General
-
Target
2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118
-
Size
160KB
-
Sample
240510-e4ybesed46
-
MD5
2d59911040a480a6fbddb59a1d66ad8f
-
SHA1
b97065e561f6fb69d16932473e5dd039ef2b842d
-
SHA256
8ab99ac368b338310cb1e130d9971aedcdd3b79e5c7143e8b4b0a8ce894f9c78
-
SHA512
c85a1b5faf249f186515a222a5e931de6ebbce2f4d3f09460761e2a9a114ca7bfae6dc55c80a3aa0b1688136d5419afbfff909311a23e13b514fbd2ab94859ed
-
SSDEEP
3072:Kt38mD9P3ILbi4eTMlwDCnumOtbzl9j0G:KdNBPAbnWJmOhb
Behavioral task
behavioral1
Sample
2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
sodinokibi
20
44
scietech.academy
forextimes.ru
limounie.com
atma.nl
jglconsultancy.com
khtrx.com
azerbaycanas.com
husetsanitas.dk
amco.net.au
brownswoodblog.com
leopoldineroux.com
polynine.com
skyscanner.ro
pourlabretagne.bzh
wasnederland.nl
leatherjees.com
skolaprome.eu
stringnosis.academy
julielusktherapy.com
cotton-avenue.co.il
logosindustries.com
jollity.hu
advanced-removals.co.uk
gbk-tp1.de
rolleepollee.com
schulz-moelln.de
markseymourphotography.co.uk
salonlamar.nl
parentsandkids.com
jobscore.com
fazagostar.co
tradenavigator.ch
pays-saint-flour.fr
relevantonline.eu
kookooo.com
chorusconsulting.net
slotspinner.com
imaginekithomes.co.nz
wg-heiligenstadt.de
ayudaespiritualtamara.com
innovationgames-brabant.nl
nrgvalue.com
girlish.ae
concontactodirecto.com
istantidigitali.com
bulyginnikitav.000webhostapp.com
ebible.co
heimdalbygg.no
holocine.de
profiz.com
onlinetvgroup.com
mediahub.co.nz
photographycreativity.co.uk
silverbird.dk
avisioninthedesert.com
sweetz.fr
sachainchiuk.com
benchbiz.com
levencovka.ru
flossmoordental.com
satoblog.org
fann.ru
hypogenforensic.com
ninjaki.com
rvside.com
bratek-immobilien.de
precisetemp.com
grafikstudio-visuell.de
theboardroomafrica.com
eafx.pro
manzel.tn
nxtstg.org
redctei.co
christianscholz.de
valiant-voice.com
sochi-okna23.ru
mjk.digital
futurenetworking.com
outstandingminialbums.com
belinda.af
jag.me
eyedoctordallas.com
fixx-repair.com
artcase.pl
prodentalblue.com
mrmac.com
ravage-webzine.nl
testitjavertailut.net
ingresosextras.online
grupoexin10.com
kryddersnapsen.dk
catalyseurdetransformation.com
latteswithleslie.com
hameghlim.com
bookingwheel.com
jandhpest.com
vipcarrental.ae
comoserescritor.com
alattekniksipil.com
ziliak.com
lmmont.sk
o90.dk
pansionatblago.ru
basindentistry.com
triplettabordeaux.fr
keyboardjournal.com
auberives-sur-vareze.fr
alpesiberie.com
bayshoreelite.com
frameshift.it
ultimatelifesource.com
anleggsregisteret.no
signededenroth.dk
subyard.com
maxcube24.com.ua
oscommunity.de
narca.net
akwaba-safaris.com
purepreprod4.com
digitale-elite.de
supercarhire.co.uk
allinonecampaign.com
kenmccallum.com
speakaudible.com
nepal-pictures.com
9nar.com
tzn.nu
crestgood.com
pisofare.co
harleystreetspineclinic.com
nalliasmali.net
affligemsehondenschool.be
trevi-vl.ru
hartofurniture.com
lidkopingsnytt.nu
mindsparkescape.com
charlottelhanna.com
