General
-
Target
42a2e208bc7721348699212bc5cf50e5_JaffaCakes118
-
Size
222KB
-
Sample
240514-xs5v8sbf3v
-
MD5
42a2e208bc7721348699212bc5cf50e5
-
SHA1
15934add1f6f10bc50daa707bf8d02bb62edbdf7
-
SHA256
d186adf9bf8ae0b9759a2836f94597d6832f076bd03de9886181be53183d25de
-
SHA512
2549f5273ea6120dc18a97c1f59324e6e5696b15bf7f56a5c22c4d1c461fd6da200272aa58529b42a8e2ce6e8c8b1298030b38298bed9194b26882be8cb8cebb
-
SSDEEP
3072:sr85CIyyTsnAdu5tjgn/RRKwkwvMT3QE4f07YouoFhiLFrb30BRtBZZg+i2T:k9nyTsnXToKJw4gEWpoFuJ0BXScT
Behavioral task
behavioral1
Sample
42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
42a2e208bc7721348699212bc5cf50e5_JaffaCakes118.exe
Resource
win10v2004-20240426-en
Malware Config
Extracted
sodinokibi
$2a$10$SlLR2WWgiOxrDQLqdHYA/Or5zeu.wNuMGc5rN/HHrIObc1EkKCIZa
3181
vannesteconstruct.be
irishmachineryauctions.com
zervicethai.co.th
ymca-cw.org.uk
trystana.com
smessier.com
beautychance.se
sabel-bf.com
kafu.ch
aselbermachen.com
first-2-aid-u.com
finediningweek.pl
berlin-bamboo-bikes.org
lbcframingelectrical.com
augenta.com
abitur-undwieweiter.de
digi-talents.com
wellplast.se
conasmanagement.de
simpkinsedwards.co.uk
romeguidedvisit.com
tastewilliamsburg.com
bingonearme.org
mylovelybluesky.com
nacktfalter.de
oldschoolfun.net
baylegacy.com
buroludo.nl
corelifenutrition.com
vietlawconsultancy.com
deschl.net
proudground.org
commercialboatbuilding.com
serce.info.pl
eadsmurraypugh.com
joseconstela.com
offroadbeasts.com
evangelische-pfarrgemeinde-tuniberg.de
richard-felix.co.uk
beyondmarcomdotcom.wordpress.com
christinarebuffetcourses.com
supportsumba.nl
jusibe.com
hairstylesnow.site
bildungsunderlebnis.haus
yassir.pro
nestor-swiss.ch
lachofikschiet.nl
bordercollie-nim.nl
sexandfessenjoon.wordpress.com
whittier5k.com
artallnightdc.com
ilive.lt
strategicstatements.com
lionware.de
latribuessentielle.com
delchacay.com.ar
mooreslawngarden.com
bodyfulls.com
moveonnews.com
ussmontanacommittee.us
slupetzky.at
softsproductkey.com
parking.netgateway.eu
bowengroup.com.au
ilso.net
visiativ-industry.fr
danielblum.info
uimaan.fi
walter-lemm.de
iphoneszervizbudapest.hu
ncuccr.org
wraithco.com
steampluscarpetandfloors.com
bodyforwife.com
victoriousfestival.co.uk
thenewrejuveme.com
argenblogs.com.ar
freie-baugutachterpraxis.de
bunburyfreightservices.com.au
finde-deine-marke.de
cactusthebrand.com
sanaia.com
maasreusel.nl
4youbeautysalon.com
crosspointefellowship.church
micro-automation.de
plantag.de
airconditioning-waalwijk.nl
danholzmann.com
mymoneyforex.com
jasonbaileystudio.com
stallbyggen.se
schmalhorst.de
geoffreymeuli.com
dw-css.de
kostenlose-webcams.com
bierensgebakkramen.nl
greenfieldoptimaldentalcare.com
waywithwords.net
advokathuset.dk
phantastyk.com
xltyu.com
gemeentehetkompas.nl
olejack.ru
slashdb.com
theapifactory.com
otsu-bon.com
globedivers.wordpress.com
modelmaking.nl
hushavefritid.dk
insigniapmg.com
castillobalduz.es
bristolaeroclub.co.uk
plastidip.com.ar
plv.media
naswrrg.org
vyhino-zhulebino-24.ru
opatrovanie-ako.sk
fensterbau-ziegler.de
