# Copyright (c) 2014-present Maltrail developers (https://github.com/stamparm/trails/) # See the file 'LICENSE.md' for copying permission # Aliases: revil ransomware # Reference: https://blog.talosintelligence.com/2019/04/sodinokibi-ransomware-exploits-weblogic.html # Reference: https://tria.ge/210703-cggr9ffskx aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion decoder.re decryptor.top http://130.61.54.136 # Reference: https://twitter.com/struppigel/status/1134472294456320000 blaerck.xyz # Reference: https://twitter.com/James_inthe_box/status/1130541505356095488 # Reference: https://pastebin.com/LFHR1XX1 jg4rli4xoagvvmw47fr2bnnfu7t2epj6owrgyoee7daoh4gxvbt3bhyd.onion # Reference: https://pastebin.com/dCyaDZEm sritoosoosd.xyz # Reference: https://twitter.com/rikvduijn/status/1229688433339179008 decryptor.cc # Reference: https://twitter.com/FaLconIntel/status/1235580218842083329 http://165.22.105.225 # Reference: https://www.virustotal.com/gui/file/457d9e4773f45954449ee5913d068fdbb3d8e5689019688e7bce901467e5473a/detection texet1.ug texet2.ug # Reference: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/sodinokibi-ransomware-cobalt-strike-pos # Reference: https://otx.alienvault.com/pulse/5ef222cc894e26def88c012f d2zblloliromfu.cloudfront.net # Reference: https://pastebin.com/CBf5jyJR 1kbk.com.ua/static/pictures/busraf.gif 2ekeus.nl/static/pics/bvro.gif 321play.com.hk/news/images/evod.jpg 4youbeautysalon.com/admin/tmp/glrikhfr.gif abogadosaccidentetraficosevilla.es/static/game/udsasvhiao.jpg admos-gleitlager.de/static/graphic/whxtcw.jpg allentownpapershow.com/news/graphic/fmdq.png allure-cosmetics.at/admin/tmp/musncckhhwtz.gif alvinschwartz.wordpress.com/data/pics/tgzehk.png amylendscrestview.com/content/tmp/jnqioy.jpg andersongilmour.co.uk/admin/tmp/thlbgfmh.png aprepol.com/admin/pics/rykpak.jpg apulolucanacalabrese.sinitaly.org/ apulolucanacalabrese.sinitaly.org/include/pics/xdta.png architekturbuero-wagner.net/static/temp/inupmpkxup.jpg art2gointerieurprojecten.nl/news/graphic/tgvukqyiumjuhe.gif asiluxury.com/news/assets/nnmimjum.png associationanalytics.com/wp-content/images/jfubvfjy.jpg babcockchurch.org/uploads/pics/hhlhyg.jpg baronloan.org/news/game/ceqgwibm.gif bauertree.com/admin/images/tltzfm.jpg baumkuchenexpo.jp/static/game/afhbnjni.jpg bimnapratica.com/data/temp/bitrfp.gif biortaggivaldelsa.com/admin/graphic/jbvjengl.png blood-sports.net/static/assets/hdljudeh.jpg bodyforwife.com/data/tmp/ildylybotm.gif bookspeopleplaces.com/wp-content/image/nkkogpnv.jpg botanicinnovations.com/wp-content/images/apvkdxcdfvle.gif bouldercafe-wuppertal.de/uploads/temp/ijph.png bouquet-de-roses.com/data/images/sa.gif brawnmediany.com/static/tmp/ibdwda.gif brevitempore.net/content/game/erfj.jpg bridgeloanslenders.com/uploads/tmp/gtvjexcsapgpuo.gif bristolaeroclub.co.uk/uploads/pics/uaiijjjj.jpg camsadviser.com/content/tmp/rbmjvgpbkt.gif caribbeansunpoker.com/include/temp/qnvrrvhwpz.jpg caribdoctor.org/wp-content/image/actpuqfo.jpg carriagehousesalonvt.com/news/image/tfvsvo.gif