pilotgreen.com
oraweb.net
stoneridgemontessori.com
lovetzuchia.com
jobscore.com
margaretmcshane.com
utilisacteur.fr
schulz-moelln.de
rivermusic.nl
rhino-turf.com
tramadolhealth.com
oportowebdesign.com
goodherbalhealth.com
jonnyhooley.com
egpu.fr
davedavisphotos.com
k-zubki.ru
ceocenters.com
hawthornsretirement.co.uk
radishallgood.com
noda.com.ua
linkbuilding.life
veggienessa.com
michaelfiegel.com
domilivefurniture.com
outstandingminialbums.com
johnsonweekly.com
markseymourphotography.co.uk
rishigangoly.com
teamsegeln.ch
bescomedical.de
optigas.com
entdoctor-durban.com
expohomes.com
wallflowersandrakes.com
jglconsultancy.com
kryddersnapsen.dk
yournextshoes.com
chomiksy.net
5thactors.com
sshomme.com
baptistdistinctives.org
specialtyhomeservicesllc.com
thenalpa.com
hnkns.com
nepal-pictures.com
renehartman.nl
explora.nl
glende-pflanzenparadies.de
ingresosextras.online
o2o-academy.com
mayprogulka.ru
mediogiro.com.ar
alharsunindo.com
line-x.co.uk
banukumbak.com
thepixelfairy.com
jag.me
neolaiamedispa.com
2020hindsight.info
brannbornfastigheter.se
alexwenzel.de
transifer.fr
neonodi.be
invela.dk
amco.net.au
maxcube24.com.ua
fsbforsale.com
drbrianhweeks.com
greeneyetattoo.com
deziplan.ru
jobkiwi.com.ng
verbouwingsdouche.nl
tchernia-conseil.fr
solutionshosting.co.uk
physio-lang.de
annenymus.com
yourcosmicbeing.com
otpusk.zp.ua
biblica.com
polynine.com
dnqa.co.uk
alltagsrassismus-entknoten.de
brinkdoepke.eu
kvetymichalovce.sk
finsahome.co.uk
pourlabretagne.bzh
juergenblaetz.de
ruggestar.ch
amorbellezaysalud.com
ninjaki.com
leansupremegarcinia.net
greatofficespaces.net
liepertgrafikweb.at
funworx.de
oro.ae
latableacrepes-meaux.fr
laylavalentine.com
a-zpaperwork.eu
bulyginnikitav.000webhostapp.com
graygreenbiomedservices.com
awag-blog.de
carmel-york.com
aheadloftladders.co.uk
parentsandkids.com
craftron.com
richardiv.com
spectamarketingdigital.com.br
rattanwarehouse.co.uk
ultimatelifesource.com
abulanov.com
soncini.ch
atma.nl
smartercashsystem.com
fann.ru
pansionatblago.ru
taulunkartano.fi
baumfinancialservices.com
stringnosis.academy
internestdigital.com
jobstomoveamerica.org
licensed-public-adjuster.com
furland.ru
circuit-diagramz.com
photonag.com
sochi-okna23.ru
zinnystar.com
grancanariaregional.com
azloans.com
bringmehope.org
baikalflot.ru
dinecorp.com
racefietsenblog.nl
aslog.fr
volta.plus
anchelor.com
sambaglow.com
boloria.de
therapybusinessacademy.com
kiraribeaute-nani.com
denverwynkoopdentist.com
dreamvoiceclub.org
mjk.digital
texanscan.org
worldproskitour.com
qwikcoach.com
eshop.design
johnstonmingmanning.com
mgimalta.com
arabianmice.com
rapid5kloan.org
skyscanner.ro
beauty-traveller.com
pinkxgayvideoawards.com
makingmillionaires.net
hutchstyle.co.uk
galatee-couture.com
bridalcave.com
salonlamar.nl
mazift.dk
towelroot.co
insane.agency
albcleaner.fr
bundan.com
lovcase.com
indiebizadvocates.org
artvark.nl
smartworkplaza.com
apogeeconseils.fr
voice2biz.com
devplus.be
111firstdelray.com
grupoexin10.com