farhaani.com
shonacox.com
narcert.com
rozemondcoaching.nl
torgbodenbollnas.se
projetlyonturin.fr
embracinghiscall.com
actecfoundation.org
falcou.fr
slwgs.org
copystar.co.uk
galleryartfair.com
kikedeoliveira.com
eco-southafrica.com
digivod.de
katketytaanet.fi
socstrp.org
goodgirlrecovery.com
body-guards.it
gopackapp.com
ivfminiua.com
ladelirante.fr
people-biz.com
kariokids.com
creative-waves.co.uk
praxis-management-plus.de
suncrestcabinets.ca
journeybacktolife.com
hoteledenpadova.it
handi-jack-llc.com
sojamindbody.com
carlosja.com
crowcanyon.com
run4study.com
seproc.hn
plotlinecreative.com
coffreo.biz
sandd.nl
autofolierung-lu.de
charlottepoudroux-photographie.fr
oncarrot.com
trapiantofue.it
aprepol.com
dekkinngay.com
homesdollar.com
fatfreezingmachines.com
smhydro.com.pl
cityorchardhtx.com
evologic-technologies.com
berliner-versicherungsvergleich.de
testcoreprohealthuk.com
mrsfieldskc.com
kirkepartner.dk
stemplusacademy.com
longislandelderlaw.com
johnsonfamilyfarmblog.wordpress.com
spsshomeworkhelp.com
fransespiegels.nl
ino-professional.ru
nvwoodwerks.com
colorofhorses.com
bptdmaluku.com
themadbotter.com
boulderwelt-muenchen-west.de
stampagrafica.es
fiscalsort.com
epwritescom.wordpress.com
tennisclubetten.nl
satyayoga.de
1kbk.com.ua
gadgetedges.com
darnallwellbeing.org.uk
shiftinspiration.com
kidbucketlist.com.au
y-archive.com
idemblogs.com
new.devon.gov.uk
jakekozmor.com
rumahminangberdaya.com
campusoutreach.org
dontpassthepepper.com
anybookreader.de
qlog.de
deko4you.at
birnam-wood.com
eglectonk.online
allfortheloveofyou.com
irinaverwer.com
chatizel-paysage.fr
pogypneu.sk
revezlimage.com
solhaug.tk
arteservicefabbro.com
vorotauu.ru
rushhourappliances.com
chaotrang.com
basisschooldezonnewijzer.nl
milsing.hr
abogadosadomicilio.es
hellohope.com
perbudget.com
muamuadolls.com
edelman.jp
gasolspecialisten.se
ianaswanson.com
heliomotion.com
skanah.com
zenderthelender.com
simpliza.com
zonamovie21.net
amerikansktgodis.se
slimidealherbal.com
jobcenterkenya.com
neuschelectrical.co.za
zieglerbrothers.de
webmaster-peloton.com
atmos-show.com
architekturbuero-wagner.net
tetinfo.in
poultrypartners.nl
sportiomsportfondsen.nl
deoudedorpskernnoordwijk.nl
groupe-cets.com
mousepad-direkt.de
crowd-patch.co.uk
gw2guilds.org
fitnessbazaar.com
coastalbridgeadvisors.com
marchand-sloboda.com
bouquet-de-roses.com
woodleyacademy.org
camsadviser.com
strandcampingdoonbeg.com
esope-formation.fr
tenacitytenfold.com
walkingdeadnj.com
zimmerei-fl.de
pcprofessor.com
theadventureedge.com
edgewoodestates.org
imperfectstore.com
kingfamily.construction
drnice.de
effortlesspromo.com
appsformacpc.com
troegs.com
blacksirius.de
team-montage.dk
cnoia.org
theclubms.com
klimt2012.info
tuuliautio.fi
launchhubl.com
verifort-capital.de
elimchan.com
lloydconstruction.com
gastsicht.de
harveybp.com
forestlakeuca.org.au
portoesdofarrobo.com
videomarketing.pro
kedak.de
calxplus.eu
naturstein-hotte.de
zimmerei-deboer.de
myteamgenius.com
celeclub.org
paulisdogshop.de
anteniti.com
