General
-
Target
REvil_v2.06.exe
-
Size
121KB
-
Sample
240926-3rfgvaxbke
-
MD5
46a40ec6d39b7530830f3047cdebaa1b
-
SHA1
a1540914b5ceb9e772ee5898e777f48e3cd57010
-
SHA256
08c2d24cb9c632f9aa84254bb673c9df04d4ac23ee07e840794e9438b06e9bd2
-
SHA512
64d3bd219e939100612242a35d36db8636a18eb962ce174284359178b6abb29c957bb1a0083015b948ff17c30e01ddd46c12824a83d0698b03372effeae0aa12
-
SSDEEP
1536:vjVXKif7kaCtHM7qpo6ZQDtFnNi+ti09or2LkLpLik8ICS4Ao3uZskecjrzgPujd:J1MZwlLk9Bm3uWqgu6M1njIXi1
Static task
static1
Behavioral task
behavioral1
Sample
REvil_v2.06.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
REvil_v2.06.exe
Resource
win11-20240802-en
Malware Config
Extracted
sodinokibi
$2a$12$k6iq18BR3UU7uFyc.Pgy0e8GklmvcWyoi09nqzJkgxZN1vNGskAtC
7495
the-virtualizer.com
aminaboutique247.com
thaysa.com
aunexis.ch
allentownpapershow.com
plotlinecreative.com
spinheal.ru
darrenkeslerministries.com
peterstrobos.com
sanyue119.com
extraordinaryoutdoors.com
airconditioning-waalwijk.nl
ledmes.ru
all-turtles.com
euro-trend.pl
ausbeverage.com.au
micro-automation.de
easytrans.com.au
sandd.nl
wien-mitte.co.at
bargningavesta.se
spylista.com
comarenterprises.com
teknoz.net
boulderwelt-muenchen-west.de
cactusthebrand.com
c2e-poitiers.com
jerling.de
zervicethai.co.th
macabaneaupaysflechois.com
bptdmaluku.com
opatrovanie-ako.sk
lapinlviasennus.fi
travelffeine.com
outcomeisincome.com
cite4me.org
verbisonline.com
ausair.com.au
sahalstore.com
delchacay.com.ar
blewback.com
bodyfulls.com
autodemontagenijmegen.nl
fairfriends18.de
stampagrafica.es
makeitcount.at
richard-felix.co.uk
modelmaking.nl
web.ion.ag
extensionmaison.info
lusak.at
zweerscreatives.nl
gantungankunciakrilikbandung.com
mbxvii.com
stormwall.se
takeflat.com
levihotelspa.fi
rushhourappliances.com
hairnetty.wordpress.com
slimidealherbal.com
mirjamholleman.nl
onlyresultsmarketing.com
fitnessingbyjessica.com
huesges-gruppe.de
mapawood.com
norpol-yachting.com
twohourswithlena.wordpress.com
ralister.co.uk
zewatchers.com
mardenherefordshire-pc.gov.uk
mir-na-iznanku.com
polymedia.dk
notmissingout.com
gasbarre.com
you-bysia.com.au
kuntokeskusrok.fi
delawarecorporatelaw.com
lionware.de
femxarxa.cat
shonacox.com
nachhilfe-unterricht.com
embracinghiscall.com
dsl-ip.de
agence-chocolat-noir.com
bingonearme.org
kostenlose-webcams.com
jorgobe.at
portoesdofarrobo.com
theletter.company
campusoutreach.org
heidelbergartstudio.gallery
xltyu.com
classycurtainsltd.co.uk
sojamindbody.com
solhaug.tk
mdacares.com
i-trust.dk
devstyle.org
pridoxmaterieel.nl
iwr.nl
pasivect.co.uk
tanzschule-kieber.de
controldekk.com
erstatningsadvokaterne.dk
tanciu.com
deepsouthclothingcompany.com
tux-espacios.com
irinaverwer.com
woodleyacademy.org
4youbeautysalon.com
drnice.de
stopilhan.com
edelman.jp
irishmachineryauctions.com
galserwis.pl
krlosdavid.com
miriamgrimm.de
kath-kirche-gera.de
muamuadolls.com
tennisclubetten.nl
bhwlawfirm.com
mediaplayertest.net
crowd-patch.co.uk
memaag.com
associationanalytics.com
quemargrasa.net
sarbatkhalsafoundation.org
copystar.co.uk
longislandelderlaw.com