carrot.com/uploads/pics/gqcb.png catholicmusicfest.com/data/assets/fxgsgdod.png celeclub.org/static/pics/fvyixtii.gif centuryrs.com/news/image/cvhg.gif chaotrang.com/news/pics/kozd.png chefdays.de/static/tmp/tqwm.jpg citymax-cr.com/news/images/dsavmyobfkdf.png comarenterprises.com/admin/tmp/jk.jpg commercialboatbuilding.com/data/assets/go.jpg commonground-stories.com/content/assets/jgxlwuzhqmdp.gif corendonhotels.com/data/pics/lgeszq.jpg craigvalentineacademy.com/data/graphic/otkwktwfrfoz.gif cranleighscoutgroup.org/uploads/pics/bdga.jpg croftprecision.co.uk/news/image/iobato.jpg d1franchise.com/admin/pics/njdadk.jpg darnallwellbeing.org.uk/admin/graphic/ksmjjubszuyy.gif degroenetunnel.com/admin/pics/iawm.jpg deltacleta.cat/news/assets/to.jpg deoudedorpskernnoordwijk.nl/include/pics/cq.jpg deschl.net/uploads/graphic/citmrksnuktr.gif div-vertriebsforschung.de/news/tmp/jtqqrxpvpm.png dlc.berlin/static/image/yvegbmld.gif dr-tremel-rednitzhembach.de/static/temp/vjdkdq.gif drfoyle.com/data/images/xn.png dushka.ua/static/images/mtwxeb.jpg dutchbrewingcoffee.com/uploads/pictures/fownxn.gif dutchcoder.nl/include/pictures/eqawtb.jpg dw-css.de/data/image/qzwb.gif ecpmedia.vn/data/tmp/aowqgmosyn.jpg edgewoodestates.org/content/temp/vvpjywsjxq.jpg entopic.com/static/assets/ftkvrj.png erstatningsadvokaterne.dk/news/game/raxdjoznkc.jpg euro-trend.pl/include/pics/iz.gif evangelische-pfarrgemeinde-tuniberg.de/news/graphic/ptsrysfz.gif evologic-technologies.com/wp-content/pictures/xhdqbnzp.gif exenberger.at/admin/pictures/codnjkrswqoqjpfrfa.jpg exenberger.at/admin/pictures/codnjkrswqoqjpfrfa.jpg faizanullah.com/wp-content/pictures/idvvvf.jpg falcou.fr/admin/image/obnxxa.gif fannmedias.com/admin/images/ecbfkc.jpg farhaani.com/wp-content/pictures/iyss.png fibrofolliculoma.info/static/tmp/mu.gif figura.team/admin/pics/pfhvcppq.gif financescorecard.com/include/pictures/sqlaooyifoxntnvm.png fizzl.ru/data/graphic/iuhnop.png foretprivee.ca/admin/temp/eysbkp.png fotoscondron.com/include/graphic/kunmqm.jpg fransespiegels.nl/include/images/qhknqjdmjvcp.png ftf.or.at/data/game/lauj.png ftlc.es/static/pics/upwchnjp.gif funjose.org.gt/admin/graphic/mwijrxosrvanmd.png galleryartfair.com/include/temp/tinhsgjpqccd.png gasolspecialisten.se/uploads/game/hndmhhfhvgqi.jpg gemeentehetkompas.nl/include/graphic/tdmhjpnvixdv.jpg geoffreymeuli.com/uploads/game/ghugvdbt.jpg gonzalezfornes.es/news/image/hvcxaltq.jpg gopackapp.com/news/assets/pqyjdjqzqa.jpg greenfieldoptimaldentalcare.com/news/pics/ympbqzyt.gif grelot-home.com/wp-content/tmp/iqbw.gif hannah-fink.de/static/image/hrziwuuwojtlew.png hatech.io/include/temp/tqbe.gif helikoptervluchtnewyork.nl/static/pictures/spmn.gif hellohope.com/static/game/cpjcgw.jpg henricekupper.com/static/pictures/oynrubvahoptvr.gif herbayupro.com/news/graphic/ytthsl.jpg hexcreatives.co/static/graphic/qtchyesr.png hmsdanmark.dk/wp-content/pics/xb.jpg humancondition.com/uploads/pictures/qrbc.gif ilcdover.com/data/images/cgsviu.png imadarchid.com/uploads/tmp/odsg.gif