charlesreger.com
justinvieira.com
geisterradler.de
behavioralmedicinespecialists.com
tampaallen.com
jacquin-maquettes.com
smokeysstoves.com
hiddencitysecrets.com.au
higadograsoweb.com
allentownpapershow.com
thomasvicino.com
smogathon.com
bastutunnan.se
chefdays.de
polymedia.dk
heurigen-bauer.at
ikads.org
live-your-life.jp
noixdecocom.fr
nandistribution.nl
turkcaparbariatrics.com
meusharklinithome.wordpress.com
rollingrockcolumbia.com
real-estate-experts.com
kadesignandbuild.co.uk
agence-referencement-naturel-geneve.net
solerluethi-allart.ch
caribdoctor.org
sw1m.ru
directwindowco.com
fitovitaforum.com
buymedical.biz
rosavalamedahr.com
monark.com
biapi-coaching.fr
cheminpsy.fr
alsace-first.com
creamery201.com
chavesdoareeiro.com
besttechie.com
pv-design.de
craigmccabe.fun
unim.su
brandl-blumen.de
sinal.org
botanicinnovations.com
michaelsmeriglioracing.com
herbstfeststaefa.ch
haar-spange.com
krcove-zily.eu
wari.com.pe
corendonhotels.com
dinslips.se
pasivect.co.uk
villa-marrakesch.de
ungsvenskarna.se
manutouchmassage.com
myhostcloud.com
schraven.de
ahouseforlease.com
abogadoengijon.es
allamatberedare.se
mepavex.nl
nurturingwisdom.com
mooshine.com
officehymy.com
croftprecision.co.uk
solinegraphic.com
despedidascostablanca.es
samnewbyjax.com
surespark.org.uk
houseofplus.com
puertamatic.es
ihr-news.jp
pcp-nc.com
importardechina.info
cursosgratuitosnainternet.com
saka.gr
agence-chocolat-noir.com
miriamgrimm.de
yousay.site
notmissingout.com
mindpackstudios.com
denifl-consulting.at
tomoiyuma.com
noesis.tech
mrsplans.net
ravensnesthomegoods.com
microcirc.net
woodworkersolution.com
fannmedias.com
teczowadolina.bytom.pl
greenko.pl
fairfriends18.de
antenanavi.com
gaiam.nl
mountsoul.de
maineemploymentlawyerblog.com
femxarxa.cat
madinblack.com
hvccfloorcare.com
jeanlouissibomana.com
assurancesalextrespaille.fr
liveottelut.com
retroearthstudio.com
funjose.org.gt
maureenbreezedancetheater.org
mercantedifiori.com
xn--logopdie-leverkusen-kwb.de
blewback.com
presseclub-magdeburg.de
xn--singlebrsen-vergleich-nec.com
nijaplay.com
rostoncastings.co.uk
vloeren-nu.nl
carrybrands.nl
hexcreatives.co
asteriag.com
planchaavapor.net
autopfand24.de
nataschawessels.com
geekwork.pl
mariposapropaneaz.com
bockamp.com
upmrkt.co
id-vet.com
mbfagency.com
facettenreich27.de
deltacleta.cat
judithjansen.com
whyinterestingly.ru
id-et-d.fr
thaysa.com
sterlingessay.com
blood-sports.net
instatron.net
shsthepapercut.com
lascuola.nl
dareckleyministries.com
igorbarbosa.com
thedresserie.com
lapinvihreat.fi
ftlc.es
teresianmedia.org
norovirus-ratgeber.de
xn--fn-kka.no
vitavia.lt
unetica.fr
schlafsack-test.net
mank.de
htchorst.nl
theshungiteexperience.com.au
shadebarandgrillorlando.com
rhinosfootballacademy.com
danskretursystem.dk
ruralarcoiris.com
innote.fi
rerekatu.com
rieed.de
hhcourier.com
americafirstcommittee.org
theletter.company
bundabergeyeclinic.com.au
resortmtn.com
paymybill.guru
lubetkinmediacompanies.com
mountaintoptinyhomes.com
associacioesportivapolitg.cat
faroairporttransfers.net