jefersonalessandro.com
yuanshenghotel.com
morgansconsult.com
dennisverschuur.com
jimprattmediations.com
lagschools.ng
holocine.de
carsten.sparen-it.de
malevannye.ru
lesyeuxbleus.net
computer-place.de
shrinkingplanet.com
julielusktherapy.com
ygallerysalonsoho.com:443
the5thquestion.com
peppergreenfarmcatering.com.au
thestudio.academy
drbenveniste.com
thiagoperez.com
cyberpromote.de
eastgrinsteadwingchun.com
vdolg24.online
newonestop.com
nevadaruralhousingstudies.org
animalfood-online.de
betterce.com
arthakapitalforvaltning.dk
gratiocafeblog.wordpress.com
rizplakatjaya.com
docarefoundation.org
thehovecounsellingpractice.co.uk
pxsrl.it
gazelle-du-web.com
acornishstudio.co.uk
saint-malo-developpement.fr
site.markkit.com.br
der-stempelking.de
afbudsrejserallinclusive.dk
masecologicos.com
business-basic.de
citydogslife.com
agrifarm.dk
nykfdyrehospital.dk
diakonie-weitramsdorf-sesslach.de
queertube.net
chris-anne.com
descargandoprogramas.com
hameghlim.com
landgoedspica.nl
ykobbqchicken.ca
voetbalhoogeveen.nl
greenrider.nl
leadforensics.com
baita.ac
projektparkiet.pl
mollymccarthydesign.com
natturestaurante.com.br
michal-s.co.il
rossomattonecase.it
mediabolmong.com
augen-praxisklinik-rostock.de
kenmccallum.com
successcolony.com.ng
paradigmlandscape.com
luvbec.com
catalyseurdetransformation.com
unislaw-narty.pl
gosouldeep.com
frimec-international.es
pokemonturkiye.com
aberdeenartwalk.org
patassociation.com
zealcon.ae
mneti.ru
domaine-des-pothiers.com
aidanpublishing.co.uk
framemyballs.com
crestgood.com
studionumerik.fr
irizar.com
bjornvanvulpen.nl
perfectgrin.com
medicalsupportco.com
centuryvisionglobal.com
itheroes.dk
saboboxtel.uk
alisodentalcare.com
bavovrienden.nl
renderbox.ch
trainiumacademy.com
rs-danmark.dk
pazarspor.org.tr
stage-infirmier.fr
onesynergyinternational.com
adaduga.info
daveystownhouse.com
geitoniatonaggelon.gr
motocrossplace.co.uk
chatberlin.de
mikegoodfellow.co.uk
prodentalblue.com
adedesign.com
kafkacare.com
gbk-tp1.de
leloupblanc.gr
awaitspain.com
olry-cloisons.fr
dayenne-styling.nl
cuadc.org
globalskills.pt
jeanmonti.com
walterman.es
avis.mantova.it
asiaartgallery.jp
easydental.ae
ufovidmag.com
bellesiniacademy.org
fotoeditores.com
apmollerpension.com
eafx.pro
stanleyqualitysystems.com
suitesartemis.gr
kompresory-opravy.com
metriplica.academy
lattalvor.com
coachpreneuracademy.com
global-migrate.com
imagine-entertainment.com
zwemofficial.nl
wribrazil.com
annida.it
eurethicsport.eu
mazzaropi.com.br
krishnabrawijaya.com
creohn.de
lsngroupe.com
brownswoodblog.com
elex.is
kartuindonesia.com
lapponiasafaris.com
electricianul.com
banksrl.co.za
signededenroth.dk
janasfokus.com
welovecustomers.fr
lollachiro.com
reygroup.pt
rename.kz
lgiwines.com
iactechnologies.net
acumenconsultingcompany.com
hensleymarketing.com
ncjc.ca
factorywizuk.com
direitapernambuco.com
bookingwheel.com
sbit.ag
watchsale.biz
akwaba-safaris.com
spirello.nl
11.in.ua
hawaiisteelbuilding.com
factoriareloj.com