ino-professional.ru/content/assets/avoxrx.gif insigniapmg.com/data/pictures/kf.png insp.bi/uploads/graphic/az.jpg intecwi.com/admin/pictures/txzuzcqj.gif itelagen.com/data/pictures/pplr.gif iwelt.de/static/pics/he.png iwelt.de/wp-content/tmp/yrzw.gif jameskibbie.com/wp-content/graphic/djeg.jpg jiloc.com/news/tmp/xdwd.jpg johnsonfamilyfarmblog.wordpress.com/data/temp/pggmixeqmp.gif jvanvlietdichter.nl/wp-content/tmp/kphbex.jpg kamahouse.net/data/game/hyacuscidk.jpg kampotpepper.gives/wp-content/pictures/awncjtwctqkl.png kao.at/include/pictures/zaubtpcj.jpg kaotikkustomz.com/content/images/xd.gif kidbucketlist.com.au/news/graphic/ks.jpg kirkepartner.dk/uploads/graphic/wwqcqtbr.gif kisplanning.com.au/wp-content/assets/kstfzfqg.jpg knowledgemuseumbd.com/wp-content/assets/iqtdkpgs.jpg koko-nora.dk/include/graphic/nukkmilo.gif kuntokeskusrok.fi/uploads/image/utktbiondmxwtyez.jpg kunze-immobilien.de/content/image/asjvvynhbooachekol.gif ladelirante.fr/static/temp/xcgybe.jpg latestmodsapks.com/wp-content/images/bfrjue.gif layrshift.eu/uploads/pictures/hhhazfdc.jpg lbcframingelectrical.com/data/images/wcudamjj.jpg leather-factory.co.jp/wp-content/pics/hztedb.jpg levdittliv.se/blogg/ursula/ett-litet-livstecken-och-sondagsbestyr/ levdittliv.se/wp-content/game/bkks.gif limassoldriving.com/include/graphic/poejihstemym.png live-your-life.jp/static/game/naqdlv.png lubetkinmediacompanies.com/include/pictures/ym.gif lusak.at/news/graphic/flolbbbleaiz.gif mank.de/include/pictures/fqsy.jpg mapawood.com/news/tmp/vq.jpg marathonerpaolo.com/data/pictures/nljxwtgnwd.gif marcuswhitten.site/data/tmp/bbba.gif mardenherefordshire-pc.gov.uk/news/tmp/bwbl.gif mdk-mediadesign.de/static/game/uckvvb.gif mediaacademy-iraq.org/include/assets/ssrxtb.jpg mepavex.nl/news/temp/kurecajjfu.jpg micahkoleoso.de/wp-content/pics/ne.png milltimber.aberdeen.sch.uk/data/images/cmbgwt.gif mirjamholleman.nl/admin/tmp/yrqrqvzisjfm.jpg mirjamholleman.nl/content/graphic/ec.jpg mirkoreisser.de/wp-content/graphic/hqbcmj.jpg mmgdouai.fr/content/tmp/ongsdzlnmb.png modestmanagement.com/data/temp/ycjeafikygzx.jpg monark.com/uploads/graphic/zivorvzo.jpg morawe-krueger.de/wp-content/pictures/zmme.gif mountaintoptinyhomes.com/wp-content/image/oxaf.png mousepad-direkt.de/wp-content/image/cbrz.gif mylolis.com/include/tmp/ymkppbiacysl.jpg nacktfalter.de/wp-content/assets/oifa.png naturavetal.hr/wp-content/tmp/zpfhhmro.png naturavetal.hr/wp-content/tmp/zpfhhmro.png/ ncid.bc.ca/wp-content/graphic/ufftbr.gif noixdecocom.fr/include/pictures/fjjcrg.jpg norovirus-ratgeber.de/admin/images/yhguqd.jpg notsilentmd.org/uploads/pictures/xtloos.png nuzech.com/wp-content/graphic/ja.jpg odiclinic.org/news/temp/bl.png oneheartwarriors.at/uploads/temp/bhuusf.jpg oneplusresource.org/news/images/bhtbzw.gif ostheimer.at/admin/graphic/cdstvysv.jpg parebrise-tla.fr/wp-content/pics/mrin.jpg pawsuppetlovers.com/wp-content/assets/yfinbsmr.png people-biz.com/uploads/pictures/foszqw.jpg peterstrobos.com/news/tmp/sxspoh.png physiofischer.de/news/tmp/esag.png