stemenstilte.nl
werkkring.nl
ecoledansemulhouse.fr
kaotikkustomz.com
deprobatehelp.com
jerling.de
commonground-stories.com
balticdermatology.lt
maryloutaylor.com
pt-arnold.de
compliancesolutionsstrategies.com
leeuwardenstudentcity.nl
mylolis.com
vibehouse.rw
centrospgolega.com
piajeppesen.dk
xn--rumung-bua.online
hairnetty.wordpress.com
dutchcoder.nl
datacenters-in-europe.com
bogdanpeptine.ro
rimborsobancario.net
manifestinglab.com
midmohandyman.com
flexicloud.hk
stefanpasch.me
katiekerr.co.uk
hihaho.com
igfap.com
koko-nora.dk
henricekupper.com
corona-handles.com
freie-gewerkschaften.de
atozdistribution.co.uk
mirjamholleman.nl
zweerscreatives.nl
educar.org
international-sound-awards.com
intecwi.com
hrabritelefon.hr
bestbet.com
schoolofpassivewealth.com
cwsitservices.co.uk
advizewealth.com
psnacademy.in
nosuchthingasgovernment.com
friendsandbrgrs.com
35-40konkatsu.net
milanonotai.it
wurmpower.at
modamilyon.com
scenepublique.net
verytycs.com
hotelzentral.at
2ekeus.nl
pawsuppetlovers.com
alysonhoward.com
tomaso.gr
brevitempore.net
linnankellari.fi
mdacares.com
ogdenvision.com
roadwarrior.app
love30-chanko.com
better.town
dublikator.com
dr-seleznev.com
ceid.info.tr
101gowrie.com
pferdebiester.de
pierrehale.com
karacaoglu.nl
ilcdover.com
rehabilitationcentersinhouston.net
kissit.ca
analiticapublica.es
schoellhammer.com
memaag.com
sla-paris.com
bloggyboulga.net
dezatec.es
antiaginghealthbenefits.com
edv-live.de
kunze-immobilien.de
anthonystreetrimming.com
bee4win.com
d1franchise.com
withahmed.com
beaconhealthsystem.org
kamahouse.net
catholicmusicfest.com
hannah-fink.de
bxdf.info
liikelataamo.fi
stupbratt.no
filmstreamingvfcomplet.be
sportverein-tambach.de
work2live.de
craftleathermnl.com
classycurtainsltd.co.uk
deepsouthclothingcompany.com
autodujos.lt
braffinjurylawfirm.com
carriagehousesalonvt.com
collaborativeclassroom.org
miraclediet.fun
greenpark.ch
ostheimer.at
balticdentists.com
acomprarseguidores.com
bhwlawfirm.com
ralister.co.uk
porno-gringo.com
leda-ukraine.com.ua
waynela.com
dubnew.com
bargningharnosand.se
antonmack.de
abl1.net
grupocarvalhoerodrigues.com.br
tinkoff-mobayl.ru
degroenetunnel.com
makeitcount.at
ccpbroadband.com
ohidesign.com
abogadosaccidentetraficosevilla.es
adoptioperheet.fi
lenreactiv-shop.ru
imaginado.de
centromarysalud.com
ora-it.de
familypark40.com
nuzech.com
licor43.de
kevinjodea.com
joyeriaorindia.com
polychromelabs.com
wasmachtmeinfonds.at
luckypatcher-apkz.com
triggi.de
gamesboard.info
bigler-hrconsulting.ch
gymnasedumanagement.com
chrissieperry.com
schutting-info.nl
webcodingstudio.com
amylendscrestview.com
herbayupro.com
dramagickcom.wordpress.com
fotoideaymedia.es
fayrecreations.com
stoneys.ch
naturavetal.hr
sofavietxinh.com
seagatesthreecharters.com
tinyagency.com
platformier.com
DupontSellsHomes.com
danubecloud.com
hatech.io
extensionmaison.info
ventti.com.ar
paradicepacks.com
maratonaclubedeportugal.com
zewatchers.com
forskolorna.org
art2gointerieurprojecten.nl
the-virtualizer.com