myhealth.net.au
interactcenter.org
schmalhorst.de
pinkexcel.com
thenewrejuveme.com
seproc.hn
ecpmedia.vn
celeclub.org
sportverein-tambach.de
judithjansen.com
architecturalfiberglass.org
andersongilmour.co.uk
tradiematepro.com.au
ecoledansemulhouse.fr
puertamatic.es
grelot-home.com
centrospgolega.com
karacaoglu.nl
dezatec.es
chatizel-paysage.fr
promalaga.es
bsaship.com
lloydconstruction.com
fotoscondron.com
morawe-krueger.de
beyondmarcomdotcom.wordpress.com
noskierrenteria.com
punchbaby.com
autopfand24.de
harpershologram.wordpress.com
surespark.org.uk
alten-mebel63.ru
connectedace.com
cafemattmeera.com
securityfmm.com
heurigen-bauer.at
alhashem.net
triggi.de
filmstreamingvfcomplet.be
vyhino-zhulebino-24.ru
stacyloeb.com
alfa-stroy72.com
sexandfessenjoon.wordpress.com
zonamovie21.net
thefixhut.com
digi-talents.com
y-archive.com
kisplanning.com.au
dinslips.se
imadarchid.com
ouryoungminds.wordpress.com
bunburyfreightservices.com.au
aodaichandung.com
veybachcenter.de
qualitaetstag.de
schoolofpassivewealth.com
malychanieruchomoscipremium.com
deltacleta.cat
klusbeter.nl
waywithwords.net
pawsuppetlovers.com
mrsplans.net
resortmtn.com
imaginado.de
ino-professional.ru
mank.de
vdberg-autoimport.nl
courteney-cox.net
paymybill.guru
pelorus.group
autofolierung-lu.de
esope-formation.fr
pmc-services.de
wmiadmin.com
smhydro.com.pl
anteniti.com
blossombeyond50.com
smartypractice.com
joyeriaorindia.com
DupontSellsHomes.com
labobit.it
socialonemedia.com
jasonbaileystudio.com
presseclub-magdeburg.de
better.town
sachnendoc.com
calabasasdigest.com
trapiantofue.it
spd-ehningen.de
rhinosfootballacademy.com
revezlimage.com
ra-staudte.de
maratonaclubedeportugal.com
mylolis.com
worldhealthbasicinfo.com
trulynolen.co.uk
firstpaymentservices.com
craftleathermnl.com
htchorst.nl
paradicepacks.com
rumahminangberdaya.com
microcirc.net
hexcreatives.co
dekkinngay.com
durganews.com
coding-marking.com
lykkeliv.net
asteriag.com
cnoia.org
asiluxury.com
echtveilig.nl
gadgetedges.com
ncs-graphic-studio.com
eadsmurraypugh.com
fayrecreations.com
abogadosadomicilio.es
upplandsspar.se
cleliaekiko.online
bargningharnosand.se
parkcf.nl
simulatebrain.com
visiativ-industry.fr
pubweb.carnet.hr
webhostingsrbija.rs
winrace.no
mmgdouai.fr
highlinesouthasc.com
broseller.com
cirugiauretra.es
gasolspecialisten.se
thewellnessmimi.com
zenderthelender.com
chefdays.de
michaelsmeriglioracing.com
stupbratt.no
allamatberedare.se
burkert-ideenreich.de
edrcreditservices.nl
yourobgyn.net
praxis-foerderdiagnostik.de
theclubms.com
hotelzentral.at
milanonotai.it
harveybp.com
entopic.com
thomas-hospital.de
cursosgratuitosnainternet.com
ulyssemarketing.com
troegs.com
profectis.de
csgospeltips.se
rostoncastings.co.uk
gporf.fr
sabel-bf.com
happyeasterimages.org
lillegrandpalais.com
koken-voor-baby.nl
bouldercafe-wuppertal.de
rerekatu.com
nosuchthingasgovernment.com
sofavietxinh.com
hugoversichert.de
real-estate-experts.com
uimaan.fi
jsfg.com
christ-michael.net
saarland-thermen-resort.com
caffeinternet.it
no-plans.com
365questions.org
markelbroch.com
greenko.pl
