General
-
Target
13d4c1451da6fa284c08c669a7d0e7c1_JaffaCakes118
-
Size
164KB
-
Sample
240504-wgvepadc9w
-
MD5
13d4c1451da6fa284c08c669a7d0e7c1
-
SHA1
2ea65287c7489d8ab5abd04e172c55d1518a4052
-
SHA256
df724c49a1401d66f690b0a940f70bd286671448a625690ccdfdc4c42b4b5b07
-
SHA512
f845335dd84b5bf9b20889dfd051bf012dfcf96adaf4f6de171b3a8e62f42cf03c0e18314ad6ca59ff3eb5e1c0ef3dce179845aac6582b9438c0b13809f47554
-
SSDEEP
3072:ffYWjswg4fQlt4ndm8jX5IXzs+M9VQHDO9KR/vOst3b:ffYWAw9fcUdmwIXo+M9VQHDxmst
Behavioral task
behavioral1
Sample
13d4c1451da6fa284c08c669a7d0e7c1_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
13d4c1451da6fa284c08c669a7d0e7c1_JaffaCakes118.exe
Resource
win10v2004-20240426-en
Malware Config
Extracted
sodinokibi
6
1402
vvego.com
catering.com
animalfood-online.de
mazzaropi.com.br
agenceassemble.fr
anchelor.com
duthler.nl
druktemakersheerenveen.nl
smartercashsystem.com
slotenmakerszwijndrecht.nl
ijsselbeton.nl
azloans.com
makingmillionaires.net
hnkns.com
elliemaccreative.wordpress.com
forskolinslimeffect.net
precisetemp.com
mazift.dk
selected-minds.de
agora-collectivites.com
lidkopingsnytt.nu
pourlabretagne.bzh
nauticmarine.dk
gardenpartner.pl
goddardleadership.org
airvapourbarrier.com
dantreranch.com
matthieupetel.fr
solidhosting.nl
texanscan.org
gatlinburgcottage.com
g2mediainc.com
centuryvisionglobal.com
amorbellezaysalud.com
rs-danmark.dk
thestudio.academy
teethinadaydentalimplants.com
catalyseurdetransformation.com
placermonticello.com
diverfiestas.com.es
artcase.pl
jeanmonti.com
biketruck.de
tothebackofthemoon.com
nbva.co.uk
mediabolmong.com
bluemarinefoundation.com
90nguyentuan.com
nrgvalue.com
optigas.com
adabible.org
pankiss.ru
billigeflybilletter.dk
ziliak.com
charlottelhanna.com
ayudaespiritualtamara.com
lexced.com
altitudeboise.com
poems-for-the-soul.ch
fla.se
vipcarrental.ae
indiebizadvocates.org
techybash.com
global-migrate.com
neolaiamedispa.com
nepal-pictures.com
finsahome.co.uk
craftingalegacy.com
signededenroth.dk
heimdalbygg.no
kdbrh.com
gosouldeep.com
colored-shelves.com
endlessrealms.net
theintellect.edu.pk
zuerich-umzug.ch
chatberlin.de
mustangmarketinggroup.com
hutchstyle.co.uk
rivermusic.nl
efficiencyconsulting.es
schlagbohrmaschinetests.com
k-zubki.ru
geitoniatonaggelon.gr
artvark.nl
marmarabasin.com
myfbateam.com
perceptdecor.com
crestgood.com
edrickennedymacfoy.com
billyoart.com
forextimes.ru
geoweb.software
bakingismyyoga.com
gazelle-du-web.com
nicksrock.com
malevannye.ru
veggienessa.com
ninjaki.com
projektparkiet.pl
ya-elka.ru
jmmartinezilustrador.com
naukaip.ru
antesacademy.it
astrographic.com
breathebettertolivebetter.com
voetbalhoogeveen.nl
angelsmirrorus.com
kamin-somnium.de
pvandambv.nl
photographycreativity.co.uk
iactechnologies.net
fbmagazine.ru
eurethicsport.eu
kartuindonesia.com
radishallgood.com
go.labibini.ch
brunoimmobilier.com
theboardroomafrica.com
grancanariaregional.com
stabilisateur.fr
tilldeeke.de
lesyeuxbleus.net
mrcar.nl
floweringsun.org
uncensoredhentaigif.com
5thactors.com
georgemuncey.com
greeneyetattoo.com
supercarhire.co.uk
muller.nl
uci-france.fr