kao.at
tecnojobsnet.com
alhashem.net
readberserk.com
lichencafe.com
sauschneider.info
girlillamarketing.com
backstreetpub.com
entopic.com
hugoversichert.de
mikeramirezcpa.com
highimpactoutdoors.net
csgospeltips.se
ai-spt.jp
spacecitysisters.org
completeweddingkansas.com
ecopro-kanto.com
devlaur.com
klusbeter.nl
nmiec.com
faronics.com
manijaipur.com
sanyue119.com
securityfmm.com
huesges-gruppe.de
smithmediastrategies.com
dubscollective.com
hypozentrum.com
employeesurveys.com
nokesvilledentistry.com
pinkexcel.com
nakupunafoundation.org
xlarge.at
financescorecard.com
bouncingbonanza.com
kenhnoithatgo.com
tradiematepro.com.au
musictreehouse.net
asgestion.com
ontrailsandboulevards.com
krlosdavid.com
siliconbeach-realestate.com
live-con-arte.de
pubweb.carnet.hr
naturalrapids.com
consultaractadenacimiento.com
stingraybeach.com
tongdaifpthaiphong.net
wacochamber.com
mrtour.site
onlyresultsmarketing.com
nsec.se
southeasternacademyofprosthodontics.org
thewellnessmimi.com
gasbarre.com
toponlinecasinosuk.co.uk
baumkuchenexpo.jp
baptisttabernacle.com
div-vertriebsforschung.de
smale-opticiens.nl
365questions.org
kampotpepper.gives
biortaggivaldelsa.com
cerebralforce.net
citymax-cr.com
polzine.net
argos.wityu.fund
zso-mannheim.de
4net.guru
gporf.fr
partnertaxi.sk
coursio.com
cortec-neuro.com
milltimber.aberdeen.sch.uk
urist-bogatyr.ru
cranleighscoutgroup.org
mmgdouai.fr
punchbaby.com
bsaship.com
jadwalbolanet.info
harpershologram.wordpress.com
hkr-reise.de
nhadatcanho247.com
milestoneshows.com
osterberg.fi
conexa4papers.trade
hotelsolbh.com.br
aniblinova.wordpress.com
blumenhof-wegleitner.at
praxis-foerderdiagnostik.de
markelbroch.com
bauertree.com
smart-light.co.uk
qualitus.com
makeflowers.ru
raschlosser.de
pelorus.group
baronloan.org
radaradvies.nl
travelffeine.com
mirkoreisser.de
carolinepenn.com
homecomingstudio.com
boompinoy.com
lapmangfpt.info.vn
stopilhan.com
lange.host
smejump.co.th
wychowanieprzedszkolne.pl
aminaboutique247.com
restaurantesszimmer.de
elpa.se
mediaplayertest.net
dutchbrewingcoffee.com
triactis.com
dnepr-beskid.com.ua
ausair.com.au
syndikat-asphaltfieber.de
firstpaymentservices.com
pmcimpact.com
yourobgyn.net
asiluxury.com
oneplusresource.org
jolly-events.com
upplandsspar.se
figura.team
quizzingbee.com
tandartspraktijkheesch.nl
kath-kirche-gera.de
teknoz.net
maxadams.london
sloverse.com
panelsandwichmadrid.es
havecamerawilltravel2017.wordpress.com
12starhd.online
liliesandbeauties.org
skiltogprint.no
ki-lowroermond.nl
tips.technology
gonzalezfornes.es
broseller.com
denovofoodsgroup.com
ivivo.es
smartypractice.com
profectis.de
iwelt.de
physiofischer.de
boldcitydowntown.com
dr-tremel-rednitzhembach.de
tonelektro.nl
www1.proresult.no
patrickfoundation.net
pickanose.com
desert-trails.com
worldhealthbasicinfo.com
limassoldriving.com
the-domain-trader.com
itelagen.com
ecpmedia.vn
igrealestate.com
personalenhancementcenter.com
oemands.dk
thefixhut.com
summitmarketingstrategies.com
vermoote.de
xn--fnsterputssollentuna-39b.se
lusak.at
