Analysis Report c647b2da_by_Libranalysis
Overview
General Information
Detection
Sodinokibi
Score: | 96 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Found malware configuration
Found ransom note / readme
Multi AV Scanner detection for submitted file
Yara detected Sodinokibi Ransomware
Contains functionality to detect sleep reduction / modifications
Found Tor onion address
Machine Learning detection for sample
Modifies existing user documents (likely ransomware behavior)
Checks for available system drives (often done to infect USB drives)
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to delete services
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Contains functionality to enumerate running services
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Yara signature match
Classification
|
{
"prc": [
"firefox",
"agntsvc",
"tbirdconfig",
"ocomm",
"visio",
"oracle",
"outlook",
"winword",
"isqlplussvc",
"mydesktopservice",
"steam",
"thunderbird",
"ocautoupds",
"synctime",
"infopath",
"thebat",
"onenote",
"excel",
"encsvc",
"mspub",
"dbeng50",
"sql",
"sqbcoreservice",
"xfssvccon",
"msaccess",
"powerpnt",
"ocssd",
"wordpad",
"dbsnmp",
"mydesktopqos"
],
"sub": "3721",
"svc": [
"vss",
"veeam",
"sophos",
"mepocs",
"svc$",
"backup",
"sql",
"memtas"
],
"wht": {
"ext": [
"msp",
"deskthemepack",
"icl",
"msu",
"ldf",
"wpx",
"ics",
"lnk",
"cab",
"com",
"adv",
"cmd",
"hlp",
"ocx",
"exe",
"bat",
"drv",
"diagcfg",
"diagcab",
"386",
"icns",
"scr",
"mpa",
"msstyles",
"hta",
"nls",
"rtp",
"sys",
"themepack",
"spl",
"lock",
"mod",
"msc",
"cpl",
"msi",
"idx",
"key",
"shs",
"cur",
"theme",
"bin",
"ani",
"dll",
"prf",
"rom",
"nomedia",
"ps1",
"ico",
"diagpkg"
],
"fls": [
"bootsect.bak",
"bootfont.bin",
"boot.ini",
"desktop.ini",
"iconcache.db",
"autorun.inf",
"ntuser.dat",
"thumbs.db",
"ntuser.ini",
"ntldr",
"ntuser.dat.log"
],
"fld": [
"programdata",
"program files",
"$windows.~bt",
"application data",
"intel",
"program files (x86)",
"google",
"mozilla",
"perflogs",
"tor browser",
"$windows.~ws",
"$recycle.bin",
"system volume information",
"windows.old",
"appdata",
"msocache",
"boot"
]
},
"img": "QQBsAGwAIABvAGYAIAB5AG8AdQByACAAZgBpAGwAZQBzACAAYQByAGUAIABlAG4AYwByAHkAcAB0AGUAZAAhAA0ACgANAAoARgBpAG4AZAAgAHsARQBYAFQAfQAtAHIAZQBhAGQAbQBlAC4AdAB4AHQAIABhAG4AZAAgAGYAbwBsAGwAbwB3ACAAaQBuAHMAdAB1AGMAdABpAG8AbgBzAAAA",
"spsize": 25,
"dmn": "quemargrasa.net;wraithco.com;dubnew.com;zweerscreatives.nl;eaglemeetstiger.de;highimpactoutdoors.net;vesinhnha.com.vn;rocketccw.com;div-vertriebsforschung.de;rieed.de;ulyssemarketing.com;jbbjw.com;moveonnews.com;em-gmbh.ch;deepsouthclothingcompany.com;2ekeus.nl;vdberg-autoimport.nl;deschl.net;teknoz.net;micahkoleoso.de;adoptioperheet.fi;leda-ukraine.com.ua;peterstrobos.com;faronics.com;ecopro-kanto.com;you-bysia.com.au;newyou.at;humancondition.com;tstaffing.nl;transliminaltribe.wordpress.com;quizzingbee.com;ecoledansemulhouse.fr;theclubms.com;jiloc.com;sofavietxinh.com;garage-lecompte-rouen.fr;amylendscrestview.com;devlaur.com;monark.com;eadsmurraypugh.com;jameskibbie.com;handi-jack-llc.com;koko-nora.dk;profectis.de;oldschoolfun.net;walkingdeadnj.com;embracinghiscall.com;rhinosfootballacademy.com;epwritescom.wordpress.com;coastalbridgeadvisors.com;seagatesthreecharters.com;danskretursystem.dk;hannah-fink.de;corelifenutrition.com;werkkring.nl;walter-lemm.de;bradynursery.com;bbsmobler.se;tanzprojekt.com;synlab.lt;tsklogistik.eu;globedivers.wordpress.com;makeurvoiceheard.com;crowd-patch.co.uk;mariposapropaneaz.com;longislandelderlaw.com;oneplusresource.org;edgewoodestates.org;pogypneu.sk;glennroberts.co.nz;transportesycementoshidalgo.es;kojinsaisei.info;edv-live.de;seminoc.com;cranleighscoutgroup.org;cimanchesterescorts.co.uk;muamuadolls.com;mytechnoway.com;shiftinspiration.com;anteniti.com;evergreen-fishing.com;blumenhof-wegleitner.at;classycurtainsltd.co.uk;filmvideoweb.com;houseofplus.com;restaurantesszimmer.de;kath-kirche-gera.de