sweetz.fr
ya-elka.ru
m2graph.fr
soundseeing.net
altocontatto.net
galaniuklaw.com
cookinn.nl
skidpiping.de
slotspinner.com
mursall.de
glas-kuck.de
blucamp.com
astrographic.com
affligemsehondenschool.be
ntinasfiloxenia.gr
bodymindchallenger.com
onlinemarketingsurgery.co.uk
production-stills.co.uk
protoplay.ca
tbalp.co.uk
muni.pe
edvestors.org
prometeyagro.com.ua
n-newmedia.de
breakluckrecords.com
bohrlochversicherung.info
agencewho-aixenprovence.fr
advanced-removals.co.uk
dinedrinkdetroit.com
skooppi.fi
diverfiestas.com.es
rozmata.com
altitudeboise.com
littlesaints.academy
rolleepollee.com
alabamaroofingllc.com
lunoluno.com
keuken-prijs.nl
espaciopolitica.com
bumbipdeco.site
promus.ca
girlish.ae
axisoflove.org:443
speiserei-hannover.de
vitormmcosta.com
kristianboennelykke.dk
billigeflybilletter.dk
vitoriaecoturismo.com.br
mike.matthies.de
campusescalade.com
frameshift.it
floweringsun.org
alwaysdc.com
cesep2019.com
kdbrh.com
aoyama.ac
goddardleadership.org
karelinjames.com
tages-geldvergleich.de
cmeow.com
curtsdiscountguns.com
aceroprime.com
singletonfinancial.com
laaisterplakky.nl
basindentistry.com
raeoflightmusic.com
gta-jjb.fr
lyricalduniya.com
satoblog.org
kemtron.fr
rhino-storage.co.uk
gaearoyals.com
rechtenplicht.be
tastevirginia.com
hospitalitytrainingsolutions.co.uk
hostaletdelsindians.es
linearete.com
saberconcrete.com
mesajjongeren.nl
sytzedevries.com
theintellect.edu.pk
vvego.com
zaczytana.com
craftstone.co.nz
modamarfil.com
traitware.com
poems-for-the-soul.ch
auberives-sur-vareze.fr
nvisionsigns.com
richardkershawwines.co.za
bruut.online
werkzeugtrolley.net
lumturo.academy
bychowo.pl
skinkeeper.li
druktemakersheerenveen.nl
antesacademy.it
belinda.af
universelle.fr
netadultere.fr
clemenfoto.dk
johnkoen.com
palmenhaus-erfurt.de
donau-guides.eu
manzel.tn
animation-pro.co.uk
bubbalucious.com
kickittickets.com
carolynfriedlander.com
housesofwa.com
from02pro.com
memphishealthandwellness.com
uci-france.fr
bayshoreelite.com
mrmac.com
edrickennedymacfoy.com
eyedoctordallas.com
advancedeyecare.com
rino-gmbh.com
ijsselbeton.nl
tellthebell.website
cotton-avenue.co.il
anleggsregisteret.no
nrgvalue.com
lexced.com
monstarrsoccer.com
cssp-mediation.org
strauchs-wanderlust.info
tatyanakopieva.ru
miscbo.it
arearugcleaningnyc.com
jandhpest.com
dr-vita.de
molinum.pt
azerbaycanas.com
hotelturbo.de
legundschiess.de
subquercy.fr
forskolinslimeffect.net
husetsanitas.dk
sjtpo.org
professionetata.com
cp-bap.de
dentalcircle.com
dierenambulancealkmaar.nl
advance-refle.com
trivselsguide.dk
bd2fly.com
patriotcleaning.net
liveyourheartout.co
web865.com
signamedia.de
trevi-vl.ru
c-sprop.com
kelsigordon.com
nalliasmali.net
akcadagofis.com
glennverschueren.be
hinotruckwreckers.com.au
limounie.com
gardenpartner.pl
marcandy.com
ced-elec.com
bcmets.info
colored-shelves.com
bonitabeachassociation.com
bg.szczecin.pl
stitch-n-bitch.com
tanatek.com
flossmoordental.com
look.academy
rentsportsequip.com
switch-made.com