hekecrm.com
dreamvoiceclub.org
alattekniksipil.com
mangimirossana.it
littlesaints.academy
leloupblanc.gr
epsondriversforwindows.com
holocine.de
brannbornfastigheter.se
towelroot.co
barbaramcfadyenjewelry.com
factoriareloj.com
janmorgenstern.com
triplettabordeaux.fr
the5thquestion.com
tbalp.co.uk
dennisverschuur.com
marcandy.com
axisoflove.org:443
yayasanprimaunggul.org
oro.ae
penumbuhrambutkeiskei.com
bluelakevision.com
palema.gr
blucamp.com
brinkdoepke.eu
turing.academy
karelinjames.com
humanviruses.org
signamedia.de
expohomes.com
julielusktherapy.com
lovcase.com
keuken-prijs.nl
stringnosis.academy
business-basic.de
domaine-des-pothiers.com
louiedager.com
nepressurecleaning.com
yvesdoin-aquarelles.fr
jakubrybak.com
pinthelook.com
drnelsonpediatrics.com
jag.me
awag-blog.de
futurenetworking.com
nginx.com
riffenmattgarage.ch
iron-mine.ru
framemyballs.com
patassociation.com
affligemsehondenschool.be
dogsunlimitedguide.com
harleystreetspineclinic.com
vapiano.fr
laylavalentine.com
testitjavertailut.net
pajagus.fr
eatyoveges.com
condormobile.fr
circuit-diagramz.com
onlinetvgroup.com
malzomattalar.com
imaginekithomes.co.nz
mjk.digital
ludoil.it
metroton.ru
vitoriaecoturismo.com.br
dinecorp.com
ddmgen.com
denverwynkoopdentist.com
hotjapaneselesbian.com
bjornvanvulpen.nl
christianscholz.de
globalskills.pt
delegationhub.com
smartmind.net
eksperdanismanlik.com
diakonie-weitramsdorf-sesslach.de
boyfriendsgoal.site
ronielyn.com
distrifresh.com
zumrutkuyutemel.com
luvbec.com
ox-home.com
saint-malo-developpement.fr
bohrlochversicherung.info
look.academy
slideevents.be
bulyginnikitav.000webhostapp.com
krishnabrawijaya.com
galatee-couture.com
denhaagfoodie.nl
pureelements.nl
angeleyezstripclub.com
fskhjalmar.se
atelierkomon.com
eyedoctordallas.com
jimprattmediations.com
mondolandscapes.com
datatri.be
janellrardon.com
direitapernambuco.com
patriotcleaning.net
walterman.es
lovetzuchia.com
asiaartgallery.jp
girlish.ae
rishigangoly.com
rolleepollee.com
yourcosmicbeing.com
bumbipdeco.site
hartofurniture.com
creohn.de
factorywizuk.com
lapponiasafaris.com
wrinstitute.org
lmmont.sk
motocrossplace.co.uk
wirmuessenreden.com
energosbit-rp.ru
xn--billigafrgpatroner-stb.se
topvijesti.net
kookooo.com
ownidentity.com
acumenconsultingcompany.com
skyboundnutrition.co.uk
cincinnatiphotocompany.org
alene.co
claudiakilian.de
carsten.sparen-it.de
descargandoprogramas.com
imajyuku-sozoku.com
victorvictoria.com
cssp-mediation.org
rtc24.com
richardkershawwines.co.za
innovationgames-brabant.nl
raeoflightmusic.com
arearugcleaningnyc.com
webforsites.com
hostaletdelsindians.es
proffteplo.com
jayfurnitureco.com
soncini.ch
shortysspices.com
invela.dk
magrinya.net
thehovecounsellingpractice.co.uk
mneti.ru
sellthewrightway.com
furland.ru
epicjapanart.com
skolaprome.eu
graygreenbiomedservices.com
tutvracks.com
mayprogulka.ru
die-immo-agentur.de
jlgraphisme.fr
citiscapes-art.com
johnsonweekly.com
chris-anne.com
cesep2019.com
pinkxgayvideoawards.com
plbinsurance.com
theatre-embellie.fr
rizplakatjaya.com
silverbird.dk
elex.is
triavlete.com
quitescorting.com