wien-mitte.co.at
heidelbergartstudio.gallery
drinkseed.com
you-bysia.com.au
adultgamezone.com
vancouver-print.ca
tophumanservicescourses.com
sahalstore.com
noskierrenteria.com
bricotienda.com
parebrise-tla.fr
tanzschule-kieber.de
sobreholanda.com
pier40forall.org
simplyblessedbykeepingitreal.com
rota-installations.co.uk
xtptrack.com
helenekowalsky.com
songunceliptv.com
parkcf.nl
xoabigail.com
takeflat.com
bargningavesta.se
iyengaryogacharlotte.com
aakritpatel.com
austinlchurch.com
ncs-graphic-studio.com
podsosnami.ru
juneauopioidworkgroup.org
aunexis.ch
boosthybrid.com.au
roygolden.com
iviaggisonciliegie.it
ausbeverage.com.au
bookspeopleplaces.com
cleliaekiko.online
waveneyrivercentre.co.uk
vibethink.net
exenberger.at
todocaracoles.com
siluet-decor.ru
tux-espacios.com
thailandholic.com
hebkft.hu
coding-machine.com
blossombeyond50.com
destinationclients.fr
ra-staudte.de
waermetauscher-berechnen.de
foryourhealth.live
ampisolabergeggi.it
ledmes.ru
verbisonline.com
promesapuertorico.com
senson.fi
allure-cosmetics.at
icpcnj.org
fitnessingbyjessica.com
kamienny-dywan24.pl
vox-surveys.com
jameskibbie.com
merzi.info
c-a.co.in
expandet.dk
seitzdruck.com
tulsawaterheaterinstallation.com
synlab.lt
montrium.com
saxtec.com
c2e-poitiers.com
hmsdanmark.dk
morawe-krueger.de
sipstroysochi.ru
mediaclan.info
devok.info
vdberg-autoimport.nl
web.ion.ag
refluxreducer.com
hashkasolutindo.com
lightair.com
simulatebrain.com
onlybacklink.com
labobit.it
leoben.at
tanciu.com
truenyc.co
echtveilig.nl
executiveairllc.com
em-gmbh.ch
zflas.com
sweering.fr
tstaffing.nl
frontierweldingllc.com
sairaku.net
alfa-stroy72.com
baustb.de
macabaneaupaysflechois.com
nativeformulas.com
slimani.net
cursoporcelanatoliquido.online
tigsltd.com
socialonemedia.com
westdeptfordbuyrite.com
123vrachi.ru
diversiapsicologia.es
kuntokeskusrok.fi
twohourswithlena.wordpress.com
mastertechengineering.com
extraordinaryoutdoors.com
littlebird.salon
pixelarttees.com
gantungankunciakrilikbandung.com
imadarchid.com
connectedace.com
theduke.de
uranus.nl
i-arslan.de
dirittosanitario.biz
no-plans.com
gratispresent.se
dsl-ip.de
sportsmassoren.com
brigitte-erler.com
cimanchesterescorts.co.uk
webhostingsrbija.rs
artotelamsterdam.com
levdittliv.se
nancy-informatique.fr
peterstrobos.com
wmiadmin.com
shhealthlaw.com
ceres.org.au
vetapharma.fr
kosterra.com
dr-pipi.de
bouldercafe-wuppertal.de
jbbjw.com
kaminscy.com
saarland-thermen-resort.com
grelot-home.com
courteney-cox.net
trulynolen.co.uk
tsklogistik.eu
ateliergamila.com
newyou.at
blog.solutionsarchitect.guru
christ-michael.net
caribbeansunpoker.com
promalaga.es
wsoil.com.sg
seminoc.com
body-armour.online
glennroberts.co.nz
x-ray.ca
ouryoungminds.wordpress.com
systemate.dk
garage-lecompte-rouen.fr
vesinhnha.com.vn
erstatningsadvokaterne.dk
sotsioloogia.ee
marketingsulweb.com
koken-voor-baby.nl
admos-gleitlager.de
bayoga.co.uk
marathonerpaolo.com
qualitaetstag.de
oceanastudios.com
aarvorg.com
tarotdeseidel.com
kmbshipping.co.uk
clos-galant.com