hm-com.com
datatri.be
publicompserver.de
mangimirossana.it
livelai.com
silverbird.dk
myplaywin3.com
barbaramcfadyenjewelry.com
claudiakilian.de
sycamoregreenapts.com
mediahub.co.nz
lmmont.sk
boomerslivinglively.com
scholarquotes.com
tradenavigator.ch
yourhappyevents.fr
santastoy.store
jlgraphisme.fr
slotenmakerszwijndrecht.nl
mondolandscapes.com
ravage-webzine.nl
die-immo-agentur.de
bcabattoirs.org
marmarabasin.com
oscommunity.de
bluelakevision.com
k-v-f.de
agenceassemble.fr
berdonllp.com
pubcon.com
turing.academy
internalresults.com
auto-opel.ro
haard-totaal.nl
mindfuelers.com
jakubrybak.com
orchardbrickwork.com
stralsund-ansichten.de
teethinadaydentalimplants.com
devus.de
rubyaudiology.com
askstaffing.com
golfclublandgoednieuwkerk.nl
angeleyezstripclub.com
mind2muscle.nl
smartmind.net
bodet150ans.com
boyfriendsgoal.site
ox-home.com
gurutechnologies.net
omegamarbella.com
janellrardon.com
lidkopingsnytt.nu
thegetawaycollective.com
pajagus.fr
the3-week-diet.net
eventosvirtualesexitosos.com
groovedealers.ru
pureelements.nl
the-beauty-guides.com
cardsandloyalty.com
oexebusiness.com
tieronechic.com
lashandbrowenvy.com
profiz.com
cleanroomequipment.ie
piestar.com
bourchier.org
ciga-france.fr
innovationgames-brabant.nl
blavait.fr
ikzoekgod.be
vedsegaard.dk
nuohous.com
circlecitydj.com
bmw-i-pure-impulse.com
redctei.co
ilveshistoria.com
pisofare.co
hostingbangladesh.net
almamidwifery.com
airserviceunlimited.com
magnetvisual.com
block-optic.com
chainofhopeeurope.eu
stressreliefadvice.com
sololibrerie.it
eatyoveges.com
kosten-vochtbestrijding.be
fta-media.com
leopoldineroux.com
latteswithleslie.com
nieuwsindeklas.be
alnectus.com
karmeliterviertel.com
campinglaforetdetesse.com
t3brothers.com
atrgroup.it
mundo-pieces-auto.fr
comoserescritor.com
kombi-dress.com
amelielecompte.wordpress.com
campusce.com
valiant-voice.com
mercadodelrio.com
nxtstg.org
ayudaespiritualtamara.com
katherinealy.com
mbuildinghomes.com
5pointpt.com
advesa.com
palmecophilippines.com
buonabitare.com
initconf.com
agora-collectivites.com
placermonticello.com
buzzneakers.com
tilldeeke.de
yvesdoin-aquarelles.fr
endstarvation.com
spacebel.be
cincinnatiphotocompany.org
metcalfe.ca
luvinsburger.fr
pvandambv.nl
autoteamlast.de
sppdstats.com
palema.gr
alene.co
weddingceremonieswithtim.com
wineandgo.hu
futurenetworking.com
condormobile.fr
cmascd.com
billscars.net
clinic-beethovenstrasse-ag.ch
catering.com
elliemaccreative.wordpress.com
riffenmattgarage.ch
thesilkroadny.com
bagaholics.in
atelierkomon.com
hoteltantra.com
myfbateam.com
focuskontur.com
vapiano.fr
matthieupetel.fr
richardmaybury.co.uk
springfieldplumbermo.com
epicjapanart.com
eos-horlogerie.com
primemarineengineering.com
topvijesti.net
allinonecampaign.com
mariajosediazdemera.com
mustangmarketinggroup.com
skyboundnutrition.co.uk
phukienbepthanhdat.com
fidelitytitleoregon.com
penumbuhrambutkeiskei.com
b3b.ch
naukaip.ru
schlagbohrmaschinetests.com
charlesfrancis.photos