cc-experts.de
bendel-partner.de
justaroundthecornerpetsit.com
o2o-academy.com
cxcompany.com
zaczytana.com
traitware.com
rokthetalk.com
mindfuelers.com
professionetata.com
kerstliedjeszingen.nl
jobscore.com
triplettagaite.fr
linearete.com
piestar.com
glas-kuck.de
awaisghauri.com
agrifarm.dk
richardmaybury.co.uk
fridakids.com
abulanov.com
afbudsrejserallinclusive.dk
dentalcircle.com
carmel-york.com
ykobbqchicken.ca
aceroprime.com
stralsund-ansichten.de
cops4causes.org
mac-computer-support-hamburg.de
springfieldplumbermo.com
happycatering.de
leijstrom.com
nutriwell.com.sg
kausette.com
jdscenter.com
jonnyhooley.com
dr-vita.de
frimec-international.es
wallflowersandrakes.com
mamajenedesigns.com
verbouwingsdouche.nl
wasnederland.nl
baikalflot.ru
rhino-turf.com
the-cupboard.co.uk
akcadagofis.com
mike.matthies.de
berdonllp.com
larchwoodmarketing.com
speakaudible.com
sololibrerie.it
onesynergyinternational.com
ravage-webzine.nl
studionumerik.fr
fluzfluzrewards.com
parksideseniorliving.net
dayenne-styling.nl
letsstopsmoking.co.uk
alltagsrassismus-entknoten.de
martinipstudios.com
fanuli.com.au
rozmata.com
pansionatblago.ru
bluetenreich-brilon.de
test-teleachat.fr
vedsegaard.dk
innersurrection.com
brownswoodblog.com
theater-lueneburg.de
avtoboss163.ru:443
campusescalade.com
redctei.co
xtensifi.com
alharsunindo.com
banukumbak.com
schluesseldienste-hannover.de
spacebel.be
atrgroup.it
parentsandkids.com
leansupremegarcinia.net
acibademmobil.com.tr
glennverschueren.be
groovedealers.ru
itheroes.dk
volta.plus
luvinsburger.fr
schulz-moelln.de
annenymus.com
alwaysdc.com
t3brothers.com
craftstone.co.nz
ronaldhendriks.nl
chatterchatterchatter.com
oexebusiness.com
loparnille.se
citydogslife.com
burg-zelem.de
agendatwentytwenty.com
sochi-okna23.ru
gurutechnologies.net
chorusconsulting.net
licensed-public-adjuster.com
biodentify.ai
ntinasfiloxenia.gr
cmascd.com
mercadodelrio.com
edvestors.org
kryddersnapsen.dk
encounter-p.net
grafikstudio-visuell.de
ruggestar.ch
unislaw-narty.pl
glende-pflanzenparadies.de
powershell.su
web865.com
physio-lang.de
ideamode.com
spirello.nl
guohedd.com
fixx-repair.com
bajova.sk
saboboxtel.uk
casinodepositors.com
livelai.com
leadforensics.com
nvisionsigns.com
trivselsguide.dk
metallbau-hartmann.eu
cp-bap.de
miscbo.it
koncept-m.ru
kellengatton.com
fazagostar.co
jacquesgarcianoto.com
devus.de
buffdaddyblog.com
endstarvation.com
achetrabalhos.com
molade.nl
chainofhopeeurope.eu
liveyourheartout.co
peninggibadan.co.id
tages-geldvergleich.de
dnqa.co.uk
scotlandsroute66.co.uk
mieleshopping.it
levelseven.be
internalresults.com
soundseeing.net
mariannelemenestrel.com
outstandingminialbums.com
randyabrown.com
hvitfeldt.dk
2020hindsight.info
witraz.pl
oththukaruva.com
keyboardjournal.com
tetameble.pl
babysitting-hk.helpergo.co
happylublog.wordpress.com
lashandbrowenvy.com
alabamaroofingllc.com
kelsigordon.com
altocontatto.net
landgoedspica.nl
electricianul.com
rarefoods.ro
otpusk.zp.ua
medicalsupportco.com
alpesiberie.com
craftron.com
explora.nl
boomerslivinglively.com
reygroup.pt
kemtron.fr
tweedekansenloket.nl
rubyaudiology.com
