← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
AWS.DEV | Ransom REevil | MaaS -Mirai , Makop , Sodinokibi | 6.13.25 Appears ti be ongoing
WHITE Q.Vashti 2026-05-13 Modified: 2026-05-13
516
IOCs
HIGH VOLUME
filehashmd5filehashsha1showingcopyrightlevelbluepacker entropype featurespe unknownresource nameallocates rwxnetwork icmpantivm networkexe nolookupproxy wpaddead hosttoolsgenericdeletes selfransomevaderactivelearnck idname tacticssuspiciousinformativeinstallsadversarieswindowsmodulesregistrypersistenceexecutionserviceunitedpathflagdateaccess typegermany germanycreatehttp headertcp trafficet infoentropyhybridmaliciousgeneralclickstringsinjectremoteencrypt filespythonglobalwin32 exepe32intelms windowswin32 dynamiclink librarywin16 neicons libraryos2 executablepe32 compileroverlaydatape32 executableborland delphidelphi genericmd5 codeempty hashfile typesuccessregopenkeyexwregopenkeyexahkeycurrentuservirtualallocexcreatefilewgenericreadhkeyclassesrootgenericwriteregsetvalueexwdesktopwebviewmirairusssian datareevilmoney docgmt flagserverunited kingdomfrance franceukraine ukrainellc nameviet namshowcvebad trafficfalseerrortagsipv4url httpsurl httpsearchtype indicatorrole titleadded activerelated pulsesentriesmonitortargetmembersmaasattackmitre att
MITRE ATT&CK & Malware Families
ATT&CK TECHNIQUES
MALWARE FAMILIES
Ransom:Win32/Makop.PA!MTB Trojan/Win32.BlueCrab.R331768 Trojan.Ransom.Sodinokibi Emotet Virus.Neshta Mirai RANSOM_REvil Labeled as: Ransom.Sodinokibi.Generic
Indicators of Compromise (83 / 516 total)
All FileHash-MD5 FileHash-SHA1 FileHash-SHA256 URL CVE domain hostname
TYPEINDICATORDESCRIPTIONCREATED
URL http://kassadainteriors.co.uk/ — 2026-05-13
URL http://rbktg.com/ — 2026-05-13
URL http://4lowin.com/ — 2026-05-13
URL http://airsonett.se/ — 2026-05-13
URL http://arte57.com.br/images/xs.jpg?5b804=1499152 — 2026-05-13
URL http://assistlasvegas.com/ — 2026-05-13
URL http://cafe-mariya.kz/ — 2026-05-13
URL http://createachange.co.uk/wp/wp-admin — 2026-05-13
URL http://createachange.co.uk/wp/wp-admin/css/css/index.php — 2026-05-13
URL http://dolcevita.kh.ua/ — 2026-05-13
URL http://dolcevita.kh.ua/js/paclm — 2026-05-13
URL http://dolcevita.kh.ua/js/paclm/ — 2026-05-13
URL http://ds.nordicgames.at/ig2/ — 2026-05-13
URL http://fisioterapiakaizen.com/ — 2026-05-13
URL http://florianfeuerwehrmann.com/ — 2026-05-13
URL http://formedlia.se/wp-admin — 2026-05-13
URL http://forward.com.ua — 2026-05-13
URL http://frequency.fr/upload/productions/ — 2026-05-13
URL http://furuspesialisten.com/fill/dropbox/db/ff/proposal/LoginVerification.php — 2026-05-13
URL http://go2l.ink/1CiT/ — 2026-05-13
URL http://hobbysamlaren.se/Samlar_welcome.html — 2026-05-13
URL http://hwfsweden.se/images/http/message/wetransfer/Wetransfer/index.php — 2026-05-13
URL http://kyledata.de/ — 2026-05-13
URL http://kyledata.de/impressum.html — 2026-05-13
URL http://labelleflowers.co.uk/09u8h76f/65fg67n — 2026-05-13
URL http://lesfleursdugolfe.fr/category/non-classe/page/2 — 2026-05-13
URL http://lesfleursdugolfe.fr/information-fiction-as-well-as-business-2 — 2026-05-13
URL http://littlemarquis.be/ — 2026-05-13
URL http://menuiseriepichon.fr/index.php/nouveautes — 2026-05-13
URL http://mlab.org.ua/files/bin/ — 2026-05-13
URL http://nybingosajt.se/category/expekt-bingo — 2026-05-13
URL http://qlcalendar.com/messg.jpg — 2026-05-13
URL http://restorangnezdo.ru/ — 2026-05-13
URL http://rissafety.com/ — 2026-05-13
URL http://ruudhofstee.nl/ — 2026-05-13
URL http://s48.as/ — 2026-05-13
URL http://simplecleanbeauty.com/k9y/ — 2026-05-13
URL http://slankenett.no/paypal-45234523445 — 2026-05-13
URL http://storyline.no/logs — 2026-05-13
