Sodinokibi_Ransomware_04-07-2019

#sodinokibi #Ransomware
--------------------------------------
04-07-2019
--------------------------------------
Main object- "dd05b24610d5f9513e68201a88cdb05391bfd061346a7274062d1416e8322ff6.bin.gz"
	sha256	d659e06a81e6b0c4b3785ed25cd9b5bc54c2bfe8a491959153269e31dc8b639d
	sha1	dbdb547ad0268b3241e9d67c425e02ad073c0179
	md5	1b0b26187392c780587de9fdfa45a362
	ssdeep_parts	[object Object]
Dropped executable file
	sha256	C:\Users\admin\Desktop\dd05b24610d5f9513e68201a88cdb05391bfd061346a7274062d1416e8322ff6.bin.gz	dd05b24610d5f9513e68201a88cdb05391bfd061346a7274062d1416e8322ff6
DNS requests
	domain	auberives-sur-vareze.fr
	domain	so-sage.fr
	domain	aquacheck.co.za
	domain	katherinealy.com
	domain	selected-minds.de
	domain	nuohous.com
	domain	www.makingmillionaires.net
	domain	makingmillionaires.net
	domain	piestar.com
	domain	outstandingminialbums.com
	domain	bubbalucious.com
	domain	projektparkiet.pl
	domain	golfclublandgoednieuwkerk.nl
	domain	maxcube24.com.ua
	domain	rentsportsequip.com
	domain	rino-gmbh.com
	domain	bourchier.org
	domain	qwikcoach.com
	domain	jlgraphisme.fr
	domain	xrresources.com
	domain	accounts.google.com
	domain	the3-week-diet.net
	domain	decryptor.top
	domain	gratiocafeblog.wordpress.com
	domain	marcandy.com
	domain	mieleshopping.it
	domain	cleanroomequipment.ie
	domain	fanuli.com.au
	domain	asiaartgallery.jp
	domain	alabamaroofingllc.com
	domain	adedesign.com
	domain	tesisatonarim.com
	domain	ziliak.com
	domain	spectamarketingdigital.com.br
	domain	signamedia.de
	domain	egpu.fr
	domain	barbaramcfadyenjewelry.com
	domain	111firstdelray.com
	domain	frimec-international.es
	domain	latteswithleslie.com
	domain	www.alabamaroofingllc.com
	domain	ayudaespiritualtamara.com
	domain	www.cleanroomequipment.ie
	domain	drbenveniste.com
	domain	dogsunlimitedguide.com
	domain	teamsegeln.ch
	domain	physio-lang.de
	domain	pajagus.fr
	domain	look.academy
	domain	myfbateam.com
	domain	activeterroristwarningcompany.com
	domain	nutriwell.com.sg
	domain	dibli.store
	domain	charlesfrancis.photos
	domain	www.airserviceunlimited.com
	domain	pvandambv.nl
	domain	mazzaropi.com.br
	domain	eurethicsport.eu
	domain	airserviceunlimited.com
Connections
	ip	197.221.14.44
	ip	217.182.126.186
	ip	104.18.41.218
	ip	5.35.250.124
	ip	217.160.0.166
	ip	164.132.235.17
	ip	162.255.118.194
	ip	77.94.249.22
	ip	35.170.173.134
	ip	178.32.51.80
	ip	159.203.65.67
	ip	185.55.85.6
	ip	212.90.148.124
	ip	88.99.61.233
	ip	185.68.16.21
	ip	104.28.29.191
	ip	178.32.76.90
	ip	5.152.193.244
	ip	69.195.124.231
	ip	146.66.113.232
	ip	195.114.26.214
	ip	192.0.78.13
	ip	46.30.215.229
	ip	185.197.128.45
	ip	89.145.92.29
	ip	91.214.71.139
	ip	198.46.93.64
	ip	89.234.180.47
	ip	136.243.123.152
	ip	206.189.196.208
	ip	104.31.80.46
	ip	209.182.204.181
	ip	8.248.113.254
	ip	104.28.9.186
	ip	52.71.222.18
	ip	188.165.33.133
	ip	23.185.0.2
	ip	183.90.242.17
	ip	185.2.4.41
	ip	83.166.138.104
	ip	37.230.97.92
	ip	64.90.33.203
	ip	104.27.133.249
	ip	185.119.173.174
	ip	83.150.213.43
	ip	104.27.166.25
	ip	149.56.35.134
	ip	173.199.126.114
	ip	78.46.155.135
	ip	108.160.146.5
	ip	78.46.5.147
	ip	91.134.24.251
	ip	104.25.17.111
	ip	50.116.71.86
	ip	104.24.19.18
	ip	184.168.221.83
	ip	81.19.159.69
HTTP/HTTPS requests
	url	http://decryptor.top/C2D97495C4BA3647