# Copyright (c) 2014-2021 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Aliases: revil ransomware

# Reference: https://blog.talosintelligence.com/2019/04/sodinokibi-ransomware-exploits-weblogic.html
# Reference: https://tria.ge/210703-cggr9ffskx

aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion
decoder.re
decryptor.top
http://130.61.54.136

# Reference: https://twitter.com/struppigel/status/1134472294456320000

blaerck.xyz

# Reference: https://twitter.com/James_inthe_box/status/1130541505356095488
# Reference: https://pastebin.com/LFHR1XX1

jg4rli4xoagvvmw47fr2bnnfu7t2epj6owrgyoee7daoh4gxvbt3bhyd.onion

# Reference: https://pastebin.com/dCyaDZEm

sritoosoosd.xyz

# Reference: https://twitter.com/rikvduijn/status/1229688433339179008

decryptor.cc

# Reference: https://twitter.com/FaLconIntel/status/1235580218842083329

http://165.22.105.225

# Reference: https://www.virustotal.com/gui/file/457d9e4773f45954449ee5913d068fdbb3d8e5689019688e7bce901467e5473a/detection

texet1.ug
texet2.ug

# Reference: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/sodinokibi-ransomware-cobalt-strike-pos
# Reference: https://otx.alienvault.com/pulse/5ef222cc894e26def88c012f