URL http://thekingsway.org/002031lrsqerx/payment/business — 2026-05-13
URL http://thekingsway.org/WD 9556446767edaaf43ab88426f381546b0b5928a910f05adefdd82a2833bf2933 2026-05-13
URL http://thekingsway.org/invoices — 2026-05-13
URL http://thekingsway.org/sep2018/en/invoices-attached — 2026-05-13
URL http://wgsoft.de/download/obd-ii-eobd-software/14-scanmaster-for-mobydic/file — 2026-05-13
URL http://www.filmaka.us/ — 2026-05-13
URL http://www.frequency.fr/upload/productions/ 0f774764181a1d850141bf64393228b7acdb6261844f0165a78839f549d7bcce 2026-05-13
URL http://www.hwfsweden.se/images/http/message/wetransfer/Wetransfer/index.php 4a405f004ce6af925ac9c862b168e0c97d9c927aa0e42fa2d6c653272508647a 2026-05-13
URL http://www.mlab.org.ua/forum/download/file.php?id=33521 — 2026-05-13
URL http://www.praktikum-china.de/components/com_zoom/language/index1.html — 2026-05-13
URL https://createachange.co.uk/wp/wp-admin — 2026-05-13
URL https://latortueblanche.com/dev/wp-content/wells/ — 2026-05-13
URL https://www.filmaka.us/ — 2026-05-13
URL http://8.8.8.8:53 — 2026-05-13
URL http://steamlcommunity.ru.com/ — 2026-05-13
URL http://steamlcommunity.ru.com/profiles/76561198986808505 — 2026-05-13
URL https://nic.at/registrar/168 — 2026-05-13
URL https://steamlcommunity.ru.com/ — 2026-05-13
URL https://steamlcommunity.ru.com/profiles/76561198986808505/ — 2026-05-13
URL http://www.dirtsearch.org — 2026-05-13
URL https://www.dirtsearch.org — 2026-05-13
URL http://250amembers.dirtsearch.org — 2026-05-13
URL http://252fwww.dirtsearch.org — 2026-05-13
URL http://dashboard.dirtsearch.org — 2026-05-13
URL http://dirtsearch.org/ — 2026-05-13
URL http://ds1.dirtsearch.org — 2026-05-13
URL http://free.dirtytoes.com/ — 2026-05-13
URL http://members.dirtsearch.org — 2026-05-13
URL http://members.dirtsearch.org/customer/login?path=/customer/ — 2026-05-13
URL http://www.dirtsearch.org/ — 2026-05-13
URL http://www.dirtsearch.org/dirt-search/faq — 2026-05-13
URL https://250amembers.dirtsearch.org — 2026-05-13
URL https://252fwww.dirtsearch.org — 2026-05-13
URL https://dashboard.dirtsearch.org — 2026-05-13
URL https://dashboard.dirtsearch.org/dash.php — 2026-05-13
URL https://ds1.dirtsearch.org — 2026-05-13
URL https://members.dirtsearch.org — 2026-05-13
URL https://www.dirtsearch.org/data/ — 2026-05-13
URL https://www.dirtsearch.org/data/%20TSARA/BRASHEARS/Colorado/ — 2026-05-13
URL https://www.dirtsearch.org/data/TSARA/BRASHEARS/ — 2026-05-13
URL https://www.dirtsearch.org/dirt-search/broken-site/ — 2026-05-13
URL https://www.dirtsearch.org/news/ — 2026-05-13
URL https://www.dirtsearch.org/pub/44524557484f4c4c414e444d69737369737369707069.html — 2026-05-13
URL https://www.dirtsearch.org/pub/524f4245525442454c43484552466c6f72696461.html — 2026-05-13
References (9)
↗ RANSOM_REvil - https://www.nextron-systems.com/notes-on-virustotal-matches/ ↗ YARA: Matches rule MAL_RANSOM_REvil_Oct20_1 from ruleset crime_ransom_revil by Florian Roth (Nextron Systems) ↗ YARA: Matches rule Windows_Ransomware_Sodinokibi_83f05fbe from ruleset Windows_Ransomware_Sodinokibi by Elastic Security ↗ YARA: Matches rule win_revil_auto from ruleset win.revil_auto by Felix Bilstein - yara-signator at cocacoding dot com ↗ https://otx.alienvault.com/malware/Ransom:Win32/Makop/ ↗ https://www.hybrid-analysis.com/sample/cb33f3d60a715436ab49ab7968c5a31410d0cd6b9d141b41b2362c02b59e2913/5e68effaec3f2e3f0c5237b8 ↗ https://www.hybrid-analysis.com/sample/cb33f3d60a715436ab49ab7968c5a31410d0cd6b9d141b41b2362c02b59e2913/5e68effaec3f2e3f0c5237b8 ↗ Permissions requested: SE_DEBUG_PRIVILEGE SE_LOAD_DRIVER_PRIVILEGE ↗ Behaviour: Extract file to system directory