bigbaguettes.eu
huehnerauge-entfernen.de
fax-payday-loans.com
rebeccarisher.com
thomas-hospital.de
abogados-en-alicante.es
eraorastudio.com
corola.es
notsilentmd.org
hardinggroup.com
rksbusiness.com
calabasasdigest.com
penco.ie
otto-bollmann.de
operaslovakia.sk
1team.es
transliminaltribe.wordpress.com
myhealth.net.au
kaliber.co.jp
jobmap.at
spectrmash.ru
bridgeloanslenders.com
humancondition.com
myzk.site
minipara.com
d2marketing.co.uk
enovos.de
toreria.es
campus2day.de
aglend.com.au
mapawood.com
ziegler-praezisionsteile.de
thee.network
lecantou-coworking.com
edrcreditservices.nl
pasvenska.se
urmasiimariiuniri.ro
odiclinic.org
cirugiauretra.es
psa-sec.de
bbsmobler.se
cite4me.org
simoneblum.de
vihannesporssi.fi
oneheartwarriors.at
alvinschwartz.wordpress.com
ftf.or.at
healthyyworkout.com
quickyfunds.com
sevenadvertising.com
helikoptervluchtnewyork.nl
kojima-shihou.com
fibrofolliculoma.info
prochain-voyage.net
mrxermon.de
transportesycementoshidalgo.es
newstap.com.ng
boisehosting.net
pivoineetc.fr
precisionbevel.com
caffeinternet.it
petnest.ir
apprendrelaudit.com
comparatif-lave-linge.fr
mdk-mediadesign.de
wolf-glas-und-kunst.de
burkert-ideenreich.de
crediacces.com
veybachcenter.de
navyfederalautooverseas.com
daklesa.de
babcockchurch.org
space.ua
delawarecorporatelaw.com
ligiercenter-sachsen.de
jorgobe.at
eaglemeetstiger.de
iwr.nl
answerstest.ru
darrenkeslerministries.com
parks-nuernberg.de
starsarecircular.org
homng.net
pay4essays.net
ncid.bc.ca
aodaichandung.com
luxurytv.jp
winrace.no
pmc-services.de
highlinesouthasc.com
hokagestore.com
architecturalfiberglass.org
alten-mebel63.ru
purposeadvisorsolutions.com
spargel-kochen.de
latestmodsapks.com
ulyssemarketing.com
i-trust.dk
almosthomedogrescue.dog
durganews.com
dushka.ua
reddysbakery.com
modestmanagement.com
levihotelspa.fi
vickiegrayimages.com
chandlerpd.com
candyhouseusa.com
bafuncs.org
daniel-akermann-architektur-und-planung.ch
aco-media.nl
autodemontagenijmegen.nl
sagadc.com
norpol-yachting.com
stacyloeb.com
kindersitze-vergleich.de
thedad.com
jandaonline.com
euro-trend.pl
cyntox.com
apolomarcas.com
cuspdental.com
mytechnoway.com
brawnmediany.com
lefumetdesdombes.com
jsfg.com
dlc.berlin
iyahayki.nl
outcomeisincome.com
celularity.com
philippedebroca.com
lykkeliv.net
stoeferlehalle.de
cuppacap.com
symphonyenvironmental.com
bigasgrup.com
craigvalentineacademy.com
layrshift.eu
huissier-creteil.com
stoeberstuuv.de
cafemattmeera.com
micahkoleoso.de
lynsayshepherd.co.uk
bimnapratica.com
gmto.fr
marcuswhitten.site
iqbalscientific.com
loprus.pl
humanityplus.org
streamerzradio1.site
pocket-opera.de
centuryrs.com
psc.de
knowledgemuseumbd.com
malychanieruchomoscipremium.com
groupe-frayssinet.fr
insp.bi
kojinsaisei.info
zzyjtsgls.com
jiloc.com
tandartspraktijkhartjegroningen.nl
lorenacarnero.com
mediaacademy-iraq.org
pointos.com
drfoyle.com
accountancywijchen.nl
ctrler.cn
kisplanning.com.au
logopaedie-blomberg.de
mir-na-iznanku.com
associationanalytics.com
sachnendoc.com
jvanvlietdichter.nl