;knowledgemuseumbd.com;offroadbeasts.com;euro-trend.pl;hardinggroup.com;drugdevice.org;kingfamily.construction;creative-waves.co.uk;sagadc.com;cactusthebrand.com;allentownpapershow.com;puertamatic.es;boompinoy.com;bargningharnosand.se;spargel-kochen.de;facettenreich27.de;kisplanning.com.au;thedresserie.com;layrshift.eu;tastewilliamsburg.com;lightair.com;quickyfunds.com;321play.com.hk;coding-marking.com;myteamgenius.com;oneheartwarriors.at;lubetkinmediacompanies.com;naswrrg.org;turkcaparbariatrics.com;jacquin-maquettes.com;xn--thucmctc-13a1357egba.com;i-arslan.de;simulatebrain.com;kariokids.com;body-guards.it;baronloan.org;milanonotai.it;nvwoodwerks.com;forskolorna.org;pivoineetc.fr;chrissieperry.com;madinblack.com;artotelamsterdam.com;nhadatcanho247.com;wari.com.pe;asiluxury.com;extraordinaryoutdoors.com;wmiadmin.com;zonamovie21.net;torgbodenbollnas.se;webhostingsrbija.rs;norpol-yachting.com;mediaacademy-iraq.org;edelman.jp;123vrachi.ru;iwelt.de;plastidip.com.ar;meusharklinithome.wordpress.com;parking.netgateway.eu;seitzdruck.com;bloggyboulga.net;waynela.com;hexcreatives.co;mardenherefordshire-pc.gov.uk;mousepad-direkt.de;portoesdofarrobo.com;porno-gringo.com;vanswigchemdesign.com;juneauopioidworkgroup.org;appsformacpc.com;journeybacktolife.com;aglend.com.au;thee.network;mymoneyforex.com;patrickfoundation.net;bxdf.info;lukeshepley.wordpress.com;tarotdeseidel.com;mylovelybluesky.com;bestbet.com;8449nohate.org;space.ua;bogdanpeptine.ro;clos-galant.com;abogadosaccidentetraficosevilla.es;hokagestore.com;abuelos.com;manifestinglab.com;cortec-neuro.com;kuntokeskusrok.fi;sporthamper.com;gporf.fr;richard-felix.co.uk;xn--rumung-bua.online;linnankellari.fi;kojima-shihou.com;thenewrejuveme.com;geisterradler.de;sarbatkhalsafoundation.org;pridoxmaterieel.nl;asteriag.com;katketytaanet.fi;ungsvenskarna.se;montrium.com;argenblogs.com.ar;better.town;surespark.org.uk;smalltownideamill.wordpress.com;klusbeter.nl;punchbaby.com;gastsicht.de;smejump.co.th;digivod.de;dr-pipi.de;labobit.it;exenberger.at;roygolden.com;freie-baugutachterpraxis.de;id-vet.com;merzi.info;answerstest.ru;haremnick.com;harpershologram.wordpress.com;osterberg.fi;spsshomeworkhelp.com;naturalrapids.com;sabel-bf.com;ilcdover.com;tuuliautio.fi;skiltogprint.no;summitmarketingstrategies.com;macabaneaupaysflechois.com;mezhdu-delom.ru;iqbalscientific.com;ceid.info.tr;croftprecision.co.uk;web.ion.ag;beautychance.se;xtptrack.com;smessier.com;selfoutlet.com;ymca-cw.org.uk;schlafsack-test.net;gaiam.nl;latestmodsapks.com;analiticapublica.es;aakritpatel.com;desert-trails.com;deprobatehelp.com;americafirstcommittee.org;schmalhorst.de;healthyyworkout.com;compliancesolutionsstrategies.com;westdeptfordbuyrite.com;anybookreader.de;deltacleta.cat;theshungiteexperience.com.au;yamalevents.com;lillegrandpalais.com;phantastyk.com;foretprivee.ca;stemplusacademy.com;advokathuset.dk;bastutunnan.se;zimmerei-deboer.de;blossombeyond50.com;jyzdesign.com;cityorchardhtx.com;educar.org;uranus.nl;andersongilmour.co.uk;atozdistribution.co.uk;hellohope.com;sauschneider.info;waywithwords.net;twohourswithlena.wordpress.com;praxis-foerderdiagnostik.de;newstap.com.ng;alsace-first.com;zflas.com;corendonhotels.com;iwelt.de;officehymy.com;ausair.com.au;mank.de;carlosja.com;smartypractice.com;harveybp.com;artige.com;ilso.net;expandet.dk;poultrypartners.nl;schoellhammer.com;esope-formation.fr;mindpackstudios.com;kevinjodea.com;greenko.pl;durganews.com;hairstylesnow.site;theletter.company;buymedical.biz;lichencafe.com;rollingrockcolumbia.com;iphoneszervizbudapest.hu;senson.fi;kenhnoithatgo.com;huissier-creteil.com;nandistribution.nl;norovirus-ratgeber.de;liliesandbeauties.org;boosthybrid.com.au;aselbermachen.com;lusak.at;bockamp.com;nokesvilledentistry.com;iwelt.de;cwsitservices.co.uk;smokeysstoves.com;chavesdoareeiro.com;nancy-informatique.fr;fotoscondron.com;vitavia.lt;pay4essays.net;pointos.com;ralister.co.uk;galleryartfair.com;onlyresultsmarketing.