clinic-beethovenstrasse-ag.ch
irizar.com
ncjc.ca
animalfood-online.de
vedsegaard.dk
karmeliterviertel.com
sololibrerie.it
devus.de
drbrianhweeks.com
verbouwingsdouche.nl
agrifarm.dk
directique.com
cormanmarketing.com
o2o-academy.com
mike.matthies.de
blavait.fr
rishigangoly.com
electricianul.com
inewsstar.com
loysonbryan.com
voice2biz.com
berdonllp.com
jakubrybak.com
a-zpaperwork.eu
go.labibini.ch
four-ways.com
3daywebs.com
xn--80addfr4ahr.dp.ua
fluzfluzrewards.com
jaaphoekzema.nl
factorywizuk.com
fire-space.com
yournextshoes.com
signamedia.de
laaisterplakky.nl
t3brothers.com
worldproskitour.com
dantreranch.com
putzen-reinigen.com
adabible.org
the-beauty-guides.com
blueridgeheritage.com
johnsonweekly.com
craftron.com
kafkacare.com
shortysspices.com
dayenne-styling.nl
publicompserver.de
mindfuelers.com
wirmuessenreden.com
walterman.es
brighthillgroup.com
5pointpt.com
indiebizadvocates.org
paardcentraal.nl
ownidentity.com
reizenmetkinderen.be
thepixelfairy.com
watchsale.biz
slideevents.be
deziplan.ru
myplaywin3.com
elex.is
legundschiess.de
optigas.com
b3b.ch
oexebusiness.com
kerstliedjeszingen.nl
atrgroup.it
otpusk.zp.ua
gurutechnologies.net
curtsdiscountguns.com
peppergreenfarmcatering.com.au
ketomealprep.academy
druktemakersheerenveen.nl
haus-landliebe.de
distrifresh.com
alharsunindo.com
bendel-partner.de
theintellect.edu.pk
dennisverschuur.com
baita.ac
qandmmusiccenter.com
pixelhealth.net
janellrardon.com
saberconcrete.com
sveneulberg.de
proffteplo.com
tesisatonarim.com
chomiksy.net
lagschools.ng
juergenblaetz.de
motocrosshideout.com
nicksrock.com
trivselsguide.dk
mollymccarthydesign.com
wordpress.idium.no
myfbateam.com
miscbo.it
pvandambv.nl
111firstdelray.com
saint-malo-developpement.fr
yuanshenghotel.com
goodherbalhealth.com
mazzaropi.com.br
suonenjoen.fi
akcadagofis.com
furland.ru
angelika-schwarz.com
thegrinningmanmusical.com
netadultere.fr
toranjtuition.org
billscars.net
arearugcleaningnyc.com
fbmagazine.ru
apiarista.de
bjornvanvulpen.nl
bavovrienden.nl
interlinkone.com
bluetenreich-brilon.de
cap29010.it
utilisacteur.fr
pxsrl.it
lsngroupe.com
belofloripa.be
mercadodelrio.com
dinedrinkdetroit.com
rizplakatjaya.com
pureelements.nl
muller.nl
lovcase.com
martha-frets-ceramics.nl
gta-jjb.fr
arabianmice.com
deduktia.fi
buffdaddyblog.com
altitudeboise.com
masecologicos.com
cl0nazepamblog.com
sycamoregreenapts.com
skidpiping.de
fridakids.com
ikadomus.com
morgansconsult.com
bcmets.info
gratiocafeblog.wordpress.com
omegamarbella.com
therapybusinessacademy.com
wademurray.com
ramirezprono.com
vdolg24.online
lattalvor.com
schroederschoembs.com
transifer.fr
imajyuku-sozoku.com
whoopingcrane.com
neonodi.be
datatri.be
jimprattmediations.com
tothebackofthemoon.com
espaciopolitica.com
alaskaremote.com
cesep2019.com
hensleymarketing.com
tutvracks.com
pajagus.fr
blucamp.com
cc-experts.de
monstarrsoccer.com
klapanvent.ru
stressreliefadvice.com
greenrider.nl