d2zblloliromfu.cloudfront.net

# Reference: https://pastebin.com/CBf5jyJR

1kbk.com.ua/static/pictures/busraf.gif
2ekeus.nl/static/pics/bvro.gif
321play.com.hk/news/images/evod.jpg
4youbeautysalon.com/admin/tmp/glrikhfr.gif
abogadosaccidentetraficosevilla.es/static/game/udsasvhiao.jpg
admos-gleitlager.de/static/graphic/whxtcw.jpg
allentownpapershow.com/news/graphic/fmdq.png
allure-cosmetics.at/admin/tmp/musncckhhwtz.gif
alvinschwartz.wordpress.com/data/pics/tgzehk.png
amylendscrestview.com/content/tmp/jnqioy.jpg
andersongilmour.co.uk/admin/tmp/thlbgfmh.png
aprepol.com/admin/pics/rykpak.jpg
apulolucanacalabrese.sinitaly.org/
apulolucanacalabrese.sinitaly.org/include/pics/xdta.png
architekturbuero-wagner.net/static/temp/inupmpkxup.jpg
art2gointerieurprojecten.nl/news/graphic/tgvukqyiumjuhe.gif
asiluxury.com/news/assets/nnmimjum.png
associationanalytics.com/wp-content/images/jfubvfjy.jpg
babcockchurch.org/uploads/pics/hhlhyg.jpg
baronloan.org/news/game/ceqgwibm.gif
bauertree.com/admin/images/tltzfm.jpg
baumkuchenexpo.jp/static/game/afhbnjni.jpg
bimnapratica.com/data/temp/bitrfp.gif
biortaggivaldelsa.com/admin/graphic/jbvjengl.png
blood-sports.net/static/assets/hdljudeh.jpg
bodyforwife.com/data/tmp/ildylybotm.gif
bookspeopleplaces.com/wp-content/image/nkkogpnv.jpg
botanicinnovations.com/wp-content/images/apvkdxcdfvle.gif
bouldercafe-wuppertal.de/uploads/temp/ijph.png
bouquet-de-roses.com/data/images/sa.gif
brawnmediany.com/static/tmp/ibdwda.gif
brevitempore.net/content/game/erfj.jpg
bridgeloanslenders.com/uploads/tmp/gtvjexcsapgpuo.gif
bristolaeroclub.co.uk/uploads/pics/uaiijjjj.jpg
camsadviser.com/content/tmp/rbmjvgpbkt.gif
caribbeansunpoker.com/include/temp/qnvrrvhwpz.jpg
caribdoctor.org/wp-content/image/actpuqfo.jpg
carriagehousesalonvt.com/news/image/tfvsvo.gif
carrot.com/uploads/pics/gqcb.png
catholicmusicfest.com/data/assets/fxgsgdod.png
celeclub.org/static/pics/fvyixtii.gif
centuryrs.com/news/image/cvhg.gif
chaotrang.com/news/pics/kozd.png
chefdays.de/static/tmp/tqwm.jpg
citymax-cr.com/news/images/dsavmyobfkdf.png
comarenterprises.com/admin/tmp/jk.jpg
commercialboatbuilding.com/data/assets/go.jpg
commonground-stories.com/content/assets/jgxlwuzhqmdp.gif
corendonhotels.com/data/pics/lgeszq.jpg
craigvalentineacademy.com/data/graphic/otkwktwfrfoz.gif
cranleighscoutgroup.org/uploads/pics/bdga.jpg
croftprecision.co.uk/news/image/iobato.jpg
d1franchise.com/admin/pics/njdadk.jpg
darnallwellbeing.org.uk/admin/graphic/ksmjjubszuyy.gif
degroenetunnel.com/admin/pics/iawm.jpg
deltacleta.cat/news/assets/to.jpg
deoudedorpskernnoordwijk.nl/include/pics/cq.jpg
deschl.net/uploads/graphic/citmrksnuktr.gif
div-vertriebsforschung.de/news/tmp/jtqqrxpvpm.png
dlc.berlin/static/image/yvegbmld.gif
dr-tremel-rednitzhembach.de/static/temp/vjdkdq.gif
drfoyle.com/data/images/xn.png
dushka.ua/static/images/mtwxeb.jpg
dutchbrewingcoffee.com/uploads/pictures/fownxn.gif
dutchcoder.nl/include/pictures/eqawtb.jpg
dw-css.de/data/image/qzwb.gif
ecpmedia.vn/data/tmp/aowqgmosyn.jpg
edgewoodestates.org/content/temp/vvpjywsjxq.jpg
entopic.com/static/assets/ftkvrj.png
erstatningsadvokaterne.dk/news/game/raxdjoznkc.jpg
euro-trend.pl/include/pics/iz.gif
evangelische-pfarrgemeinde-tuniberg.de/news/graphic/ptsrysfz.gif
evologic-technologies.com/wp-content/pictures/xhdqbnzp.gif
exenberger.at/admin/pictures/codnjkrswqoqjpfrfa.jpg
exenberger.at/admin/pictures/codnjkrswqoqjpfrfa.jpg
faizanullah.com/wp-content/pictures/idvvvf.jpg
falcou.fr/admin/image/obnxxa.gif
fannmedias.com/admin/images/ecbfkc.jpg
farhaani.com/wp-content/pictures/iyss.png
fibrofolliculoma.info/static/tmp/mu.gif
figura.team/admin/pics/pfhvcppq.gif
financescorecard.com/include/pictures/sqlaooyifoxntnvm.png
fizzl.ru/data/graphic/iuhnop.png
foretprivee.ca/admin/temp/eysbkp.png
fotoscondron.com/include/graphic/kunmqm.jpg
fransespiegels.nl/include/images/qhknqjdmjvcp.png
ftf.or.at/data/game/lauj.png
ftlc.es/static/pics/upwchnjp.gif
funjose.org.gt/admin/graphic/mwijrxosrvanmd.png
galleryartfair.com/include/temp/tinhsgjpqccd.png
gasolspecialisten.se/uploads/game/hndmhhfhvgqi.jpg
gemeentehetkompas.nl/include/graphic/tdmhjpnvixdv.jpg
geoffreymeuli.com/uploads/game/ghugvdbt.jpg
gonzalezfornes.es/news/image/hvcxaltq.jpg
gopackapp.com/news/assets/pqyjdjqzqa.jpg
greenfieldoptimaldentalcare.com/news/pics/ympbqzyt.gif
grelot-home.com/wp-content/tmp/iqbw.gif
hannah-fink.de/static/image/hrziwuuwojtlew.png
hatech.io/include/temp/tqbe.gif
helikoptervluchtnewyork.nl/static/pictures/spmn.gif
hellohope.com/static/game/cpjcgw.jpg
henricekupper.com/static/pictures/oynrubvahoptvr.gif
herbayupro.com/news/graphic/ytthsl.jpg
hexcreatives.co/static/graphic/qtchyesr.png
hmsdanmark.dk/wp-content/pics/xb.jpg
humancondition.com/uploads/pictures/qrbc.gif
ilcdover.com/data/images/cgsviu.png
imadarchid.com/uploads/tmp/odsg.gif
ino-professional.ru/content/assets/avoxrx.gif
insigniapmg.com/data/pictures/kf.png
insp.bi/uploads/graphic/az.jpg
intecwi.com/admin/pictures/txzuzcqj.gif
itelagen.com/data/pictures/pplr.gif
iwelt.de/static/pics/he.png
iwelt.de/wp-content/tmp/yrzw.gif
jameskibbie.com/wp-content/graphic/djeg.jpg
jiloc.com/news/tmp/xdwd.jpg
johnsonfamilyfarmblog.wordpress.com/data/temp/pggmixeqmp.gif
jvanvlietdichter.nl/wp-content/tmp/kphbex.jpg
kamahouse.net/data/game/hyacuscidk.jpg
kampotpepper.gives/wp-content/pictures/awncjtwctqkl.png
kao.at/include/pictures/zaubtpcj.jpg
kaotikkustomz.com/content/images/xd.gif
kidbucketlist.com.au/news/graphic/ks.jpg
kirkepartner.dk/uploads/graphic/wwqcqtbr.gif
kisplanning.com.au/wp-content/assets/kstfzfqg.jpg