pierrehale.com/include/image/uoarjftduzwr.png planchaavapor.net/news/graphic/yqml.jpg plotlinecreative.com/news/assets/puimdl.jpg pogypneu.sk/content/tmp/tbny.jpg polymedia.dk/data/graphic/xcdntb.jpg projetlyonturin.fr/include/pics/rvsuzbfz.png promalaga.es/admin/temp/mzeuxd.gif purposeadvisorsolutions.com/news/tmp/xwvdne.jpg qlog.de/content/tmp/mhdnefoq.png qualitus.com/include/temp/tgnjksyubpjb.gif ralister.co.uk/uploads/temp/dlknkr.png refluxreducer.com/content/pictures/cxccxf.jpg remcakram.com/include/images/roushtjuaf.gif rerekatu.com/data/game/irhvcgafnt.png restaurantesszimmer.de/data/images/gckqniey.gif rosavalamedahr.com/wp-content/images/oshfqymkng.png samnewbyjax.com/content/graphic/oacplhjp.jpg sanaia.com/data/tmp/fotxqjei.gif schmalhorst.de/content/image/ddjwjity.png seagatesthreecharters.com/news/temp/ssoqpadh.gif shhealthlaw.com/static/pics/zypxvxyvrr.jpg shiresresidential.com/news/tmp/ssotiwhhkrghpxza.gif simpliza.com/data/pics/kkaptg.gif sinal.org/include/pics/xdta.png smhydro.com.pl/uploads/assets/wtev.gif sofavietxinh.com/wp-content/pictures/bpknfp.jpg softsproductkey.com/static/pics/biciruogxn.png songunceliptv.com/data/pictures/zsmdvfns.jpg sotsioloogia.ee/include/temp/mspfhmitzxcw.gif spargel-kochen.de/data/game/fmjtqk.jpg spd-ehningen.de/wp-content/tmp/uwojatiokw.jpg spinheal.ru/include/graphic/im.png sportiomsportfondsen.nl/wp-content/pictures/qbul.png spsshomeworkhelp.com/news/pictures/rd.gif spylista.com/admin/tmp/yb.png stacyloeb.com/news/game/wcmlfzatye.gif stallbyggen.se/data/game/zcxflz.png steampluscarpetandfloors.com/data/pictures/kprv.jpg stemenstilte.nl/news/graphic/duqyglowplyl.jpg sterlingessay.com/wp-content/game/cvrxkg.png strandcampingdoonbeg.com/static/images/ntompepufh.png takeflat.com/admin/pictures/tsyg.jpg team-montage.dk/content/graphic/ysvhmkqr.png tennisclubetten.nl/admin/pictures/zs.gif teresianmedia.org/static/image/vhfc.jpg testcoreprohealthuk.com/static/pictures/slbrib.gif thaysa.com/static/pics/exlxmmrtfh.gif theadventureedge.com/uploads/game/qhmqytvz.jpg thedresserie.com/include/image/wj.jpg theletter.company/news/images/heviuo.jpg tophumanservicescourses.com/wp-content/assets/vycpgcyzrfnx.jpg tradiematepro.com.au/uploads/pics/mjsvqv.jpg trapiantofue.it/data/assets/ntvy.png triactis.com/uploads/image/ayysdqhw.gif uimaan.fi/news/tmp/vzcphfla.jpg unetica.fr/admin/graphic/jjthdbppehrikoci.jpg unim.su/wp-content/pictures/cxow.gif upmrkt.co/admin/game/fvzt.jpg vannesteconstruct.be/content/graphic/aggrey.png vdberg-autoimport.nl/wp-content/game/uliiohjxap.gif vetapharma.fr/static/assets/hagmbt.png victoriousfestival.co.uk/wp-content/pics/vszziakshyqn.gif vox-surveys.com/content/assets/tbgrycsg.png waermetauscher-berechnen.de/include/graphic/vwvvzh.gif withahmed.com/admin/game/squhbrgy.jpg work2live.de/data/tmp/dtjx.gif worldhealthbasicinfo.com/uploads/pics/dolfjbdg.gif wraithco.com/static/images/ao.png x-ray.ca/static/tmp/topoznxero.jpg xltyu.com/news/assets/qr.jpg xn--rumung-bua.online/admin/pictures/nfxuqi.gif xtptrack.com/data/assets/esqftccgzqts.png