waynela.com
chavesdoareeiro.com
botanicinnovations.com
renergysolution.com
www1.proresult.no
podsosnami.ru
westdeptfordbuyrite.com
ontrailsandboulevards.com
edgewoodestates.org
iyengaryogacharlotte.com
blgr.be
kalkulator-oszczednosci.pl
cuppacap.com
dw-css.de
latestmodsapks.com
bayoga.co.uk
catholicmusicfest.com
liliesandbeauties.org
blumenhof-wegleitner.at
projetlyonturin.fr
admos-gleitlager.de
songunceliptv.com
nataschawessels.com
buroludo.nl
craigvalentineacademy.com
moveonnews.com
praxis-management-plus.de
amerikansktgodis.se
bafuncs.org
pivoineetc.fr
acomprarseguidores.com
norovirus-ratgeber.de
zimmerei-fl.de
abogadoengijon.es
geekwork.pl
castillobalduz.es
colorofhorses.com
braffinjurylawfirm.com
latribuessentielle.com
fransespiegels.nl
rieed.de
kojima-shihou.com
artallnightdc.com
qualitus.com
lukeshepley.wordpress.com
shhealthlaw.com
hatech.io
pferdebiester.de
despedidascostablanca.es
pomodori-pizzeria.de
gaiam.nl
tecnojobsnet.com
leeuwardenstudentcity.nl
hashkasolutindo.com
samnewbyjax.com
charlesreger.com
southeasternacademyofprosthodontics.org
herbstfeststaefa.ch
gemeentehetkompas.nl
helenekowalsky.com
kojinsaisei.info
spsshomeworkhelp.com
sotsioloogia.ee
streamerzradio1.site
xn--thucmctc-13a1357egba.com
krcove-zily.eu
officehymy.com
behavioralmedicinespecialists.com
xlarge.at
tigsltd.com
schutting-info.nl
radaradvies.nl
mylovelybluesky.com
newyou.at
employeesurveys.com
centromarysalud.com
foretprivee.ca
35-40konkatsu.net
architekturbuero-wagner.net
pierrehale.com
thomasvicino.com
tsklogistik.eu
smogathon.com
calxplus.eu
danubecloud.com
desert-trails.com
besttechie.com
dubnew.com
hypozentrum.com
conexa4papers.trade
meusharklinithome.wordpress.com
zzyjtsgls.com
boldcitydowntown.com
tomoiyuma.com
chrissieperry.com
mooshine.com
johnsonfamilyfarmblog.wordpress.com
makeurvoiceheard.com
freie-baugutachterpraxis.de
executiveairllc.com
agence-referencement-naturel-geneve.net
serce.info.pl
accountancywijchen.nl
hmsdanmark.dk
polzine.net
haremnick.com
tonelektro.nl
kampotpepper.gives
strategicstatements.com
argos.wityu.fund
apprendrelaudit.com
div-vertriebsforschung.de
jvanvlietdichter.nl
bestbet.com
kirkepartner.dk
denovofoodsgroup.com
limassoldriving.com
humancondition.com
simplyblessedbykeepingitreal.com
milestoneshows.com
elimchan.com
tomaso.gr
rebeccarisher.com
eglectonk.online
igfap.com
partnertaxi.sk
testzandbakmetmening.online
theduke.de
jobcenterkenya.com
schlafsack-test.net
zflas.com
8449nohate.org
abl1.net
stemplusacademy.com
bildungsunderlebnis.haus
thee.network
kindersitze-vergleich.de
evologic-technologies.com
solinegraphic.com
adoptioperheet.fi
wolf-glas-und-kunst.de
corendonhotels.com
jacquin-maquettes.com
gratispresent.se
psnacademy.in
space.ua
physiofischer.de
dareckleyministries.com
softsproductkey.com
mousepad-direkt.de
leather-factory.co.jp
parkstreetauto.net
simpkinsedwards.co.uk
skanah.com
smokeysstoves.com
sloverse.com
zieglerbrothers.de
heliomotion.com
321play.com.hk
actecfoundation.org
idemblogs.com
thedresserie.com
balticdentists.com
bigler-hrconsulting.ch