knowledgemuseumbd.com/wp-content/assets/iqtdkpgs.jpg
koko-nora.dk/include/graphic/nukkmilo.gif
kuntokeskusrok.fi/uploads/image/utktbiondmxwtyez.jpg
kunze-immobilien.de/content/image/asjvvynhbooachekol.gif
ladelirante.fr/static/temp/xcgybe.jpg
latestmodsapks.com/wp-content/images/bfrjue.gif
layrshift.eu/uploads/pictures/hhhazfdc.jpg
lbcframingelectrical.com/data/images/wcudamjj.jpg
leather-factory.co.jp/wp-content/pics/hztedb.jpg
levdittliv.se/blogg/ursula/ett-litet-livstecken-och-sondagsbestyr/
levdittliv.se/wp-content/game/bkks.gif
limassoldriving.com/include/graphic/poejihstemym.png
live-your-life.jp/static/game/naqdlv.png
lubetkinmediacompanies.com/include/pictures/ym.gif
lusak.at/news/graphic/flolbbbleaiz.gif
mank.de/include/pictures/fqsy.jpg
mapawood.com/news/tmp/vq.jpg
marathonerpaolo.com/data/pictures/nljxwtgnwd.gif
marcuswhitten.site/data/tmp/bbba.gif
mardenherefordshire-pc.gov.uk/news/tmp/bwbl.gif
mdk-mediadesign.de/static/game/uckvvb.gif
mediaacademy-iraq.org/include/assets/ssrxtb.jpg
mepavex.nl/news/temp/kurecajjfu.jpg
micahkoleoso.de/wp-content/pics/ne.png
milltimber.aberdeen.sch.uk/data/images/cmbgwt.gif
mirjamholleman.nl/admin/tmp/yrqrqvzisjfm.jpg
mirjamholleman.nl/content/graphic/ec.jpg
mirkoreisser.de/wp-content/graphic/hqbcmj.jpg
mmgdouai.fr/content/tmp/ongsdzlnmb.png
modestmanagement.com/data/temp/ycjeafikygzx.jpg
monark.com/uploads/graphic/zivorvzo.jpg
morawe-krueger.de/wp-content/pictures/zmme.gif
mountaintoptinyhomes.com/wp-content/image/oxaf.png
mousepad-direkt.de/wp-content/image/cbrz.gif
mylolis.com/include/tmp/ymkppbiacysl.jpg
nacktfalter.de/wp-content/assets/oifa.png
naturavetal.hr/wp-content/tmp/zpfhhmro.png
naturavetal.hr/wp-content/tmp/zpfhhmro.png/
ncid.bc.ca/wp-content/graphic/ufftbr.gif
noixdecocom.fr/include/pictures/fjjcrg.jpg
norovirus-ratgeber.de/admin/images/yhguqd.jpg
notsilentmd.org/uploads/pictures/xtloos.png
nuzech.com/wp-content/graphic/ja.jpg
odiclinic.org/news/temp/bl.png
oneheartwarriors.at/uploads/temp/bhuusf.jpg
oneplusresource.org/news/images/bhtbzw.gif
ostheimer.at/admin/graphic/cdstvysv.jpg
parebrise-tla.fr/wp-content/pics/mrin.jpg
pawsuppetlovers.com/wp-content/assets/yfinbsmr.png
people-biz.com/uploads/pictures/foszqw.jpg
peterstrobos.com/news/tmp/sxspoh.png
physiofischer.de/news/tmp/esag.png
pierrehale.com/include/image/uoarjftduzwr.png
planchaavapor.net/news/graphic/yqml.jpg
plotlinecreative.com/news/assets/puimdl.jpg
pogypneu.sk/content/tmp/tbny.jpg
polymedia.dk/data/graphic/xcdntb.jpg
projetlyonturin.fr/include/pics/rvsuzbfz.png
promalaga.es/admin/temp/mzeuxd.gif
purposeadvisorsolutions.com/news/tmp/xwvdne.jpg
qlog.de/content/tmp/mhdnefoq.png
qualitus.com/include/temp/tgnjksyubpjb.gif
ralister.co.uk/uploads/temp/dlknkr.png
refluxreducer.com/content/pictures/cxccxf.jpg
remcakram.com/include/images/roushtjuaf.gif
rerekatu.com/data/game/irhvcgafnt.png
restaurantesszimmer.de/data/images/gckqniey.gif
rosavalamedahr.com/wp-content/images/oshfqymkng.png
samnewbyjax.com/content/graphic/oacplhjp.jpg
sanaia.com/data/tmp/fotxqjei.gif
schmalhorst.de/content/image/ddjwjity.png
seagatesthreecharters.com/news/temp/ssoqpadh.gif
shhealthlaw.com/static/pics/zypxvxyvrr.jpg
shiresresidential.com/news/tmp/ssotiwhhkrghpxza.gif
simpliza.com/data/pics/kkaptg.gif
sinal.org/include/pics/xdta.png
smhydro.com.pl/uploads/assets/wtev.gif
sofavietxinh.com/wp-content/pictures/bpknfp.jpg
softsproductkey.com/static/pics/biciruogxn.png
songunceliptv.com/data/pictures/zsmdvfns.jpg
sotsioloogia.ee/include/temp/mspfhmitzxcw.gif
spargel-kochen.de/data/game/fmjtqk.jpg
spd-ehningen.de/wp-content/tmp/uwojatiokw.jpg
spinheal.ru/include/graphic/im.png
sportiomsportfondsen.nl/wp-content/pictures/qbul.png
spsshomeworkhelp.com/news/pictures/rd.gif
spylista.com/admin/tmp/yb.png
stacyloeb.com/news/game/wcmlfzatye.gif
stallbyggen.se/data/game/zcxflz.png
steampluscarpetandfloors.com/data/pictures/kprv.jpg
stemenstilte.nl/news/graphic/duqyglowplyl.jpg
sterlingessay.com/wp-content/game/cvrxkg.png
strandcampingdoonbeg.com/static/images/ntompepufh.png
takeflat.com/admin/pictures/tsyg.jpg
team-montage.dk/content/graphic/ysvhmkqr.png
tennisclubetten.nl/admin/pictures/zs.gif
teresianmedia.org/static/image/vhfc.jpg
testcoreprohealthuk.com/static/pictures/slbrib.gif
thaysa.com/static/pics/exlxmmrtfh.gif
theadventureedge.com/uploads/game/qhmqytvz.jpg
thedresserie.com/include/image/wj.jpg
theletter.company/news/images/heviuo.jpg
tophumanservicescourses.com/wp-content/assets/vycpgcyzrfnx.jpg
tradiematepro.com.au/uploads/pics/mjsvqv.jpg
trapiantofue.it/data/assets/ntvy.png
triactis.com/uploads/image/ayysdqhw.gif
uimaan.fi/news/tmp/vzcphfla.jpg
unetica.fr/admin/graphic/jjthdbppehrikoci.jpg
unim.su/wp-content/pictures/cxow.gif
upmrkt.co/admin/game/fvzt.jpg
vannesteconstruct.be/content/graphic/aggrey.png
vdberg-autoimport.nl/wp-content/game/uliiohjxap.gif
vetapharma.fr/static/assets/hagmbt.png
victoriousfestival.co.uk/wp-content/pics/vszziakshyqn.gif
vox-surveys.com/content/assets/tbgrycsg.png
waermetauscher-berechnen.de/include/graphic/vwvvzh.gif
withahmed.com/admin/game/squhbrgy.jpg
work2live.de/data/tmp/dtjx.gif
worldhealthbasicinfo.com/uploads/pics/dolfjbdg.gif
wraithco.com/static/images/ao.png
x-ray.ca/static/tmp/topoznxero.jpg
xltyu.com/news/assets/qr.jpg
xn--rumung-bua.online/admin/pictures/nfxuqi.gif
xtptrack.com/data/assets/esqftccgzqts.png
yamalevents.com/data/image/kxuk.png
ymca-cw.org.uk/static/tmp/wpud.jpg
zflas.com/news/graphic/pgdkatftog.jpg
zweerscreatives.nl/news/images/wggjcoztzi.jpg