com;xltyu.com;shsthepapercut.com;jeanlouissibomana.com;bigasgrup.com;drnice.de;berlin-bamboo-bikes.org;sobreholanda.com;ventti.com.ar;zzyjtsgls.com;pocket-opera.de;notmissingout.com;kunze-immobilien.de;sw1m.ru;brigitte-erler.com;financescorecard.com;familypark40.com;fannmedias.com;tennisclubetten.nl;artallnightdc.com;pt-arnold.de;parebrise-tla.fr;scenepublique.net;thedad.com;podsosnami.ru;proudground.org;cuppacap.com;amerikansktgodis.se;heliomotion.com;id-et-d.fr;kikedeoliveira.com;bouquet-de-roses.com;agence-chocolat-noir.com;birnam-wood.com;entopic.com;refluxreducer.com;romeguidedvisit.com;admos-gleitlager.de;101gowrie.com;testcoreprohealthuk.com;myhostcloud.com;huesges-gruppe.de;roadwarrior.app;fax-payday-loans.com;heurigen-bauer.at;solinegraphic.com;edrcreditservices.nl;spacecitysisters.org;dublikator.com;lloydconstruction.com;evangelische-pfarrgemeinde-tuniberg.de;suncrestcabinets.ca;pv-design.de;tomoiyuma.com;thomas-hospital.de;lynsayshepherd.co.uk;basisschooldezonnewijzer.nl;verbisonline.com;datacenters-in-europe.com;craigvalentineacademy.com;fiscalsort.com;uimaan.fi;stormwall.se;highlinesouthasc.com;cafemattmeera.com;coffreo.biz;joseconstela.com;ruralarcoiris.com;lascuola.nl;ivivo.es;joyeriaorindia.com;broseller.com;brevitempore.net;vickiegrayimages.com;olejack.ru;homesdollar.com;theduke.de;gmto.fr;hashkasolutindo.com;biortaggivaldelsa.com;erstatningsadvokaterne.dk;tandartspraktijkhartjegroningen.nl;the-virtualizer.com;bodyfulls.com;waermetauscher-berechnen.de;bauertree.com;stingraybeach.com;midmohandyman.com;noskierrenteria.com;schraven.de;lefumetdesdombes.com;smithmediastrategies.com;mooshine.com;winrace.no;slupetzky.at;tampaallen.com;zervicethai.co.th;gonzalezfornes.es;aarvorg.com;faroairporttransfers.net;minipara.com;ai-spt.jp;pierrehale.com;lescomtesdemean.be;ino-professional.ru;mank.de;urclan.net;marcuswhitten.site;d1franchise.com;musictreehouse.net;miraclediet.fun;darrenkeslerministries.com;stoeferlehalle.de;simpliza.com;socstrp.org;oceanastudios.com;thaysa.com;sportverein-tambach.de;oemands.dk;gadgetedges.com;catholicmusicfest.com;hotelsolbh.com.br;socialonemedia.com;kadesignandbuild.co.uk;huehnerauge-entfernen.de;zimmerei-fl.de;rushhourappliances.com;verifort-capital.de;kmbshipping.co.uk;controldekk.com;teczowadolina.bytom.pl;ontrailsandboulevards.com;enovos.de;jobcenterkenya.com;cerebralforce.net;raschlosser.de;platformier.com;sahalstore.com;krlosdavid.com;alten-mebel63.ru;bingonearme.org;blood-sports.net;psnacademy.in;mooreslawngarden.com;systemate.dk;sotsioloogia.ee;blewback.com;ianaswanson.com;crowcanyon.com;mrxermon.de;sojamindbody.com;bigler-hrconsulting.ch;collaborativeclassroom.org;aunexis.ch;yassir.pro;work2live.de;samnewbyjax.com;gasolspecialisten.se;testzandbakmetmening.online;makeflowers.ru;pier40forall.org;stemenstilte.nl;rafaut.com;autofolierung-lu.de;autodujos.lt;wychowanieprzedszkolne.pl;ra-staudte.de;dutchcoder.nl;dushka.ua;danubecloud.com;wurmpower.at;interactcenter.org;centrospgolega.com;alhashem.net;troegs.com;ostheimer.at;todocaracoles.com;hotelzentral.at;ziegler-praezisionsteile.de;cirugiauretra.es;blogdecachorros.com;planchaavapor.net;dezatec.es;helikoptervluchtnewyork.nl;corelifenutrition.com;tophumanservicescourses.com;polychromelabs.com;verytycs.com;simpkinsedwards.co.uk;delchacay.com.ar;revezlimage.com;bundabergeyeclinic.com.au;rozemondcoaching.nl;n1-headache.com;copystar.co.uk;reddysbakery.com;adultgamezone.com;buroludo.nl;bigbaguettes.eu;frontierweldingllc.com;oncarrot.com;bristolaeroclub.co.uk;iyengaryogacharlotte.com;global-kids.info;carolinepenn.com;polymedia.dk;tenacitytenfold.com;aodaichandung.com;wasmachtmeinfonds.at;mrsplans.net;serce.info.pl;anthonystreetrimming.com;johnsonfamilyfarmblog.wordpress.com;slwgs.org;autodemontagenijmegen.nl;leather-factory.co.jp;despedidascostablanca.es;zenderthelender.com;abogados-en-alicante.es;hvccfloorcare.com;manijaipur.com;noesis.tech;atalent.fi;bafuncs.org;paulisdogshop