transliminaltribe.wordpress.com
xoabigail.com
wychowanieprzedszkolne.pl
satyayoga.de
ceid.info.tr
ikads.org
modamilyon.com
stingraybeach.com
carriagehousesalonvt.com
hushavefritid.dk
bundabergeyeclinic.com.au
themadbotter.com
dr-seleznev.com
vorotauu.ru
qlog.de
insidegarage.pl
perbudget.com
basisschooldezonnewijzer.nl
bigasgrup.com
ogdenvision.com
rota-installations.co.uk
igorbarbosa.com
austinlchurch.com
fundaciongregal.org
theapifactory.com
bodyforwife.com
rozemondcoaching.nl
ohidesign.com
bouncingbonanza.com
iwelt.de
hrabritelefon.hr
ncuccr.org
pogypneu.sk
noesis.tech
stallbyggen.se
poultrypartners.nl
abogadosaccidentetraficosevilla.es
yousay.site
fax-payday-loans.com
coursio.com
wellplast.se
naturstein-hotte.de
myzk.site
bogdanpeptine.ro
pt-arnold.de
alvinschwartz.wordpress.com
smithmediastrategies.com
x-ray.ca
dr-tremel-rednitzhembach.de
vancouver-print.ca
cuspdental.com
symphonyenvironmental.com
argenblogs.com.ar
paulisdogshop.de
scenepublique.net
icpcnj.org
linnankellari.fi
plastidip.com.ar
brandl-blumen.de
diversiapsicologia.es
manifestinglab.com
hotelsolbh.com.br
importardechina.info
pcp-nc.com
pointos.com
ditog.fr
assurancesalextrespaille.fr
bimnapratica.com
teresianmedia.org
webcodingstudio.com
babcockchurch.org
the-domain-trader.com
nurturingwisdom.com
zimmerei-deboer.de
global-kids.info
joseconstela.com
fatfreezingmachines.com
effortlesspromo.com
deoudedorpskernnoordwijk.nl
devok.info
berlin-bamboo-bikes.org
pv-design.de
deschl.net
farhaani.com
lefumetdesdombes.com
flexicloud.hk
nsec.se
syndikat-asphaltfieber.de
cityorchardhtx.com
musictreehouse.net
aniblinova.wordpress.com
devlaur.com
urclan.net
caribdoctor.org
sanaia.com
id-vet.com
toponlinecasinosuk.co.uk
ftlc.es
lmtprovisions.com
pay4essays.net
blacksirius.de
antenanavi.com
oneheartwarriors.at
miraclediet.fun
mezhdu-delom.ru
aarvorg.com
sla-paris.com
roygolden.com
restaurantesszimmer.de
igrealestate.com
alsace-first.com
kissit.ca
finde-deine-marke.de
turkcaparbariatrics.com
nuzech.com
kedak.de
compliancesolutionsstrategies.com
gopackapp.com
seitzdruck.com
jadwalbolanet.info
mountsoul.de
tandartspraktijkhartjegroningen.nl
1kbk.com.ua
n1-headache.com
smessier.com
buymedical.biz
tastewilliamsburg.com
talentwunder.com
ctrler.cn
pocket-opera.de
personalenhancementcenter.com
tetinfo.in
marcuswhitten.site
unetica.fr
c-a.co.in
anthonystreetrimming.com
humanityplus.org
pixelarttees.com
fiscalsort.com
groupe-cets.com
dnepr-beskid.com.ua
nvwoodwerks.com
strandcampingdoonbeg.com
frontierweldingllc.com
oslomf.no
slupetzky.at
stoneys.ch
daklesa.de
cheminpsy.fr
exenberger.at
kaminscy.com
pier40forall.org
ki-lowroermond.nl
4net.guru
rimborsobancario.net
wurmpower.at
marietteaernoudts.nl
lbcframingelectrical.com
maineemploymentlawyerblog.com
rehabilitationcentersinhouston.net
educar.org
imperfectstore.com
slwgs.org
marchand-sloboda.com
waermetauscher-berechnen.de
ymca-cw.org.uk
danholzmann.com
spacecitysisters.org
aselbermachen.com
quickyfunds.com
work2live.de
launchhubl.com
insp.bi
nativeformulas.com
highimpactoutdoors.net