smalltownideamill.wordpress.com
vitalyscenter.es
seevilla-dr-sturm.at
comarenterprises.com
artige.com
insidegarage.pl
n1-headache.com
haremnick.com
lapinlviasennus.fi
tanzprojekt.com
sporthamper.com
remcakram.com
drugdevice.org
blogdecachorros.com
faizanullah.com
andersongilmour.co.uk
ditog.fr
marietteaernoudts.nl
pomodori-pizzeria.de
dpo-as-a-service.com
abuelos.com
rocketccw.com
global-kids.info
bradynursery.com
blgr.be
lmtprovisions.com
servicegsm.net
mooglee.com
renergysolution.com
makeurvoiceheard.com
devstyle.org
happyeasterimages.org
foretprivee.ca
yamalevents.com
fizzl.ru
jyzdesign.com
kalkulator-oszczednosci.pl
evergreen-fishing.com
jenniferandersonwriter.com
controldekk.com
shiresresidential.com
spylista.com
mardenherefordshire-pc.gov.uk
talentwunder.com
xn--thucmctc-13a1357egba.com
nicoleaeschbachorg.wordpress.com
interactcenter.org
quemargrasa.net
easytrans.com.au
mezhdu-delom.ru
vanswigchemdesign.com
parkstreetauto.net
galserwis.pl
lescomtesdemean.be
atalent.fi
lillegrandpalais.com
fundaciongregal.org
leather-factory.co.jp
sarbatkhalsafoundation.org
izzi360.com
fotoscondron.com
julis-lsa.de
rafaut.com
trackyourconstruction.com
oslomf.no
spd-ehningen.de
nachhilfe-unterricht.com
mbxvii.com
321play.com.hk
lukeshepley.wordpress.com
binder-buerotechnik.at
selfoutlet.com
xn--vrftet-pua.biz
lucidinvestbank.com
all-turtles.com
stormwall.se
pridoxmaterieel.nl
filmvideoweb.com
spinheal.ru
lebellevue.fr
testzandbakmetmening.online
8449nohate.org
aurum-juweliere.de
urclan.net
coding-marking.com
-
net
true
-
pid
$2a$10$SlLR2WWgiOxrDQLqdHYA/Or5zeu.wNuMGc5rN/HHrIObc1EkKCIZa
-
prc
agntsvc
wordpad
onenote
mydesktopqos
mydesktopservice
thunderbird
winword
excel
visio
isqlplussvc
dbeng50
encsvc
steam
mspub
firefox
outlook
dbsnmp
ocautoupds
xfssvccon
tbirdconfig
msaccess
ocomm
sqbcoreservice
sql
ocssd
oracle
infopath
synctime
thebat
powerpnt
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
3181
-
svc
svc$
backup
vss
sophos
memtas
sql
mepocs
veeam
Extracted
C:\Users\69r5t5847-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0E049F2593381959
http://decryptor.cc/0E049F2593381959
Extracted
C:\Users\324r52k7-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/082B4BBB7D859F3D
http://decryptor.cc/082B4BBB7D859F3D
Targets
-
-
Target
42a2e208bc7721348699212bc5cf50e5_JaffaCakes118
-
Size
222KB
-
MD5
42a2e208bc7721348699212bc5cf50e5
-
SHA1
15934add1f6f10bc50daa707bf8d02bb62edbdf7
-
SHA256
d186adf9bf8ae0b9759a2836f94597d6832f076bd03de9886181be53183d25de
-
SHA512
2549f5273ea6120dc18a97c1f59324e6e5696b15bf7f56a5c22c4d1c461fd6da200272aa58529b42a8e2ce6e8c8b1298030b38298bed9194b26882be8cb8cebb
-
SSDEEP
3072:sr85CIyyTsnAdu5tjgn/RRKwkwvMT3QE4f07YouoFhiLFrb30BRtBZZg+i2T:k9nyTsnXToKJw4gEWpoFuJ0BXScT
-
Detect Neshta payload
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies system executable filetype association
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Defense Evasion
Modify Registry
4Subvert Trust Controls
1Install Root Certificate
1