.de;marchand-sloboda.com;groupe-cets.com;bowengroup.com.au;ihr-news.jp;upmrkt.co;daklesa.de;wacochamber.com;grelot-home.com;theapifactory.com;vihannesporssi.fi;vannesteconstruct.be;mdk-mediadesign.de;loprus.pl;tandartspraktijkheesch.nl;ccpbroadband.com;35-40konkatsu.net;stoeberstuuv.de;conexa4papers.trade;trapiantofue.it;woodleyacademy.org;seproc.hn;mmgdouai.fr;stacyloeb.com;ausbeverage.com.au;promesapuertorico.com;allure-cosmetics.at;onlybacklink.com;cnoia.org;sanaia.com;southeasternacademyofprosthodontics.org;architecturalfiberglass.org;balticdermatology.lt;bodyforwife.com;gantungankunciakrilikbandung.com;urist-bogatyr.ru;body-armour.online;truenyc.co;campus2day.de;dlc.berlin;greenfieldoptimaldentalcare.com;teresianmedia.org;farhaani.com;baptisttabernacle.com;creamery201.com;mbfagency.com;alysonhoward.com;victoriousfestival.co.uk;hmsdanmark.dk;tecnojobsnet.com;maryloutaylor.com;employeesurveys.com;qualitus.com;happyeasterimages.org;gw2guilds.org;easytrans.com.au;tux-espacios.com;dnepr-beskid.com.ua;levdittliv.se;finde-deine-marke.de;securityfmm.com;jerling.de;toponlinecasinosuk.co.uk;klimt2012.info;naturstein-hotte.de;mountaintoptinyhomes.com;vibethink.net;mountsoul.de;neuschelectrical.co.za;marathonerpaolo.com;connectedace.com;chaotrang.com;jsfg.com;rebeccarisher.com;falcou.fr;pmc-services.de;maureenbreezedancetheater.org;michaelsmeriglioracing.com;tinkoff-mobayl.ru;vitalyscenter.es;1kbk.com.ua;sportsmassoren.com;havecamerawilltravel2017.wordpress.com;courteney-cox.net;alfa-stroy72.com;insp.bi;mooglee.com;atmos-show.com;beaconhealthsystem.org;craigmccabe.fun;ladelirante.fr;pomodori-pizzeria.de;eglectonk.online;shiresresidential.com;lapmangfpt.info.vn;boldcitydowntown.com;vorotauu.ru;biapi-coaching.fr;almosthomedogrescue.dog;ecpmedia.vn;pubweb.carnet.hr;manutouchmassage.com;conasmanagement.de;run4study.com;cyntox.com;theadventureedge.com;antiaginghealthbenefits.com;marketingsulweb.com;y-archive.com;geoffreymeuli.com;d2marketing.co.uk;geekwork.pl;modelmaking.nl;microcirc.net;myhealth.net.au;caribbeansunpoker.com;renergysolution.com;justinvieira.com;plantag.de;gamesboard.info;lionware.de;dsl-ip.de;arteservicefabbro.com;mastertechengineering.com;parkstreetauto.net;icpcnj.org;completeweddingkansas.com;airconditioning-waalwijk.nl;hkr-reise.de;zieglerbrothers.de;kamienny-dywan24.pl;devok.info;starsarecircular.org;jasonbaileystudio.com;caribdoctor.org;latribuessentielle.com;softsproductkey.com;lorenacarnero.com;xn--singlebrsen-vergleich-nec.com;forestlakeuca.org.au;commonground-stories.com;precisionbevel.com;homng.net;pcprofessor.com;smogathon.com;tradiematepro.com.au;chefdays.de;nmiec.com;tanzschule-kieber.de;ussmontanacommittee.us;sevenadvertising.com;fizzl.ru;itelagen.com;mir-na-iznanku.com;centuryrs.com;htchorst.nl;galserwis.pl;bimnapratica.com;fensterbau-ziegler.de;tongdaifpthaiphong.net;colorofhorses.com;jolly-events.com;allfortheloveofyou.com;bargningavesta.se;12starhd.online;citymax-cr.com;oslomf.no;commercialboatbuilding.com;petnest.ir;siluet-decor.ru;firstpaymentservices.com;sportiomsportfondsen.nl;ikads.org;solerluethi-allart.ch;extensionmaison.info;executiveairllc.com;mediaplayertest.net;plotlinecreative.com;friendsandbrgrs.com;smale-opticiens.nl;triggi.de;milltimber.aberdeen.sch.uk;drinkseed.com;drfoyle.com;simplyblessedbykeepingitreal.com;sla-paris.com;dinslips.se;promalaga.es;nosuchthingasgovernment.com;kaliber.co.jp;symphonyenvironmental.com;tanciu.com;jobmap.at;shhealthlaw.com;elimchan.com;beyondmarcomdotcom.wordpress.com;balticdentists.com;comarenterprises.com;purposeadvisorsolutions.com;fotoideaymedia.es;brawnmediany.com;dareckleyministries.com;girlillamarketing.com;pasvenska.se;tulsawaterheaterinstallation.com;aniblinova.wordpress.com;goodgirlrecovery.com;camsadviser.com;mediaclan.info;bptdmaluku.com;ceres.org.au;art2gointerieurprojecten.nl;thailandholic.com;resortmtn.com;destinationclients.fr;heidelbergartstudio.gallery;visiativ-industry.fr;krcove-zily.eu;rostoncastings.co.uk;servicegsm.net;ncs-graphic-studio.com;fransespiegels.nl;sipstroysochi.ru;pinkexcel.com;readberserk.com;kirkepartner.dk;projetlyonturin.fr;shadebarandgrillorlando.com;freie-gewerkschaften.de;hiddencitysecrets.com.au;figura.team;gasbarre.com;qlog.de;carriagehousesalonvt.com;deoudedorpskernnoordwijk.nl;koken-voor-baby.nl;partnertaxi.sk;asgestion.com;imaginado.de;vetapharma.fr;eco-southafrica.com;actecfoundation.org;herbstfeststaefa.ch;naturavetal.hr;pawsuppetlovers.com;ohidesign.com;jvanvlietdichter.nl;bridgeloanslenders.com;wien-mitte.co.at;pferdebiester.de;rosavalamedahr.com;fatfreezingmachines.com;malychanieruchomoscipremium.com;songunceliptv.com;vibehouse.rw;tips.technology;kidbucketlist.com.au;vox-surveys.com;x-ray.ca;cite4me.org;chandlerpd.com;rehabilitationcentersinhouston.net;steampluscarpetandfloors.com;prochain-voyage.net;backstreetpub.com;saxtec.com;dirittosanitario.biz;ctrler.cn;modamilyon.com;lapinvihreat.fi;live-con-arte.de;crosspointefellowship.church;antenanavi.com;ki-lowroermond.nl;boisehosting.net;ivfminiua.com;xn--logopdie-leverkusen-kwb.de;darnallwellbeing.org.uk;bricotienda.com;irishmachineryauctions.com;bhwlawfirm.com;abogadoengijon.es;denifl-consulting.at;botanicinnovations.com;unim.su;judithjansen.com;bouncingbonanza.com;campusoutreach.org;spylista.com;leoben.at;austinlchurch.com;directwindowco.com;tetinfo.in;corona-handles.com;solhaug.tk;danielblum.info;withahmed.com;apprendrelaudit.com;365questions.org;schmalhorst.de;pickanose.com;lebellevue.fr;strandcampingdoonbeg.com;katiekerr.co.uk;nachhilfe-unterricht.com;finediningweek.pl;vancouver-print.ca;rerekatu.com;skanah.com;shonacox.com;wellplast.se;ravensnesthomegoods.com;pasivect.co.uk;lange.host;presseclub-magdeburg.de;architekturbuero-wagner.net;bookspeopleplaces.com;yousay.site;paradicepacks.com;mikeramirezcpa.com;iviaggisonciliegie.it;abl1.net;kamahouse.net;mapawood.com;mirkoreisser.de;higadograsoweb.com;ilive.lt;1team.es;stoneys.ch;agence-referencement-naturel-geneve.net;fibrofolliculoma.info;hatech.io;real-estate-experts.com;lapinlviasennus.fi;hhcourier.com;lmtprovisions.com;nataschawessels.com;myzk.site;xn--fnsterputssollentuna-39b.se;effortlesspromo.com;radaradvies.nl;bsaship.com;4net.guru;nacktfalter.de;hihaho.com;abitur-undwieweiter.de;sexandfessenjoon.wordpress.com;memaag.com;cuspdental.com;celeclub.org;streamerzradio1.site;jadwalbolanet.info;herbayupro.com;blog.solutionsarchitect.guru;pmcimpact.com;blgr.be;baumkuchenexpo.jp;fairfriends18.de;bayoga.co.uk;love30-chanko.com;ncuccr.org;blacksirius.de;cheminpsy.fr;drinkseed.com;tinyagency.com;charlottepoudroux-photographie.fr;themadbotter.com;jusibe.com;trystana.com;christ-michael.net;luxurytv.jp;elpa.se;fitnessingbyjessica.com;trulynolen.co.uk;mercantedifiori.com;jorgobe.at;berliner-versicherungsvergleich.de;associacioesportivapolitg.cat;igrealestate.com;autopfand24.de;c-a.co.in;evologic-technologies.com;wolf-glas-und-kunst.de;bordercollie-nim.nl;psa-sec.de;hushavefritid.dk;nuzech.com;iyahayki.nl;karacaoglu.nl;i-trust.dk;thefixhut.com;aurum-juweliere.de;calabasasdigest.com;tonelektro.nl;insigniapmg.com;kafu.ch;nestor-swiss.ch;echtveilig.nl;mbxvii.com;nsec.se;groupe-frayssinet.fr;dekkinngay.com;kaotikkustomz.com;nijaplay.com;unetica.fr;dutchbrewingcoffee.com;plv.media;ftf.or.at;dw-css.de;jakekozmor.com;bunburyfreightservices.com.au;dubscollective.com;rota-installations.co.uk;sweering.fr;luckypatcher-apkz.com;crediacces.com;cleliaekiko.online;personalenhancementcenter.com;no-plans.com;calxplus.eu;strategicstatements.com;ateliergamila.com;xn--fn-kka.no;physiofischer.de;maxadams.london;ora-it.de;lbcframingelectrical.com;leeuwardenstudentcity.nl;zewatchers.com;apolomarcas.com;imadarchid.com;schutting-info.nl;dr-seleznev.com;liikelataamo.fi;fitnessbazaar.com;innote.fi;stupbratt.no;live-your-life.jp;associationanalytics.com;makeitcount.at;kostenlose-webcams.com;remcakram.com;julis-lsa.de;aco-media.