withahmed.com
midmohandyman.com
ventti.com.ar
xn--logopdie-leverkusen-kwb.de
faizanullah.com
cerebralforce.net
blog.solutionsarchitect.guru
live-con-arte.de
wacochamber.com
purposeadvisorsolutions.com
mooreslawngarden.com
truenyc.co
jakekozmor.com
summitmarketingstrategies.com
parebrise-tla.fr
hardinggroup.com
tinyagency.com
bookspeopleplaces.com
vannesteconstruct.be
atalent.fi
mariposapropaneaz.com
naturavetal.hr
triactis.com
iyahayki.nl
nokesvilledentistry.com
kunze-immobilien.de
hiddencitysecrets.com.au
schraven.de
vibehouse.rw
ilive.lt
digivod.de
associacioesportivapolitg.cat
crowcanyon.com
operaslovakia.sk
leoben.at
onlybacklink.com
edv-live.de
mountaintoptinyhomes.com
smejump.co.th
vickiegrayimages.com
jandaonline.com
anybookreader.de
journeybacktolife.com
nandistribution.nl
forskolorna.org
familypark40.com
bowengroup.com.au
baylegacy.com
allfortheloveofyou.com
citymax-cr.com
dlc.berlin
teczowadolina.bytom.pl
victoriousfestival.co.uk
corelifenutrition.com
ncid.bc.ca
spectrmash.ru
freie-gewerkschaften.de
fannmedias.com
shsthepapercut.com
lachofikschiet.nl
hkr-reise.de
directwindowco.com
lecantou-coworking.com
ussmontanacommittee.us
psa-sec.de
deko4you.at
thedad.com
plv.media
lascuola.nl
ampisolabergeggi.it
commonground-stories.com
comparatif-lave-linge.fr
stemenstilte.nl
urist-bogatyr.ru
vetapharma.fr
hebkft.hu
enovos.de
ianaswanson.com
biapi-coaching.fr
herbayupro.com
atmos-show.com
homng.net
brigitte-erler.com
consultaractadenacimiento.com
smart-light.co.uk
vitavia.lt
levdittliv.se
sportiomsportfondsen.nl
glennroberts.co.nz
jiloc.com
foryourhealth.live
kadesignandbuild.co.uk
seagatesthreecharters.com
maryloutaylor.com
spargel-kochen.de
homecomingstudio.com
dushka.ua
body-guards.it
vibethink.net
dutchcoder.nl
geisterradler.de
whittier5k.com
datacenters-in-europe.com
mercantedifiori.com
iqbalscientific.com
ora-it.de
brawnmediany.com
jameskibbie.com
huissier-creteil.com
alysonhoward.com
augenta.com
ecopro-kanto.com
hellohope.com
mediaclan.info
international-sound-awards.com
liveottelut.com
greenfieldoptimaldentalcare.com
ihr-news.jp
simpliza.com
juneauopioidworkgroup.org
kaliber.co.jp
hoteledenpadova.it
henricekupper.com
dirittosanitario.biz
fitovitaforum.com
abitur-undwieweiter.de
modestmanagement.com
em-gmbh.ch
shiftinspiration.com
brevitempore.net
carolinepenn.com
celularity.com
greenpark.ch
nicoleaeschbachorg.wordpress.com
patrickfoundation.net
quizzingbee.com
aakritpatel.com
ivfminiua.com
wraithco.com
ostheimer.at
osterberg.fi
rksbusiness.com
handi-jack-llc.com
dramagickcom.wordpress.com
jbbjw.com
naturalrapids.com
ai-spt.jp
sauschneider.info
milsing.hr
uranus.nl
d2marketing.co.uk
nhadatcanho247.com
testcoreprohealthuk.com
beautychance.se
falcou.fr
tuuliautio.fi
vitalyscenter.es
hihaho.com
starsarecircular.org
xtptrack.com
gamesboard.info
antonmack.de
polychromelabs.com
readberserk.com
navyfederalautooverseas.com
dublikator.com
bridgeloanslenders.com
corola.es
kmbshipping.co.uk
mbfagency.com
pmcimpact.com
bradynursery.com
atozdistribution.co.uk
bricotienda.com