palmecophilippines.com
deduktia.fi
11.in.ua
blavait.fr
phoenixcrane.com
sber-biznes.com
pisofare.co
imagine-entertainment.com
clemenfoto.dk
entdoctor-durban.com
rentsportsequip.com
greatofficespaces.net
cormanmarketing.com
kroophold-sjaelland.dk
schroederschoembs.com
jollity.hu
innervisions-id.com
gavelmasters.com
christopherhannan.com
min-virksomhed.dk
parisschool.ru
vitormmcosta.com
autoteamlast.de
nexstagefinancial.com
charlesfrancis.photos
bruut.online
therapybusinessacademy.com
advancedeyecare.com
photonag.com
o90.dk
eventosvirtualesexitosos.com
hawaiisteelbuilding.com
zdrowieszczecin.pl
rino-gmbh.com
askstaffing.com
chinowarehousespace.com
johnkoen.com
aciscomputers.com
thepixelfairy.com
rapid5kloan.org
letterscan.de
galaniuklaw.com
lagschools.ng
apogeeconseils.fr
site.markkit.com.br
pokemonturkiye.com
perfectgrin.com
suitesartemis.gr
blueridgeheritage.com
qandmmusiccenter.com
heuvelland-oaze.nl
campinglaforetdetesse.com
kvetymichalovce.sk
cuadc.org
3daywebs.com
yourhappyevents.fr
hospitalitytrainingsolutions.co.uk
eafx.pro
palmenhaus-erfurt.de
cleanroomequipment.ie
rvside.com
secrets-clubs.co.uk
sprintcoach.com
andermattswisswatches.ch
latteswithleslie.com
hotelturbo.de
lollachiro.com
curtsdiscountguns.com
drbenveniste.com
cap29010.it
pedmanson.com
lyricalduniya.com
airserviceunlimited.com
elitkeramika-shop.com.ua
apiarista.de
laaisterplakky.nl
tzn.nu
cookinn.nl
sycamoregreenapts.com
mediogiro.com.ar
johnstonmingmanning.com
customroasts.com
bg.szczecin.pl
jax-interim-and-projectmanagement.com
collegetennis.info
tramadolhealth.com
ebible.co
cyberpromote.de
noda.com.ua
tesisatonarim.com
kenmccallum.com
jobstomoveamerica.org
animation-pro.co.uk
catchup-mag.com
sealgrinderpt.com
pxsrl.it
avis.mantova.it
santastoy.store
biblica.com
alaskaremote.com
activeterroristwarningcompany.com
jobkiwi.com.ng
gaearoyals.com
welovecustomers.fr
bagaholics.in
thiagoperez.com
michaelfiegel.com
zinnystar.com
broccolisoep.nl
liepertgrafikweb.at
mensemetgesigte.co.za
logosindustries.com
advanced-removals.co.uk
clinic-beethovenstrasse-ag.ch
masecologicos.com
klapanvent.ru
docarefoundation.org
n-newmedia.de
aoyama.ac
muni.pe
karmeliterviertel.com
primemarineengineering.com
lumturo.academy
chomiksy.net
bubbalucious.com
polynine.com
utilisacteur.fr
memphishealthandwellness.com
fotoeditores.com
redpebblephotography.com
drvoip.com
hypogenforensic.com
metcalfe.ca
initconf.com
terraflair.de
bundan.com
sarahspics.co.uk
profiz.com
fsbforsale.com
nevadaruralhousingstudies.org
hostingbangladesh.net
goodboyscustom.com
reizenmetkinderen.be
stoneridgemontessori.com
log-barn.co.uk
subyard.com
iexpert99.com
worldproskitour.com
banksrl.co.za
ikzoekgod.be
slotspinner.com
xn--80addfr4ahr.dp.ua
bcabattoirs.org
cascinarosa33.it
sppdstats.com
ultimatelifesource.com
fta-media.com
interlinkone.com
xn--ziinoapte-6ld.ro
lunoluno.com
acb-gruppe.ch
oscommunity.de
so-sage.fr
four-ways.com
amco.net.au
alnectus.com
mbuildinghomes.com
the-beauty-guides.com
stagefxinc.com
liverpoolabudhabi.ae
mahikuchen.com
nxtstg.org
grupoexin10.com
katherinealy.com