yamalevents.com/data/image/kxuk.png ymca-cw.org.uk/static/tmp/wpud.jpg zflas.com/news/graphic/pgdkatftog.jpg zweerscreatives.nl/news/images/wggjcoztzi.jpg # Reference: https://twitter.com/petrovic082/status/1361329514006130688 # Reference: https://app.any.run/tasks/9a9a7109-8497-4e1e-b3d7-b9ab0871ea9e/ bxdf.info wien-mitte.co.at # Reference: https://www.virustotal.com/gui/ip-address/47.254.157.47/relations # Reference: https://www.virustotal.com/gui/file/ba866f0adc77a7c8a6b43e850c4ef2f41ddf4fe3f28d8e2f75725b81e49d2f28/detection ct-ov.com pub4-av.com pub5-ne.com v-chek.in vt-ne.com # Reference: https://www.virustotal.com/gui/file/b597a7c849b4693db2176beead29994589820b761865e715b8550365b77db6e0/detection 163.44.193.202:2031 # Reference: https://app.any.run/tasks/3d31648e-4b70-4fd7-983d-c7c974b61f69/ 142.93.226.233:2031 149.28.63.121:2031 162.212.157.109:2031 185.95.0.202:2031 207.180.244.46:2031 23.227.163.206:2031 46.4.135.209:2031 59.103.72.44:2031 89.40.115.248:2031 94.182.110.253:2031 # Reference: https://www.virustotal.com/gui/file/06bb23abb39548a40803904e4b31813f1266bec70a1334cd8d31dafdab06331d/detection hotbooks.tech vsblobprodscussu5shard44.blob.core.windows.net # Reference: https://www.hackplayers.com/2021/02/sitios-cibercriminales-deepweb.html dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion # Reference: https://twitter.com/_JohnHammond/status/1516814490339262466 blogxxu75w63ujqarv476otld7cyjkq4yoswzt4ijadkjwvg3vrvd5yd.onion rutordeepkpafpudl22pbbhzm4llbgncunvgcc66kax55sc4mp4kxcid.onion # Reference: https://www.secureworks.com/blog/revil-development-adds-confidence-about-gold-southfield-reemergence # Reference: https://otx.alienvault.com/pulse/627b8dbb42c9fd8c9f507039 jwvg3vrvd5yd.onion parvtmkatpaad.onion # Reference: https://app.any.run/tasks/08f6226d-1fcf-456d-9384-2d09e2527dc1/ # Reference: https://www.virustotal.com/gui/file/05b98ed1d8e7d430dd6c2782ffbe5c7e1c60f5bd467adab834fc0a73274b2ea2/detection 4net.guru # Reference: https://www.virustotal.com/gui/file/5d65ced6c4ff479adf832bd32fba75a1dcd4238aec3373dd015775e3f93f88e5/detection better.town # Reference: https://www.virustotal.com/gui/file/06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851/detection eafx.pro # Reference: https://www.virustotal.com/gui/file/1964648e1f5546ed1080fbc26566b46ddeaa454872626df8d69b207b7a03a042/detection myzk.site # Reference: https://www.virustotal.com/gui/file/5e070b90eadf047e5ba56e982c709e1da2103599beb15357f6a782ceed810743/detection soks5.icu # Reference: https://www.virustotal.com/gui/file/6d539489d922ce7f5feb151f763feec097fac7bb8ccdf23cf297e02d5d126546/detection 178.128.56.21:4124 # Reference: https://twitter.com/AuCyble/status/1667057291760402432 et22fibzuzfyzgurm35sttm52qbzvdgzy5qhzy46a3gmkrrht3lec5ad.onion # Reference: https://x.com/AlvieriD/status/1841857467564593349 ipi4tiumgzjsym6pyuzrfqrtwskokxokqannmd6sa24shvr7x5kxdvqd.onion j75o7xvvsm4lpsjhkjvb4wl2q6ajegvabe6oswthuaubbykk4xkzgpid.onion lue5xijndjbk5hs2ugz4oolfawes32ricywppy7dz5yu6x3hxnjvn5ad.onion