# Reference: https://twitter.com/petrovic082/status/1361329514006130688
# Reference: https://app.any.run/tasks/9a9a7109-8497-4e1e-b3d7-b9ab0871ea9e/

bxdf.info
wien-mitte.co.at

# Reference: https://www.virustotal.com/gui/ip-address/47.254.157.47/relations
# Reference: https://www.virustotal.com/gui/file/ba866f0adc77a7c8a6b43e850c4ef2f41ddf4fe3f28d8e2f75725b81e49d2f28/detection

ct-ov.com
pub4-av.com
pub5-ne.com
v-chek.in
vt-ne.com

# Reference: https://www.virustotal.com/gui/file/b597a7c849b4693db2176beead29994589820b761865e715b8550365b77db6e0/detection

163.44.193.202:2031

# Reference: https://app.any.run/tasks/3d31648e-4b70-4fd7-983d-c7c974b61f69/

142.93.226.233:2031
149.28.63.121:2031
162.212.157.109:2031
185.95.0.202:2031
207.180.244.46:2031
23.227.163.206:2031
46.4.135.209:2031
59.103.72.44:2031
89.40.115.248:2031
94.182.110.253:2031

# Reference: https://www.virustotal.com/gui/file/06bb23abb39548a40803904e4b31813f1266bec70a1334cd8d31dafdab06331d/detection

hotbooks.tech
vsblobprodscussu5shard44.blob.core.windows.net