comoserescritor.com
startuplive.org
baita.ac
stressreliefadvice.com
shrinkingplanet.com
sharonalbrightdds.com
bodet150ans.com
ceocenters.com
kafkacare.com
davedavisphotos.com
sytzedevries.com
frameshift.it
prometeyagro.com.ua
mariamalmahdi.com
skoczynski.eu
kryptos72.com
the3-week-diet.net
arazi.eus
frankgoll.com
almamidwifery.com
richardiv.com
hom-frisor.dk
beauty-traveller.com
janasfokus.com
greenrider.nl
espaciopolitica.com
betterce.com
smarttourism.academy
switch-made.com
hinotruckwreckers.com.au
allinonecampaign.com
easydental.ae
belinda.af
hoteltantra.com
basindentistry.com
mgimalta.com
c-sprop.com
foerderverein-vatterschule.de
pays-saint-flour.fr
breakluckrecords.com
forumsittard.nl
ncn.nl
ilovefullcircle.com
goeppinger-teppichreinigung.de
voice2biz.com
modamarfil.com
adedesign.com
stathmoulis.gr
lassocrm.com
hawthornsretirement.co.uk
ced-elec.com
production-stills.co.uk
monstarrsoccer.com
alcye.com
cac2040.com
ocduiblog.com
jameswilliamspainting.com
mrkluttz.com
pilotgreen.com
domilivefurniture.com
whoopingcrane.com
teamsegeln.ch
concontactodirecto.com
b3b.ch
scietech.academy
digitale-elite.de
devplus.be
buerocenter-butzbach-werbemittel.de
lifeinbreaths.com
thegrinningmanmusical.com
kompresory-opravy.com
skyscanner.ro
sachainchiuk.com
fi-institutionalfunds.com
wg-heiligenstadt.de
mesajjongeren.nl
nalliasmali.net
ygallerysalonsoho.com:443
midwestschool.org
deziplan.ru
agriturismocastagneto.it
napisat-pismo-gubernatoru.ru:443
birthplacemag.com
neonodi.be
fann.ru
cotton-avenue.co.il
relevantonline.eu
mslp.org
opticahubertruiz.com
lsngroupe.com
ikadomus.com
kosten-vochtbestrijding.be
simpleitsolutions.ch
markseymourphotography.co.uk
haard-totaal.nl
goodherbalhealth.com
sveneulberg.de
qwikcoach.com
from02pro.com
kiraribeaute-nani.com
rentingwell.com
insane.agency
qrs-international.com
transifer.fr
onlinemarketingsurgery.co.uk
coachpreneuracademy.com
linkbuilding.life
renderbox.ch
rechtenplicht.be
bmw-i-pure-impulse.com
ilveshistoria.com
zorgboerderijravensbosch.nl
ivancacu.com
auberives-sur-vareze.fr
ncjc.ca
xrresources.com
ledyoucan.com
angelika-schwarz.com
suonenjoen.fi
aslog.fr
9nar.com
lookandseen.com
rhino-storage.co.uk
dcc-eu.com
billscars.net
promus.ca
zwemofficial.nl
protoplay.ca
salonlamar.nl
manzel.tn
satoblog.org
ahgarage.com
lattalvor.com
paradigmlandscape.com
skooppi.fi
atma.nl
molinum.pt
spectamarketingdigital.com.br
fotoslubna.com
wribrazil.com
nationnewsroom.com
rattanwarehouse.co.uk
profibersan.com
alisodentalcare.com
arabianmice.com
agencewho-aixenprovence.fr
akwaba-safaris.com
circlecitydj.com
shortsalemap.com
skidpiping.de
drbrianhweeks.com
dmlcpa.com
wyreforest.net
gbk-tp1.de
pro-gamer.pl
queertube.net
arthakapitalforvaltning.dk
baumfinancialservices.com
lisa-poncon.fr
pharmeko-group.com
egpu.fr
phukienbepthanhdat.com
gsconcretecoatings.com
mindsparkescape.com
omnicademy.com
eos-horlogerie.com
stitch-n-bitch.com
benchbiz.com
kuriero.pro
smartspeak.com
line-x.co.uk
corporacionrr.com
istantidigitali.com
metriplica.academy
pazarspor.org.tr
peppergreenfarmcatering.com.au
mariajosediazdemera.com