cuadc.org
business-basic.de
invela.dk
renderbox.ch
happylublog.wordpress.com
yourcosmicbeing.com
santastoy.store
jameswilliamspainting.com
line-x.co.uk
mazift.dk
lumturo.academy
reygroup.pt
orchardbrickwork.com
cookinn.nl
onlinemarketingsurgery.co.uk
modamarfil.com
johnstonmingmanning.com
metallbau-hartmann.eu
teamsegeln.ch
theater-lueneburg.de
justaroundthecornerpetsit.com
look.academy
airvapourbarrier.com
soncini.ch
leadforensics.com
min-virksomhed.dk
craftstone.co.nz
voetbalhoogeveen.nl
kvetymichalovce.sk
c-sprop.com
etgdogz.de
memphishealthandwellness.com
ciga-france.fr
mikegoodfellow.co.uk
agendatwentytwenty.com
mslp.org
awag-blog.de
nevadaruralhousingstudies.org
lapponiasafaris.com
floweringsun.org
kuriero.pro
5thactors.com
victorvictoria.com
specialtyhomeservicesllc.com
dierenambulancealkmaar.nl
motocrossplace.co.uk
oncarrot.com
omnicademy.com
alltagsrassismus-entknoten.de
thiagoperez.com
bellesiniacademy.org
thegetawaycollective.com
hm-com.com
insane.agency
enews-qca.com
greeneyetattoo.com
koncept-m.ru
bodet150ans.com
mensemetgesigte.co.za
bodymindchallenger.com
aberdeenartwalk.org
livelai.com
hinotruckwreckers.com.au
rtc24.com
acornishstudio.co.uk
towelroot.co
hutchstyle.co.uk
pokemonturkiye.com
parisschool.ru
agenceassemble.fr
projektparkiet.pl
so-sage.fr
smarttourism.academy
hnkns.com
mayprogulka.ru
redpebblephotography.com
geoweb.software
boloria.de
zaczytana.com
universelle.fr
strauchs-wanderlust.info
teethinadaydentalimplants.com
der-stempelking.de
alwaysdc.com
letterscan.de
mariamalmahdi.com
yvesdoin-aquarelles.fr
mahikuchen.com
perfectgrin.com
shortsalemap.com
rozmata.com
kosten-vochtbestrijding.be
edvestors.org
kroophold-sjaelland.dk
poems-for-the-soul.ch
hawthornsretirement.co.uk
delegationhub.com
babysitting-hk.helpergo.co
bruut.online
11.in.ua
primemarineengineering.com
solidhosting.nl
mind2muscle.nl
kickittickets.com
spacebel.be
bajova.sk
schlagbohrmaschinetests.com
bohrlochversicherung.info
teutoradio.de
annenymus.com
vvego.com
molinum.pt
cardsandloyalty.com
designimage.ae
jobstomoveamerica.org
bonitabeachassociation.com
ocduiblog.com
ilveshistoria.com
astrographic.com
leansupremegarcinia.net
ivancacu.com
skinkeeper.li
nuohous.com
alexwenzel.de
the3-week-diet.net
asiaartgallery.jp
happycatering.de
diverfiestas.com.es
pedmanson.com
pankiss.ru
zuerich-umzug.ch
sber-biznes.com
graygreenbiomedservices.com
hotelturbo.de
aktivfriskcenter.se
luvinsburger.fr
amelielecompte.wordpress.com
tecleados.com
piestar.com
dentalcircle.com
dr-vita.de
egpu.fr
auto-opel.ro
palema.gr
rivermusic.nl
phukienbepthanhdat.com
condormobile.fr
enactusnhlstenden.com
acumenconsultingcompany.com
clemenfoto.dk
lifeinbreaths.com
richardmaybury.co.uk
jlgraphisme.fr
apmollerpension.com
betterce.com
k-v-f.de
stanleyqualitysystems.com
littlesaints.academy
initconf.com
palmenhaus-erfurt.de
nutriwell.com.sg
aoyama.ac
weddingceremonieswithtim.com