nl;milestoneshows.com;baustb.de;smhydro.com.pl;caffeinternet.it;kaminscy.com;saarland-thermen-resort.com;sterlingessay.com;bildungsunderlebnis.haus;csgospeltips.se;mrsfieldskc.com;digi-talents.com;idemblogs.com;ouryoungminds.wordpress.com;aprepol.com;perbudget.com;nurturingwisdom.com;gratispresent.se;syndikat-asphaltfieber.de;allamatberedare.se;deko4you.at;whyinterestingly.ru;ledmes.ru;iwr.nl;parkcf.nl;talentwunder.com;smart-light.co.uk;maineemploymentlawyerblog.com;notsilentmd.org;hypozentrum.com;sandd.nl;takeflat.com;sanyue119.com;hugoversichert.de;corola.es;urmasiimariiuniri.ro;spectrmash.ru;international-sound-awards.com;lachofikschiet.nl;celularity.com;bierensgebakkramen.nl;braffinjurylawfirm.com;babcockchurch.org;slashdb.com;consultaractadenacimiento.com;simoneblum.de;ahouseforlease.com;igfap.com;comparatif-lave-linge.fr;ligiercenter-sachsen.de;dontpassthepepper.com;augenta.com;carrybrands.nl;eraorastudio.com;haar-spange.com;kampotpepper.gives;piajeppesen.dk;slimidealherbal.com;hebkft.hu;accountancywijchen.nl;woodworkersolution.com;all-turtles.com;henricekupper.com;videomarketing.pro;femxarxa.cat;tomaso.gr;bee4win.com;dramagickcom.wordpress.com;fitovitaforum.com;rimborsobancario.net;sinal.org;homecomingstudio.com;iwelt.de;funjose.org.gt;c2e-poitiers.com;vloeren-nu.nl;hoteledenpadova.it;polzine.net;levihotelspa.fi;maratonaclubedeportugal.com;jenniferandersonwriter.com;grupocarvalhoerodrigues.com.br;intecwi.com;toreria.es;launchhubl.com;aminaboutique247.com;antonmack.de;otsu-bon.com;opatrovanie-ako.sk;besttechie.com;vietlawconsultancy.com;degroenetunnel.com;ftlc.es;parks-nuernberg.de;zso-mannheim.de;cursoporcelanatoliquido.online;importardechina.info;sloverse.com;behavioralmedicinespecialists.com;instatron.net;hairnetty.wordpress.com;fundaciongregal.org;assurancesalextrespaille.fr;waveneyrivercentre.co.uk;upplandsspar.se;bouldercafe-wuppertal.de;nativeformulas.com;centromarysalud.com;trackyourconstruction.com;team-montage.dk;danholzmann.com;diversiapsicologia.es;kosterra.com;miriamgrimm.de;cursosgratuitosnainternet.com;the-domain-trader.com;rksbusiness.com;greenpark.ch;xoabigail.com;DupontSellsHomes.com;outcomeisincome.com;markelbroch.com;denovofoodsgroup.com;jandaonline.com;marietteaernoudts.nl;veybachcenter.de;dpo-as-a-service.com;seevilla-dr-sturm.at;sachnendoc.com;mirjamholleman.nl;siliconbeach-realestate.com;worldhealthbasicinfo.com;spinheal.ru;supportsumba.nl;thewellnessmimi.com;noixdecocom.fr;liveottelut.com;vyhino-zhulebino-24.ru;logopaedie-blomberg.de;devstyle.org;licor43.de;gopackapp.com;delawarecorporatelaw.com;penco.ie;acomprarseguidores.com;lykkeliv.net;retroearthstudio.com;tigsltd.com;xn--vrftet-pua.biz;chatizel-paysage.fr;paymybill.guru;abogadosadomicilio.es;first-2-aid-u.com;gemeentehetkompas.nl;xlarge.at;milsing.hr;daniel-akermann-architektur-und-planung.ch;candyhouseusa.com;maasreusel.nl;mylolis.com;stefanpasch.me;mirjamholleman.nl;charlesreger.com;mdacares.com;panelsandwichmadrid.es;yourobgyn.net;irinaverwer.com;whittier5k.com;narcert.com;modestmanagement.com;micro-automation.de;baylegacy.com;izzi360.com;littlebird.salon;filmstreamingvfcomplet.be;craftleathermnl.com;triactis.com;qualitaetstag.de;insidegarage.pl;burkert-ideenreich.de;nakupunafoundation.org;stopilhan.com;kalkulator-oszczednosci.pl;igorbarbosa.com;saka.gr;fayrecreations.com;alvinschwartz.wordpress.com;www1.proresult.no;coding-machine.com;brandl-blumen.de;villa-marrakesch.de;ditog.fr;operaslovakia.sk;new.devon.gov.uk;philippedebroca.com;satyayoga.de;travelffeine.com;pelorus.group;mepavex.nl;binder-buerotechnik.at;boulderwelt-muenchen-west.de;schoolofpassivewealth.com;psc.de;wsoil.com.sg;mrtour.site;thomasvicino.com;morawe-krueger.de;praxis-management-plus.de;slimani.net;lucidinvestbank.com;faizanullah.com;ampisolabergeggi.it;rumahminangberdaya.com;mirjamholleman.nl;webcodingstudio.com;lecantou-coworking.com;stampagrafica.es;christinarebuffetcourses.com;foryourhealth.live;ncid.bc.ca;vermoote.de;nicoleaeschbachorg.wordpress.com;navyfederalautooverseas.com;gymnasedumanagement.com;hrabritelefon.hr;stallbyggen.se;limassoldriving.com;otto-bollmann.de;kissit.ca;flexicloud.hk;pcp-nc.com;dr-tremel-rednitzhembach.de;pixelarttees.com;sairaku.net;ogdenvision.com;people-biz.com;advizewealth.com;kedak.de;castillobalduz.es;webmaster-peloton.com;imperfectstore.com;4youbeautysalon.com;humanityplus.org;spd-ehningen.de;kao.at;argos.wityu.fund;coursio.com;lenreactiv-shop.ru;helenekowalsky.com;odiclinic.org;kindersitze-vergleich.de",