successcolony.com.ng
omegamarbella.com
bookingwheel.com
wordpress.idium.no
andrealuchesi.it
mediahub.co.nz
golfclublandgoednieuwkerk.nl
jaaphoekzema.nl
flossmoordental.com
maryairbnb.wordpress.com
smartworkplaza.com
parseport.com
motocrosshideout.com
funworx.de
boloria.de
oraweb.net
trevi-vl.ru
oncarrot.com
narca.net
tatyanakopieva.ru
globalcompliancenews.com
jlwilsonbooks.com
wademurray.com
tanatek.com
beandrivingschool.com.au
5pointpt.com
unexplored.gr
designimage.ae
kristianboennelykke.dk
nuohous.com
universelle.fr
bellesiniacademy.org
bcmets.info
gratiocafeblog.wordpress.com
1deals.com
reputation-medical.online
paardcentraal.nl
husetsanitas.dk
dieetuniversiteit.nl
levencovka.ru
yuanshenghotel.com
jefersonalessandro.com
bescomedical.de
hameghlim.com
k-v-f.de
publicompserver.de
amelielecompte.wordpress.com
orchardbrickwork.com
legundschiess.de
putzen-reinigen.com
buzzneakers.com
moira-cristescu.com
sshomme.com
fidelitytitleoregon.com
evsynthacademy.org
adterium.com
eshop.design
buonabitare.com
mursall.de
silkeight.com
donau-guides.eu
skinkeeper.li
anleggsregisteret.no
michal-s.co.il
tellthebell.website
sambaglow.com
housesofwa.com
thegetawaycollective.com
dibli.store
enews-qca.com
jglconsultancy.com
stage-infirmier.fr
handyman-silkeborg.dk
bertbutter.nl
sunsolutions.es
bodymindchallenger.com
advance-refle.com
fitnessblenderstory.com
campusce.com
augen-praxisklinik-rostock.de
bonitabeachassociation.com
margaretmcshane.com
envomask.com
thesilkroadny.com
strauchs-wanderlust.info
nykfdyrehospital.dk
bilius.dk
oportowebdesign.com
thisprettyhair.com
hensleymarketing.com
sjtpo.org
albcleaner.fr
fysiotherapierijnmond.nl
trainiumacademy.com
m2graph.fr
aidanpublishing.co.uk
yournextshoes.com
cainlaw-okc.com
kickittickets.com
racefietsenblog.nl
prodentalblue.com
pubcon.com
limounie.com
azerbaycanas.com
tradenavigator.ch
auto-opel.ro
mrmac.com
kombi-dress.com
tchernia-conseil.fr
mundo-pieces-auto.fr
spartamovers.com
cl0nazepamblog.com
wineandgo.hu
bychowo.pl
paprikapod.com
unboxtherapy.site
martha-frets-ceramics.nl
ciga-france.fr
loysonbryan.com
aktivfriskcenter.se
subquercy.fr
block-optic.com
csaballoons.com
rename.kz
internestdigital.com
livedeveloper.com
avisioninthedesert.com
acornishstudio.co.uk
bourchier.org
matteoruzzaofficial.com
directique.com
hepishopping.com
juergenblaetz.de
newonestop.com
inewsstar.com
bavovrienden.nl
tieronechic.com
premier-iowa.com
finnergo.eu
hiddensee-buhne11.de
advesa.com
bratek-immobilien.de
cardsandloyalty.com
daveystownhouse.com
fire-space.com
der-stempelking.de
tastevirginia.com
sbit.ag
mind2muscle.nl
alexwenzel.de
mikegoodfellow.co.uk
etgdogz.de
bridalcave.com
irizar.com
focuskontur.com
netadultere.fr
baptistdistinctives.org
stanleyqualitysystems.com
computer-place.de
vdolg24.online
nieuwsindeklas.be
brisbaneosteopathic.com.au
dentourage.com
speiserei-hannover.de
valiant-voice.com
dentallabor-luenen.de
watchsale.biz
rossomattonecase.it
renehartman.nl
opt4cdi.com
belofloripa.be
p-ride.live
bd2fly.com
werkzeugtrolley.net
jalkapuu.net
dierenambulancealkmaar.nl
saberconcrete.com