brighthillgroup.com
plbinsurance.com
ideamode.com
p-ride.live
tutvracks.com
chorusconsulting.net
kroophold-sjaelland.dk
fi-institutionalfunds.com
fbmagazine.ru
loysonbryan.com
duthler.nl
toranjtuition.org
wademurray.com
customroasts.com
mac-computer-support-hamburg.de
the-cupboard.co.uk
sber-biznes.com
fluzfluzrewards.com
g2mediainc.com
levelseven.be
zuerich-umzug.ch
collegetennis.info
o90.dk
fazagostar.co
omnicademy.com
handyman-silkeborg.dk
triplettabordeaux.fr
tothebackofthemoon.com
koncept-m.ru
wyreforest.net
enews-qca.com
hiddensee-buhne11.de
theboardroomafrica.com
brisbaneosteopathic.com.au
solidhosting.nl
inewsstar.com
uncensoredhentaigif.com
ilovefullcircle.com
cap29010.it
hypogenforensic.com
secrets-clubs.co.uk
moira-cristescu.com
four-ways.com
acb-gruppe.ch
schroederschoembs.com
rokthetalk.com
distrifresh.com
relevantonline.eu
hvitfeldt.dk
parksideseniorliving.net
nicksrock.com
witraz.pl
georgemuncey.com
cops4causes.org
enactusnhlstenden.com
achetrabalhos.com
mieleshopping.it
oththukaruva.com
amyandzac.com
catchup-mag.com
premier-iowa.com
schluesseldienste-hannover.de
hom-frisor.dk
teutoradio.de
hepishopping.com
nexstagefinancial.com
yayasanprimaunggul.org
breathebettertolivebetter.com
wasnederland.nl
bluetenreich-brilon.de
onlinetvgroup.com
smartspeak.com
napisat-pismo-gubernatoru.ru:443
mslp.org
quitescorting.com
sveneulberg.de
theatre-embellie.fr
jameswilliamspainting.com
innersurrection.com
test-teleachat.fr
designimage.ae
jollity.hu
goeppinger-teppichreinigung.de
harleystreetspineclinic.com
chatterchatterchatter.com
andermattswisswatches.ch
lookandseen.com
pixelhealth.net
stabilisateur.fr
operativadigital.com
mahikuchen.com
sunsolutions.es
logosindustries.com
bilius.dk
dieetuniversiteit.nl
parseport.com
subyard.com
fascaonline.com
mensemetgesigte.co.za
speakaudible.com
lisa-poncon.fr
paardcentraal.nl
endlessrealms.net
casinodepositors.com
selected-minds.de
csaballoons.com
mariannelemenestrel.com
hotjapaneselesbian.com
-
net
true
-
pid
8
-
prc
mysql.exe
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
27
Extracted
C:\Users\Default\63pp0ebyl-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/2EFB90FD3FB25C5A
http://decryptor.top/2EFB90FD3FB25C5A
Extracted
C:\Users\Admin\21935g8-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9AAA86F6F5807D04
http://decryptor.top/9AAA86F6F5807D04
Targets
-
-
Target
2024-01-24_f89c4e63b3ad5dcc550ca20afb4e8be3_revil_sodinokibi
-
Size
139KB
-
MD5
f89c4e63b3ad5dcc550ca20afb4e8be3
-
SHA1
63379dd5a69d289df9f52affcf9c0dfe100800fa
-
SHA256
0f58625addd69f66282924298d843f12f7c2dc2e4d6571952830b880c08cdfee
-
SHA512
438c307f53e14c75c43b998f066367ec7ccec3511422bb11c2695941c1aee89cc0fc5a46a975fd96b62d082e8547f04df0e6222c450b7cedea9633cabce8523f
-
SSDEEP
3072:wi8Iy8EytSLbi4eTMlwDCnuZgDZIxnWOcCU:B8IUykbnWJZgDMWOcCU
Score10/10-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Renames multiple (179) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-