ygallerysalonsoho.com:443
angeleyezstripclub.com
agencewho-aixenprovence.fr
mesajjongeren.nl
marcandy.com
eatyoveges.com
annida.it
unislaw-narty.pl
promus.ca
rarefoods.ro
adterium.com
smartworkplaza.com
reputation-medical.online
gosouldeep.com
cymru.futbol
breathebettertolivebetter.com
almamidwifery.com
volta.plus
expohomes.com
jayfurnitureco.com
chris-anne.com
hostastay.com
gavelmasters.com
funworx.de
citiscapes-art.com
mneti.ru
rhino-turf.com
oraweb.net
cssp-mediation.org
factoriareloj.com
bertbutter.nl
slotenmakerszwijndrecht.nl
selected-minds.de
brunoimmobilier.com
chainofhopeeurope.eu
eastgrinsteadwingchun.com
tatyanakopieva.ru
heuvelland-oaze.nl
magnetvisual.com
campusescalade.com
fta-media.com
eshop.design
hawaiisteelbuilding.com
licensed-public-adjuster.com
xn--ziinoapte-6ld.ro
cops4causes.org
rentsportsequip.com
birthplacemag.com
forumsittard.nl
goodboyscustom.com
donau-guides.eu
naukaip.ru
shrinkingplanet.com
makingmillionaires.net
ox-home.com
matteoruzzaofficial.com
vitoriaecoturismo.com.br
barbaramcfadyenjewelry.com
phoenixcrane.com
acb-gruppe.ch
krishnabrawijaya.com
acibademmobil.com.tr
lyricalduniya.com
spectamarketingdigital.com.br
liepertgrafikweb.at
placermonticello.com
avis.mantova.it
billigeflybilletter.dk
sbit.ag
prometeyagro.com.ua
efficiencyconsulting.es
ronielyn.com
sealgrinderpt.com
fanuli.com.au
housesofwa.com
georgemuncey.com
rattanwarehouse.co.uk
uci-france.fr
iactechnologies.net
webforsites.com
texanscan.org
linkbuilding.life
nexstagefinancial.com
internalresults.com
collegetennis.info
glende-pflanzenparadies.de
pharmeko-group.com
loparnille.se
1deals.com
metroton.ru
greatofficespaces.net
cleanroomequipment.ie
forskolinslimeffect.net
trainiumacademy.com
cxcompany.com
karelinjames.com
customroasts.com
beauty-traveller.com
techybash.com
ijsselbeton.nl
geitoniatonaggelon.gr
liveyourheartout.co
smartspeak.com
eos-horlogerie.com
elliemaccreative.wordpress.com
gatlinburgcottage.com
albcleaner.fr
lashandbrowenvy.com
bagaholics.in
hostingbangladesh.net
chatterchatterchatter.com
imagine-entertainment.com
bcabattoirs.org
thestudio.academy
gsconcretecoatings.com
encounter-p.net
janasfokus.com
boyfriendsgoal.site
haard-totaal.nl
descargandoprogramas.com
scentedlair.com
framemyballs.com
larchwoodmarketing.com
antesacademy.it
golfclublandgoednieuwkerk.nl
lassocrm.com
entdoctor-durban.com
kristianboennelykke.dk
sjtpo.org
penumbuhrambutkeiskei.com
kdbrh.com
mac-computer-support-hamburg.de
centuryvisionglobal.com
molade.nl
atelierkomon.com
thenalpa.com
bumbipdeco.site
envomask.com
achetrabalhos.com
agora-collectivites.com
afbudsrejserallinclusive.dk
dnqa.co.uk
pubcon.com
tieronechic.com
livedeveloper.com
operativadigital.com
sprintcoach.com
aheadloftladders.co.uk
janmorgenstern.com
jlwilsonbooks.com
2020hindsight.info
liverpoolabudhabi.ae
cmeow.com
topautoinsurers.net
bluemarinefoundation.com
creohn.de
kompresory-opravy.com
denhaagfoodie.nl