cmeow.com
adaduga.info
tecleados.com
a-zpaperwork.eu
xn--80abehgab4ak0ddz.xn--p1ai
maxcube24.com.ua
hm-com.com
ramirezprono.com
jandhpest.com
scholarquotes.com
apmollerpension.com
enactusnhlstenden.com
andreaskildegaard.dk
carolynfriedlander.com
specialtyhomeservicesllc.com
morgansconsult.com
awaitspain.com
thenalpa.com
aheadloftladders.co.uk
teutoradio.de
limmortelyouth.com
hostastay.com
haus-landliebe.de
aberdeenartwalk.org
rsidesigns.com
purepreprod4.com
cymru.futbol
bringmehope.org
sweetz.fr
111firstdelray.com
operativadigital.com
myplaywin3.com
brighthillgroup.com
singletonfinancial.com
solutionshosting.co.uk
zealcon.ae
gta-jjb.fr
khtrx.com
fascaonline.com
premiumweb.com.ua:443
natturestaurante.com.br
taulunkartano.fi
leopoldineroux.com
mollymccarthydesign.com
osn.ro
latableacrepes-meaux.fr
ketomealprep.academy
leatherjees.com
nourella.com
magnetvisual.com
eastgrinsteadwingchun.com
scentedlair.com
ufovidmag.com
annida.it
ingresosextras.online
olry-cloisons.fr
pixelhealth.net
aquacheck.co.za
amyandzac.com
bayshoreelite.com
dinedrinkdetroit.com
topautoinsurers.net
lgiwines.com
toranjtuition.org
weddingceremonieswithtim.com
-
net
true
-
pid
6
-
prc
veeam
.*Tomcat.*
.*DogGuard.*
.*SafeDog.*
svc$
.*backup.*
memtas
vss
.*Firebird.*
.*firebird.*
.*SQL.*
sql
.*kavfs.*
sophos
.*Alert.*
.*cbService.*
.*klnagent.*
.*Sage.*
.*Mongo.*
mepocs
.*tomcat.*
.*Backup.*
backup
.*postgres.*
.*cbVSCService.*
.*Sql.*
.*Notifier.*
Apache
.*Postgres.*
.*alert.*
nginx
.*sql.*
.*oracle.*
-
ransom_oneliner
All your files are encrypted, additional information can be found inside of {EXT}-readme.txt which is located inside of every encrypted folder
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. If you have any questions, or experiencing troubles with the test decryption, you can use our chat on the website, our stuff support will help you as quick as possible. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
1402
-
svc
.*klnagent.*
.*tomcat.*
.*Sql.*
.*cbVSCService.*
svc$
nginx
.*Firebird.*
Apache
.*Tomcat.*
sophos
.*Postgres.*
.*Alert.*
.*sql.*
.*Mongo.*
sql
veeam
mepocs
memtas
.*Sage.*
backup
.*oracle.*
.*SQL.*
.*Backup.*
.*kavfs.*
.*DogGuard.*
.*cbService.*
.*firebird.*
.*alert.*
.*SafeDog.*
.*postgres.*
.*Notifier.*
.*backup.*
vss
Extracted
C:\Recovery\9xfuulq-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F0A11F0CC03D1866
http://decryptor.top/F0A11F0CC03D1866
Extracted
C:\Recovery\512x5vfh1-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A1B4700D81BA67DB
http://decryptor.top/A1B4700D81BA67DB
Targets
-
-
Target
13d4c1451da6fa284c08c669a7d0e7c1_JaffaCakes118
-
Size
164KB
-
MD5
13d4c1451da6fa284c08c669a7d0e7c1
-
SHA1
2ea65287c7489d8ab5abd04e172c55d1518a4052
-
SHA256
df724c49a1401d66f690b0a940f70bd286671448a625690ccdfdc4c42b4b5b07
-
SHA512
f845335dd84b5bf9b20889dfd051bf012dfcf96adaf4f6de171b3a8e62f42cf03c0e18314ad6ca59ff3eb5e1c0ef3dce179845aac6582b9438c0b13809f47554
-
SSDEEP
3072:ffYWjswg4fQlt4ndm8jX5IXzs+M9VQHDO9KR/vOst3b:ffYWAw9fcUdmwIXo+M9VQHDxmst
Score10/10-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-