"dbg": false,
"pid": "$2a$10$gMHdtu094GE7DD46JvCH6.bPoHnpKjInjjdxBtPaRwAEY6gOWGKYG",
"nbody": "LQAtAC0APQA9AD0AIABXAGUAbABjAG8AbQBlAC4AIABBAGcAYQBpAG4ALgAgAD0APQA9AC0ALQAtAA0ACgANAAoAWwArAF0AIABXAGgAYQB0AHMAIABIAGEAcABwAGUAbgA/ACAAWwArAF0ADQAKAA0ACgBZAG8AdQByACAAZgBpAGwAZQBzACAAYQByAGUAIABlAG4AYwByAHkAcAB0AGUAZAAsACAAYQBuAGQAIABjAHUAcgByAGUAbgB0AGwAeQAgAHUAbgBhAHYAYQBpAGwAYQBiAGwAZQAuACAAWQBvAHUAIABjAGEAbgAgAGMAaABlAGMAawAgAGkAdAA6ACAAYQBsAGwAIABmAGkAbABlAHMAIABvAG4AIAB5AG8AdQByACAAcwB5AHMAdABlAG0AIABoAGEAcwAgAGUAeAB0AGUAbgBzAGkAbwBuACAAewBFAFgAVAB9AC4ADQAKAEIAeQAgAHQAaABlACAAdwBhAHkALAAgAGUAdgBlAHIAeQB0AGgAaQBuAGcAIABpAHMAIABwAG8AcwBzAGkAYgBsAGUAIAB0AG8AIAByAGUAYwBvAHYAZQByACAAKAByAGUAcwB0AG8AcgBlACkALAAgAGIAdQB0ACAAeQBvAHUAIABuAGUAZQBkACAAdABvACAAZgBvAGwAbABvAHcAIABvAHUAcgAgAGkAbgBzAHQAcgB1AGMAdABpAG8AbgBzAC4AIABPAHQAaABlAHIAdwBpAHMAZQAsACAAeQBvAHUAIABjAGEAbgB0ACAAcgBlAHQAdQByAG4AIAB5AG8AdQByACAAZABhAHQAYQAgACgATgBFAFYARQBSACkALgANAAoADQAKAFsAKwBdACAAVwBoAGEAdAAgAGcAdQBhAHIAYQBuAHQAZQBlAHMAPwAgAFsAKwBdAA0ACgANAAoASQB0AHMAIABqAHUAcwB0ACAAYQAgAGIAdQBzAGkAbgBlAHMAcwAuACAAVwBlACAAYQBiAHMAbwBsAHUAdABlAGwAeQAgAGQAbwAgAG4AbwB0ACAAYwBhAHIAZQAgAGEAYgBvAHUAdAAgAHkAbwB1ACAAYQBuAGQAIAB5AG8AdQByACAAZABlAGEAbABzACwAIABlAHgAYwBlAHAAdAAgAGcAZQB0AHQAaQBuAGcAIABiAGUAbgBlAGYAaQB0AHMALgAgAEkAZgAgAHcAZQAgAGQAbwAgAG4AbwB0ACAAZABvACAAbwB1AHIAIAB3AG8AcgBrACAAYQBuAGQAIABsAGkAYQBiAGkAbABpAHQAaQBlAHMAIAAtACAAbgBvAGIAbwBkAHkAIAB3AGkAbABsACAAbgBvAHQAIABjAG8AbwBwAGUAcgBhAHQAZQAgAHcAaQB0AGgAIAB1AHMALgAgAEkAdABzACAAbgBvAHQAIABpAG4AIABvAHUAcgAgAGkAbgB0AGUAcgBlAHMAdABzAC4ADQAKAFQAbwAgAGMAaABlAGMAawAgAHQAaABlACAAYQBiAGkAbABpAHQAeQAgAG8AZgAgAHIAZQB0AHUAcgBuAGkAbgBnACAAZgBpAGwAZQBzACwAIABZAG8AdQAgAHMAaABvAHUAbABkACAAZwBvACAAdABvACAAbwB1AHIAIAB3AGUAYgBzAGkAdABlAC4AIABUAGgAZQByAGUAIAB5AG8AdQAgAGMAYQBuACAAZABlAGMAcgB5AHAAdAAgAG8AbgBlACAAZgBpAGwAZQAgAGYAbwByACAAZgByAGUAZQAuACAAVABoAGEAdAAgAGkAcwAgAG8AdQByACAAZwB1AGEAcgBhAG4AdABlAGUALgANAAoASQBmACAAeQBvAHUAIAB3AGkAbABsACAAbgBvAHQAIABjAG8AbwBwAGUAcgBhAHQAZQAgAHcAaQB0AGgAIABvAHUAcgAgAHMAZQByAHYAaQBjAGUAIAAtACAAZgBvAHIAIAB1AHMALAAgAGkAdABzACAAZABvAGUAcwAgAG4AbwB0ACAAbQBhAHQAdABlAHIALgAgAEIAdQB0ACAAeQBvAHUAIAB3AGkAbABsACAAbABvAHMAZQAgAHkAbwB1AHIAIAB0AGkAbQBlACAAYQBuAGQAIABkAGEAdABhACwAIABjAGEAdQBzAGUAIABqAHUAcwB0ACAAdwBlACAAaABhAHYAZQAgAHQAaABlACAAcAByAGkAdgBhAHQAZQAgAGsAZQB5AC4AIABJAG4AIABwAHIAYQBjAHQAaQBjAGUAIAAtACAAdABpAG0AZQAgAGkAcwAgAG0AdQBjAGgAIABtAG8AcgBlACAAdgBhAGwAdQBhAGIAbABlACAAdABoAGEAbgAgAG0AbwBuAGUAeQAuAA0ACgANAAoAWwArAF0AIABIAG8AdwAgAHQAbwAgAGcAZQB0ACAAYQBjAGMAZQBzAHMAIABvAG4AIAB3AGUAYgBzAGkAdABlAD8AIABbACsAXQANAAoADQAKAFkAbwB1ACAAaABhAHYAZQAgAHQAdwBvACAAdwBhAHkAcwA6AA0ACgANAAoAMQApACAAWwBSAGUAYwBvAG0AbQBlAG4AZABlAGQAXQAgAFUAcwBpAG4AZwAgAGEAIABUAE8AUgAgAGIAcgBvAHcAcwBlAHIAIQANAAoAIAAgAGEAKQAgAEQAbwB3AG4AbABvAGEAZAAgAGEAbgBkACAAaQBuAHMAdABhAGwAbAAgAFQATwBSACAAYgByAG8AdwBzAGUAcgAgAGYAcgBvAG0AIAB0AGgAaQBzACAAcwBpAHQAZQA6ACAAaAB0AHQAcABzADoALwAvAHQAbwByAHAAcgBvAGoAZQBjAHQALgBvAHIAZwAvAA0ACgAgACAAYgApACAATwBwAGUAbgAgAG8AdQByACAAdwBlAGIAcwBpAHQAZQA6ACAAaAB0AHQAcAA6AC8ALwBhAHAAbABlAGIAegB1ADQANwB3AGcAYQB6AGEAcABkAHEAawBzADYAdgByAGMAdgA2AHoAYwBuAGoAcABwAGsAYgB4AGIAcgA2AHcAawBlAHQAZgA1ADYAbgBmADYAYQBxADIAbgBtAHkAbwB5AGQALgBvAG4AaQBvAG4ALwB7AFUASQBEAH0ADQAKAA0ACgAyACkAIABJAGYAIABUAE8AUgAgAGIAbABvAGMAawBlAGQAIABpAG4AIAB5AG8AdQByACAAYwBvAHUAbgB0AHIAeQAsACAAdAByAHkAIAB0AG8AIAB1AHMAZQAgAFYAUABOACEAIABCAHUAdAAgAHkAbwB1ACAAYwBhAG4AIAB1AHMAZQAgAG8AdQByACAAcwBlAGMAbwBuAGQAYQByAHkAIAB3AGUAYgBzAGkAdABlAC4AIABGAG8AcgAgAHQAaABpAHMAOgANAAoAIAAgAGEAKQAgAE8AcABlAG4AIAB5AG8AdQByACAAYQBuAHkAIABiAHIAbwB3AHMAZQByACAAKABDAGgAcgBvAG0AZQAsACAARgBpAHIAZQBmAG8AeAAsACAATwBwAGUAcgBhACwAIABJAEUALAAgAEUAZABnAGUAKQANAAoAIAAgAGIAKQAgAE8AcABlAG4AIABvAHUAcgAgAHMAZQBjAG8AbgBkAGEAcgB5ACAAdwBlAGIAcwBpAHQAZQA6ACAAaAB0AHQAcAA6AC8ALwBkAGUAYwBvAGQAZQByAC4AcgBlAC8AewBVAEkARAB9AA0ACgANAAoAVwBhAHIAbgBpAG4AZwA6ACAAcwBlAGMAbwBuAGQAYQByAHkAIAB3AGUAYgBzAGkAdABlACAAYwBhAG4AIABiAGUAIABiAGwAbwBjAGsAZQBkACwAIAB0AGgAYQB0AHMAIAB3AGgAeQAgAGYAaQByAHMAdAAgAHYAYQByAGkAYQBuAHQAIABtAHUAYwBoACAAYgBlAHQAdABlAHIAIABhAG4AZAAgAG0AbwByAGUAIABhAHYAYQBpAGwAYQBiAGwAZQAuAA0ACgANAAoAVwBoAGUAbgAgAHkAbwB1ACAAbwBwAGUAbgAgAG8AdQByACAAdwBlAGIAcwBpAHQAZQAsACAAcAB1AHQAIAB0AGgAZQAgAGYAbwBsAGwAbwB3AGkAbgBnACAAZABhAHQAYQAgAGkAbgAgAHQAaABlACAAaQBuAHAAdQB0ACAAZgBvAHIAbQA6AA0ACgBLAGUAeQA6AA0ACgANAAoADQAKAHsASwBFAFkAfQANAAoADQAKAA0ACgAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ADQAKAA0ACgAhACEAIQAgAEQAQQBOAEcARQBSACAAIQAhACEADQAKAEQATwBOAFQAIAB0AHIAeQAgAHQAbwAgAGMAaABhAG4AZwBlACAAZgBpAGwAZQBzACAAYgB5ACAAeQBvAHUAcgBzAGUAbABmACwAIABEAE8ATgBUACAAdQBzAGUAIABhAG4AeQAgAHQAaABpAHIAZAAgAHAAYQByAHQAeQAgAHMAbwBmAHQAdwBhAHIAZQAgAGYAbwByACAAcgBlAHMAdABvAHIAaQBuAGcAIAB5AG8AdQByACAAZABhAHQAYQAgAG8AcgAgAGEAbgB0AGkAdgBpAHIAdQBzACAAcwBvAGwAdQB0AGkAbwBuAHMAIAAtACAAaQB0AHMAIABtAGEAeQAgAGUAbgB0AGEAaQBsACAAZABhAG0AYQBnAGUAIABvAGYAIAB0AGgAZQAgAHAAcgBpAHYAYQB0AGUAIABrAGUAeQAgAGEAbgBkACwAIABhAHMAIAByAGUAcwB1AGwAdAAsACAAVABoAGUAIABMAG8AcwBzACAAYQBsAGwAIABkAGEAdABhAC4ADQAKACEAIQAhACAAIQAhACEAIAAhACEAIQANAAoATwBOAEUAIABNAE8AUgBFACAAVABJAE0ARQA6ACAASQB0AHMAIABpAG4AIAB5AG8AdQByACAAaQBuAHQAZQByAGUAcwB0AHMAIAB0AG8AIABnAGUAdAAgAHkAbwB1AHIAIABmAGkAbABlAHMAIABiAGEAYwBrAC4AIABGAHIAbwBtACAAbwB1AHIAIABzAGkAZABlACwAIAB3AGUAIAAoAHQAaABlACAAYgBlAHMAdAAgAHMAcABlAGMAaQBhAGwAaQBzAHQAcwApACAAbQBhAGsAZQAgAGUAdgBlAHIAeQB0AGgAaQBuAGcAIABmAG8AcgAgAHIAZQBzAHQAbwByAGkAbgBnACwAIABiAHUAdAAgAHAAbABlAGEAcwBlACAAcwBoAG8AdQBsAGQAIABuAG8AdAAgAGkAbgB0AGUAcgBmAGUAcgBlAC4ADQAKACEAIQAhACAAIQAhACEAIAAhACEAIQAAAA==",
"et": 2,
"wipe": true,
"wfld": [
"backup"
],
"rdmcnt": 0,
"nname": "{EXT}-readme.txt",
"pk": "i8nVoXJqCzfTnPW6fievw/HIPpURDWiYdrM/rbbD3kI=",
"net": true,
"exp": false,
"arn": true
}
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
MAL_RANSOM_REvil_Oct20_1 | Detects REvil ransomware | Florian Roth |
|
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
MAL_RANSOM_REvil_Oct20_1 | Detects REvil ransomware | Florian Roth |
| |
MAL_RANSOM_REvil_Oct20_1 | Detects REvil ransomware | Florian Roth |
| |
JoeSecurity_Sodinokibi | Yara detected Sodinokibi Ransomware | Joe Security | ||
JoeSecurity_Sodinokibi | Yara detected Sodinokibi Ransomware | Joe Security | ||
JoeSecurity_Sodinokibi | Yara detected Sodinokibi Ransomware | Joe Security | ||
Click to see the 5 entries |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
MAL_RANSOM_REvil_Oct20_1 | Detects REvil ransomware | Florian Roth |
| |
MAL_RANSOM_REvil_Oct20_1 | Detects REvil ransomware | Florian Roth |
| |
MAL_RANSOM_REvil_Oct20_1 | Detects REvil ransomware | Florian Roth |
| |
MAL_RANSOM_REvil_Oct20_1 | Detects REvil ransomware | Florian Roth |
|
Sigma Overview |
---|
No Sigma rule has matched |
---|
Signature Overview |
---|
- • AV Detection
- • Cryptography
- • Compliance
- • Spreading
- • Networking
- • Spam, unwanted Advertisements and Ransom Demands
- • System Summary
- • Data Obfuscation
- • Persistence and Installation Behavior
- • Malware Analysis System Evasion
- • Anti Debugging
- • HIPS / PFW / Operating System Protection Evasion
- • Language, Device and Operating System Detection
Click to jump to signature section
Show All Signature Results
AV Detection: |
---|
Antivirus / Scanner detection for submitted sample |
Source: | Avira: |
Found malware configuration |
Source: | Malware Configuration Extractor: |