huehnerauge-entfernen.de
tandartspraktijkheesch.nl
otto-bollmann.de
evangelische-pfarrgemeinde-tuniberg.de
healthyyworkout.com
evergreen-fishing.com
fizzl.ru
slashdb.com
abuelos.com
abogados-en-alicante.es
nmiec.com
wasmachtmeinfonds.at
cimanchesterescorts.co.uk
seevilla-dr-sturm.at
tenacitytenfold.com
ladelirante.fr
boosthybrid.com.au
tstaffing.nl
refluxreducer.com
d1franchise.com
panelsandwichmadrid.es
cortec-neuro.com
creative-waves.co.uk
otsu-bon.com
xn--singlebrsen-vergleich-nec.com
leda-ukraine.com.ua
1team.es
elpa.se
marketingsulweb.com
fitnessbazaar.com
hairstylesnow.site
vermoote.de
kamienny-dywan24.pl
mikeramirezcpa.com
forestlakeuca.org.au
denifl-consulting.at
rafaut.com
101gowrie.com
houseofplus.com
penco.ie
drfoyle.com
kao.at
neuschelectrical.co.za
saka.gr
montrium.com
lorenacarnero.com
darnallwellbeing.org.uk
dontpassthepepper.com
blogdecachorros.com
tarotdeseidel.com
nancy-informatique.fr
ahouseforlease.com
rosavalamedahr.com
facettenreich27.de
chandlerpd.com
lightair.com
marathonerpaolo.com
luckypatcher-apkz.com
smale-opticiens.nl
wari.com.pe
helikoptervluchtnewyork.nl
lange.host
craigmccabe.fun
shiresresidential.com
kenhnoithatgo.com
woodworkersolution.com
smalltownideamill.wordpress.com
retroearthstudio.com
insigniapmg.com
iviaggisonciliegie.it
julis-lsa.de
myteamgenius.com
hvccfloorcare.com
mrxermon.de
toreria.es
backstreetpub.com
planchaavapor.net
upmrkt.co
layrshift.eu
dubscollective.com
olejack.ru
transportesycementoshidalgo.es
crediacces.com
walkingdeadnj.com
sweering.fr
liikelataamo.fi
geoffreymeuli.com
selfoutlet.com
jobmap.at
jeanlouissibomana.com
bastutunnan.se
trackyourconstruction.com
myhostcloud.com
bee4win.com
drinkseed.com
stoeferlehalle.de
degroenetunnel.com
artige.com
minipara.com
corona-handles.com
adultgamezone.com
webmaster-peloton.com
mytechnoway.com
mediaacademy-iraq.org
luxurytv.jp
ravensnesthomegoods.com
centuryrs.com
sportsmassoren.com
id-et-d.fr
blood-sports.net
boompinoy.com
aco-media.nl
asgestion.com
milltimber.aberdeen.sch.uk
merzi.info
roadwarrior.app
coding-machine.com
tophumanservicescourses.com
socstrp.org
hhcourier.com
fensterbau-ziegler.de
wsoil.com.sg
piajeppesen.dk
villa-marrakesch.de
monark.com
supportsumba.nl
oceanastudios.com
phantastyk.com
synlab.lt
sevenadvertising.com
bigbaguettes.eu
manutouchmassage.com
kevinjodea.com
philippedebroca.com
siliconbeach-realestate.com
zso-mannheim.de
justinvieira.com
loprus.pl
logopaedie-blomberg.de
sobreholanda.com
verifort-capital.de
romeguidedvisit.com
maasreusel.nl
cranleighscoutgroup.org
skiltogprint.no
finediningweek.pl
manijaipur.com
aurum-juweliere.de
porno-gringo.com
answerstest.ru
torgbodenbollnas.se
havecamerawilltravel2017.wordpress.com
mastertechengineering.com
lichencafe.com
dutchbrewingcoffee.com
love30-chanko.com
sterlingessay.com
nestor-swiss.ch
gmto.fr
littlebird.salon
almosthomedogrescue.dog
licor43.de
advokathuset.dk
commercialboatbuilding.com
i-arslan.de
katiekerr.co.uk
antiaginghealthbenefits.com
binder-buerotechnik.at
maureenbreezedancetheater.org
waveneyrivercentre.co.uk