patriotcleaning.net
hoteltantra.com
fitnessblenderstory.com
eksperdanismanlik.com
energosbit-rp.ru
azloans.com
guohedd.com
muni.pe
sytzedevries.com
nauticmarine.dk
bubbalucious.com
rechtenplicht.be
hvitfeldt.dk
90nguyentuan.com
zinnystar.com
bundan.com
jefersonalessandro.com
arazi.eus
duthler.nl
gardenpartner.pl
kiraribeaute-nani.com
stralsund-ansichten.de
mariannelemenestrel.com
domilivefurniture.com
skooppi.fi
ronaldhendriks.nl
zwemofficial.nl
kamin-somnium.de
glas-kuck.de
marmarabasin.com
domaine-des-pothiers.com
pro-gamer.pl
test-teleachat.fr
dogsunlimitedguide.com
noda.com.ua
simpleitsolutions.ch
jeanmonti.com
profibersan.com
olry-cloisons.fr
peninggibadan.co.id
racefietsenblog.nl
mondolandscapes.com
ruggestar.ch
chinowarehousespace.com
goddardleadership.org
randyabrown.com
leloupblanc.gr
fskhjalmar.se
triplettagaite.fr
dmlcpa.com
mediogiro.com.ar
buerocenter-butzbach-werbemittel.de
saboboxtel.uk
skyboundnutrition.co.uk
jalkapuu.net
parksideseniorliving.net
mrcar.nl
levelseven.be
denverwynkoopdentist.com
vitormmcosta.com
explora.nl
scholarquotes.com
premiumweb.com.ua:443
powershell.su
daveystownhouse.com
andreaskildegaard.dk
aslog.fr
bilius.dk
sppdstats.com
terraflair.de
malzomattalar.com
perceptdecor.com
malevannye.ru
davedavisphotos.com
xn--80abehgab4ak0ddz.xn--p1ai
bg.szczecin.pl
turing.academy
brinkdoepke.eu
michal-s.co.il
pinkxgayvideoawards.com
nginx.com
awaitspain.com
christopherhannan.com
eventosvirtualesexitosos.com
maryairbnb.wordpress.com
arthakapitalforvaltning.dk
qwikcoach.com
kemtron.fr
paprikapod.com
gazelle-du-web.com
ceocenters.com
campinglaforetdetesse.com
ddmgen.com
richardkershawwines.co.za
nieuwsindeklas.be
circuit-diagramz.com
pazarspor.org.tr
internestdigital.com
mundo-pieces-auto.fr
startuplive.org
campusce.com
epsondriversforwindows.com
tellthebell.website
witraz.pl
chatberlin.de
circlecitydj.com
smartmind.net
lunoluno.com
fysiotherapierijnmond.nl
rapid5kloan.org
zumrutkuyutemel.com
physio-lang.de
rhino-storage.co.uk
augen-praxisklinik-rostock.de
baumfinancialservices.com
bringmehope.org
newonestop.com
easydental.ae
moira-cristescu.com
stathmoulis.gr
innervisions-id.com
anchelor.com
aquacheck.co.za
globalskills.pt
veggienessa.com
spirello.nl
innersurrection.com
nationnewsroom.com
mariajosediazdemera.com
groovedealers.ru
limmortelyouth.com
schluesseldienste-hannover.de
mustangmarketinggroup.com
autoteamlast.de
die-immo-agentur.de
global-migrate.com
successcolony.com.ng
billyoart.com
ideamode.com
rentingwell.com
lesyeuxbleus.net
bakingismyyoga.com
thehovecounsellingpractice.co.uk
renehartman.nl
askstaffing.com
queertube.net
beandrivingschool.com.au
handyman-silkeborg.dk
stage-infirmier.fr
catering.com
devplus.be
site.markkit.com.br
mieleshopping.it
linearete.com
lisa-poncon.fr
natturestaurante.com.br
focuskontur.com
margaretmcshane.com
foerderverein-vatterschule.de
wrinstitute.org
mamajenedesigns.com
dreamvoiceclub.org
