Sodinokibi_Ransomware_01-08-2019

#sodinokibi #Ransomware
-------------------------------
01-08-2019
-------------------------------
Main object- "4d9a0deb300a834349526fd2f634e4dd81f259127382b14762f4919b459635cc.bin.gz"
	sha256	154d7398e4f3e520d8c2168efef65e2af2404584f4c1660aacb82dd1359e7271
	sha1	f80216b40b2ef0176951cd0b02716af1f0b5222c
	md5	deee30243b8fd777e7bdfe96537b962a
Dropped executable file
	sha256	C:\Users\admin\Desktop\4d9a0deb300a834349526fd2f634e4dd81f259127382b14762f4919b459635cc.bin.gz	4d9a0deb300a834349526fd2f634e4dd81f259127382b14762f4919b459635cc
DNS requests
	domain	awag-blog.de
	domain	rivermusic.nl
	domain	endstarvation.com
	domain	sveneulberg.de
	domain	oro.ae
	domain	four-ways.com
	domain	palema.gr
	domain	mindfuelers.com
	domain	wirmuessenreden.com
	domain	slotspinner.com
	domain	happylublog.wordpress.com
	domain	loysonbryan.com
	domain	perfectgrin.com
	domain	ronaldhendriks.nl
	domain	www.ciga-france.fr
	domain	insane.agency
	domain	mundo-pieces-auto.fr
	domain	bridalcave.com
	domain	powershell.su
	domain	akcadagofis.com
	domain	jlgraphisme.fr
	domain	gavelmasters.com
	domain	jax-interim-and-projectmanagement.com
	domain	zwemofficial.nl
	domain	ciga-france.fr
	domain	www.stagefxinc.com
	domain	ayudaespiritualtamara.com
	domain	stagefxinc.com
	domain	mike.matthies.de
	domain	dierenambulancealkmaar.nl
	domain	eatyoveges.com
	domain	sycamoregreenapts.com
	domain	from02pro.com
	domain	molinum.pt
	domain	shortsalemap.com
Connections
	ip	89.110.129.56
	ip	94.23.87.17
	ip	195.201.29.161
	ip	104.16.18.74
	ip	95.170.72.94
	ip	148.251.235.217
	ip	35.185.122.102
	ip	62.113.233.7
	ip	104.28.26.170
	ip	178.77.83.248
	ip	104.37.84.171
	ip	185.154.136.222
	ip	104.20.4.245
	ip	164.132.235.17
	ip	8.248.113.254
	ip	69.168.78.206
	ip	192.0.78.13
	ip	92.222.234.4
	ip	31.7.7.155
	ip	91.184.0.30
	ip	160.153.131.189
	ip	89.252.190.48
	ip	185.103.16.188
	ip	195.114.26.214
	ip	195.242.92.8
	ip	51.77.137.26
	ip	54.247.91.90
	ip	54.72.3.133
	ip	216.15.197.23
	ip	149.56.35.134
	ip	37.46.140.5
	ip	192.145.232.92
	ip	209.99.64.51
	ip	51.68.89.43
	ip	81.18.99.16