autodujos.lt
seminoc.com
daniel-akermann-architektur-und-planung.ch
senson.fi
gastsicht.de
ilcdover.com
theshungiteexperience.com.au
sairaku.net
jenniferandersonwriter.com
birnam-wood.com
mepavex.nl
vihannesporssi.fi
instatron.net
rocketccw.com
123vrachi.ru
mindpackstudios.com
petnest.ir
ziegler-praezisionsteile.de
sipstroysochi.ru
offroadbeasts.com
trystana.com
dr-pipi.de
xn--fn-kka.no
knowledgemuseumbd.com
pickanose.com
klimt2012.info
clos-galant.com
ligiercenter-sachsen.de
thailandholic.com
kamahouse.net
precisionbevel.com
platformier.com
xn--rumung-bua.online
tongdaifpthaiphong.net
run4study.com
body-armour.online
whyinterestingly.ru
goodgirlrecovery.com
dpo-as-a-service.com
eaglemeetstiger.de
amylendscrestview.com
bauertree.com
people-biz.com
solerluethi-allart.ch
oncarrot.com
jusibe.com
lescomtesdemean.be
schoellhammer.com
oemands.dk
danielblum.info
simoneblum.de
faroairporttransfers.net
tinkoff-mobayl.ru
cursoporcelanatoliquido.online
globedivers.wordpress.com
parking.netgateway.eu
coastalbridgeadvisors.com
yamalevents.com
mdk-mediadesign.de
berliner-versicherungsvergleich.de
noixdecocom.fr
videomarketing.pro
apolomarcas.com
gymnasedumanagement.com
parks-nuernberg.de
figura.team
chaotrang.com
charlottepoudroux-photographie.fr
theadventureedge.com
bristolaeroclub.co.uk
ilso.net
vesinhnha.com.vn
naswrrg.org
balticdermatology.lt
collaborativeclassroom.org
beaconhealthsystem.org
sporthamper.com
cyntox.com
madinblack.com
plantag.de
koko-nora.dk
lapmangfpt.info.vn
intecwi.com
kikedeoliveira.com
kingfamily.construction
boisehosting.net
kariokids.com
bouquet-de-roses.com
makeflowers.ru
croftprecision.co.uk
stefanpasch.me
mrsfieldskc.com
hokagestore.com
ccpbroadband.com
advizewealth.com
nacktfalter.de
vanswigchemdesign.com
ungsvenskarna.se
deprobatehelp.com
cwsitservices.co.uk
urmasiimariiuniri.ro
rollingrockcolumbia.com
analiticapublica.es
fotoideaymedia.es
groupe-frayssinet.fr
baumkuchenexpo.jp
lucidinvestbank.com
tampaallen.com
nakupunafoundation.org
vietlawconsultancy.com
remcakram.com
tips.technology
biortaggivaldelsa.com
completeweddingkansas.com
ivivo.es
micahkoleoso.de
odiclinic.org
drugdevice.org
bloggyboulga.net
new.devon.gov.uk
ftf.or.at
pcprofessor.com
reddysbakery.com
eraorastudio.com
carlosja.com
saxtec.com
crosspointefellowship.church
pasvenska.se
appsformacpc.com
epwritescom.wordpress.com
oneplusresource.org
mrtour.site
nijaplay.com
unim.su
mooglee.com
destinationclients.fr
grupocarvalhoerodrigues.com.br
haar-spange.com
stoeberstuuv.de
art2gointerieurprojecten.nl
danskretursystem.dk
aprepol.com
yassir.pro
carrybrands.nl
ruralarcoiris.com
bxdf.info
xn--fnsterputssollentuna-39b.se
higadograsoweb.com
allure-cosmetics.at
notsilentmd.org
expandet.dk
lebellevue.fr
kafu.ch
fibrofolliculoma.info
tulsawaterheaterinstallation.com
garage-lecompte-rouen.fr
homesdollar.com
artotelamsterdam.com
tanzprojekt.com
eco-southafrica.com
lenreactiv-shop.ru
lubetkinmediacompanies.com
girlillamarketing.com
sw1m.ru
innote.fi
candyhouseusa.com
americafirstcommittee.org
lapinvihreat.fi
vloeren-nu.nl