block-optic.com
letsstopsmoking.co.uk
opticahubertruiz.com
catchup-mag.com
endstarvation.com
dcc-eu.com
carsten.sparen-it.de
ilovefullcircle.com
epicjapanart.com
web865.com
medicalsupportco.com
sellthewrightway.com
ledyoucan.com
zealcon.ae
stagefxinc.com
hom-frisor.dk
yayasanprimaunggul.org
opt4cdi.com
sunsolutions.es
airserviceunlimited.com
alene.co
amyandzac.com
tastevirginia.com
mbuildinghomes.com
sambaglow.com
itheroes.dk
glennverschueren.be
triavlete.com
andermattswisswatches.ch
nbva.co.uk
luvbec.com
michaelfiegel.com
direitapernambuco.com
oththukaruva.com
magrinya.net
altocontatto.net
jonnyhooley.com
radishallgood.com
rs-danmark.dk
secrets-clubs.co.uk
landgoedspica.nl
rossomattonecase.it
richardiv.com
ncn.nl
andrealuchesi.it
xtensifi.com
fotoslubna.com
bychowo.pl
oportowebdesign.com
ykobbqchicken.ca
grancanariaregional.com
ufovidmag.com
rino-gmbh.com
cyberpromote.de
solutionshosting.co.uk
evsynthacademy.org
nvisionsigns.com
keuken-prijs.nl
lovetzuchia.com
mangimirossana.it
soundseeing.net
baptistdistinctives.org
taulunkartano.fi
napisat-pismo-gubernatoru.ru:443
palmecophilippines.com
p-ride.live
aciscomputers.com
studionumerik.fr
mrkluttz.com
aceroprime.com
colored-shelves.com
boomerslivinglively.com
cac2040.com
galaniuklaw.com
animation-pro.co.uk
qrs-international.com
quitescorting.com
baikalflot.ru
galatee-couture.com
corporacionrr.com
tweedekansenloket.nl
lollachiro.com
rsidesigns.com
ludoil.it
theatre-embellie.fr
tchernia-conseil.fr
alcye.com
biblica.com
the-cupboard.co.uk
amorbellezaysalud.com
alnectus.com
finsahome.co.uk
jdscenter.com
protoplay.ca
cmascd.com
biketruck.de
zorgboerderijravensbosch.nl
dentourage.com
hostaletdelsindians.es
bmw-i-pure-impulse.com
charlesfrancis.photos
csaballoons.com
citydogslife.com
cp-bap.de
unexplored.gr
brisbaneosteopathic.com.au
fotoeditores.com
kombi-dress.com
adaduga.info
globalcompliancenews.com
tramadolhealth.com
metriplica.academy
topvijesti.net
advance-refle.com
burg-zelem.de
springfieldplumbermo.com
uncensoredhentaigif.com
fidelitytitleoregon.com
riffenmattgarage.ch
fascaonline.com
biodentify.ai
craftingalegacy.com
drnelsonpediatrics.com
fsbforsale.com
nykfdyrehospital.dk
wineandgo.hu
jacquesgarcianoto.com
tilldeeke.de
hekecrm.com
subquercy.fr
activeterroristwarningcompany.com
louiedager.com
sharonalbrightdds.com
photonag.com
oro.ae
jax-interim-and-projectmanagement.com
hospitalitytrainingsolutions.co.uk
spartamovers.com
katherinealy.com
claudiakilian.de
lexced.com
banukumbak.com
yourhappyevents.fr
stabilisateur.fr
mursall.de
alabamaroofingllc.com
skoczynski.eu
midwestschool.org
switch-made.com
docarefoundation.org
tetameble.pl
hiddensee-buhne11.de
aidanpublishing.co.uk
casinodepositors.com
k-zubki.ru
buonabitare.com
eurethicsport.eu
brannbornfastigheter.se
carmel-york.com
fla.se
agriturismocastagneto.it
log-barn.co.uk
unboxtherapy.site
rubyaudiology.com
the5thquestion.com