gw2guilds.org
steampluscarpetandfloors.com
suncrestcabinets.ca
coffreo.biz
first-2-aid-u.com
aglend.com.au
galleryartfair.com
verytycs.com
walter-lemm.de
mirkoreisser.de
bordercollie-nim.nl
proudground.org
systemate.dk
12starhd.online
jyzdesign.com
campus2day.de
creamery201.com
friendsandbrgrs.com
todocaracoles.com
gonzalezfornes.es
filmvideoweb.com
sagadc.com
hannah-fink.de
bockamp.com
prochain-voyage.net
kosterra.com
raschlosser.de
itelagen.com
katketytaanet.fi
faronics.com
sinal.org
jolly-events.com
2ekeus.nl
kaotikkustomz.com
newstap.com.ng
arteservicefabbro.com
kidbucketlist.com.au
vox-surveys.com
conasmanagement.de
promesapuertorico.com
xn--vrftet-pua.biz
shadebarandgrillorlando.com
psc.de
live-your-life.jp
caribbeansunpoker.com
mymoneyforex.com
team-montage.dk
iphoneszervizbudapest.hu
camsadviser.com
baustb.de
ceres.org.au
lynsayshepherd.co.uk
izzi360.com
narcert.com
financescorecard.com
funjose.org.gt
siluet-decor.ru
bierensgebakkramen.nl
baptisttabernacle.com
oldschoolfun.net
christinarebuffetcourses.com
bbsmobler.se
ateliergamila.com
servicegsm.net
baronloan.org
maxadams.london
werkkring.nl
slimani.net
-
net
false
-
pid
$2a$12$k6iq18BR3UU7uFyc.Pgy0e8GklmvcWyoi09nqzJkgxZN1vNGskAtC
-
prc
oracle
onenote
msaccess
dbsnmp
firefox
ocssd
excel
wordpad
isqlplussvc
thebat
dbeng50
sql
mspub
visio
steam
outlook
encsvc
mydesktopservice
powerpnt
winword
ocautoupds
synctime
agntsvc
tbirdconfig
thunderbird
sqbcoreservice
ocomm
mydesktopqos
infopath
xfssvccon
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
7495
-
svc
mepocs
memtas
svc$
sophos
sql
vss
veeam
backup
Extracted
C:\Users\7x5uuzi-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/60A9AD4D4CCC0AC6
http://decoder.re/60A9AD4D4CCC0AC6
Extracted
C:\Users\n1jrkl-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A3E3AE45FDACB846
http://decoder.re/A3E3AE45FDACB846
Targets
-
-
Target
REvil_v2.06.exe
-
Size
121KB
-
MD5
46a40ec6d39b7530830f3047cdebaa1b
-
SHA1
a1540914b5ceb9e772ee5898e777f48e3cd57010
-
SHA256
08c2d24cb9c632f9aa84254bb673c9df04d4ac23ee07e840794e9438b06e9bd2
-
SHA512
64d3bd219e939100612242a35d36db8636a18eb962ce174284359178b6abb29c957bb1a0083015b948ff17c30e01ddd46c12824a83d0698b03372effeae0aa12
-
SSDEEP
1536:vjVXKif7kaCtHM7qpo6ZQDtFnNi+ti09or2LkLpLik8ICS4Ao3uZskecjrzgPujd:J1MZwlLk9Bm3uWqgu6M1njIXi1
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Sets service image path in registry
-
Uses Session Manager for persistence
Creates Session Manager registry key to run executable early in system boot.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Impair Defenses: Safe Mode Boot
-
Loads dropped DLL
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Adds Run key to start application
-
Checks for any installed AV software in registry
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
3Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
3Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
1Safe Mode Boot
1Modify Registry
6Pre-OS Boot
1Bootkit
1Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1