angelsmirrorus.com
kellengatton.com
raeoflightmusic.com
stoneridgemontessori.com
finnergo.eu
bourchier.org
traitware.com
singletonfinancial.com
abulanov.com
iron-mine.ru
jobkiwi.com.ng
from02pro.com
neolaiamedispa.com
bescomedical.de
speiserei-hannover.de
n-newmedia.de
wribrazil.com
stitch-n-bitch.com
ya-elka.ru
fi-institutionalfunds.com
latableacrepes-meaux.fr
adedesign.com
goeppinger-teppichreinigung.de
wallflowersandrakes.com
dentallabor-luenen.de
jmmartinezilustrador.com
apogeeconseils.fr
professionetata.com
avtoboss163.ru:443
bridalcave.com
diakonie-weitramsdorf-sesslach.de
metcalfe.ca
cincinnatiphotocompany.org
kelsigordon.com
pinthelook.com
tbalp.co.uk
thisprettyhair.com
tages-geldvergleich.de
ahgarage.com
rokthetalk.com
zdrowieszczecin.pl
martinipstudios.com
rename.kz
elitkeramika-shop.com.ua
premier-iowa.com
bd2fly.com
leijstrom.com
scotlandsroute66.co.uk
axisoflove.org:443
pilotgreen.com
tanatek.com
carolynfriedlander.com
vapiano.fr
patassociation.com
cascinarosa33.it
computer-place.de
artvark.nl
gaearoyals.com
hepishopping.com
coachpreneuracademy.com
parseport.com
broccolisoep.nl
awaisghauri.com
lookandseen.com
iexpert99.com
drbenveniste.com
ced-elec.com
welovecustomers.fr
johnkoen.com
plbinsurance.com
xn--billigafrgpatroner-stb.se
kryptos72.com
breakluckrecords.com
drvoip.com
smartercashsystem.com
alisodentalcare.com
cainlaw-okc.com
g2mediainc.com
nepressurecleaning.com
frimec-international.es
ikzoekgod.be
lgiwines.com
suitesartemis.gr
humanviruses.org
onesynergyinternational.com
paradigmlandscape.com
thesilkroadny.com
osn.ro
hotjapaneselesbian.com
bluelakevision.com
endlessrealms.net
dieetuniversiteit.nl
matthieupetel.fr
xrresources.com
buzzneakers.com
ntinasfiloxenia.gr
kausette.com
mediabolmong.com
m2graph.fr
dinecorp.com
kartuindonesia.com
edrickennedymacfoy.com
silkeight.com
frankgoll.com
wyreforest.net
advancedeyecare.com
sshomme.com
mgimalta.com
laylavalentine.com
nourella.com
banksrl.co.za
werkzeugtrolley.net
advesa.com
production-stills.co.uk
dibli.store
sarahspics.co.uk
-
net
true
-
pid
20
-
prc
sqlservr.exe
mysql.exe
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
44
Extracted
C:\Users\i476fd0zte-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C073BA1BCCAC4BBF
http://decryptor.top/C073BA1BCCAC4BBF
Extracted
C:\Users\d45492m9-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DFB2CE7DF69740DB
http://decryptor.top/DFB2CE7DF69740DB
Targets
-
-
Target
2d59911040a480a6fbddb59a1d66ad8f_JaffaCakes118
-
Size
160KB
-
MD5
2d59911040a480a6fbddb59a1d66ad8f
-
SHA1
b97065e561f6fb69d16932473e5dd039ef2b842d
-
SHA256
8ab99ac368b338310cb1e130d9971aedcdd3b79e5c7143e8b4b0a8ce894f9c78
-
SHA512
c85a1b5faf249f186515a222a5e931de6ebbce2f4d3f09460761e2a9a114ca7bfae6dc55c80a3aa0b1688136d5419afbfff909311a23e13b514fbd2ab94859ed
-
SSDEEP
3072:Kt38mD9P3ILbi4eTMlwDCnumOtbzl9j0G:KdNBPAbnWJmOhb
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-