Behavioral task
behavioral1
Sample
aad705e43f95a736d120d1a8cda30519_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
aad705e43f95a736d120d1a8cda30519_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
aad705e43f95a736d120d1a8cda30519_JaffaCakes118
-
Size
164KB
-
MD5
aad705e43f95a736d120d1a8cda30519
-
SHA1
be7106e9066e12276d0e1c3504eb5d46a6edb296
-
SHA256
a801a78613cbf86186b524c19f7631a5e4571e94a63df867635602624643d362
-
SHA512
455ce98a3e3c5c4be3a1c5fc0239467e0447049e218eb3175814246cedc042bebf4bf66bd90393f544d22e75975fadca17bceb7985af7c7591a8936be1c713f4
-
SSDEEP
1536:bs2B7p26CaItF5gNHhKWluLpWmRHICS4AH3o/qTneyW7ZZOBml2uBbKbxoVgAy6o:9fg0NBlu9CNTed7/kBazzFbULA90kY8
Malware Config
Extracted
sodinokibi
5
983
casinodepositors.com
zaczytana.com
wineandgo.hu
khtrx.com
drbrianhweeks.com
scholarquotes.com
altocontatto.net
charlesfrancis.photos
pinthelook.com
chatberlin.de
fotoeditores.com
housesofwa.com
pubcon.com
turing.academy
elliemaccreative.wordpress.com
billscars.net
rozmata.com
azloans.com
agencewho-aixenprovence.fr
ziliak.com
janasfokus.com
betterce.com
happylublog.wordpress.com
dayenne-styling.nl
lexced.com
theboardroomafrica.com
mediabolmong.com
palmenhaus-erfurt.de
skyscanner.ro
globalskills.pt
dierenambulancealkmaar.nl
1deals.com
tweedekansenloket.nl
thesilkroadny.com
bayshoreelite.com
zinnystar.com
christianscholz.de
goodherbalhealth.com
mamajenedesigns.com
kickittickets.com
lumturo.academy
basindentistry.com
wribrazil.com
veggienessa.com
forskolinslimeffect.net
k-v-f.de
amyandzac.com
mundo-pieces-auto.fr
marcandy.com
afbudsrejserallinclusive.dk
olry-cloisons.fr
yourcosmicbeing.com
citiscapes-art.com
dogsunlimitedguide.com
magrinya.net
skidpiping.de
pokemonturkiye.com
sycamoregreenapts.com
csaballoons.com
electricianul.com
luvbec.com
mediahub.co.nz
digitale-elite.de
glas-kuck.de
phoenixcrane.com
premiumweb.com.ua:443
sochi-okna23.ru
peppergreenfarmcatering.com.au
baita.ac
peninggibadan.co.id
soncini.ch
evsynthacademy.org
gosouldeep.com
photographycreativity.co.uk
newonestop.com
schlagbohrmaschinetests.com
transifer.fr
jandhpest.com
alene.co
avis.mantova.it
mind2muscle.nl
sellthewrightway.com
ruggestar.ch
datatri.be
specialtyhomeservicesllc.com
martinipstudios.com
brannbornfastigheter.se
eastgrinsteadwingchun.com
mangimirossana.it
foerderverein-vatterschule.de
eurethicsport.eu
loparnille.se
karelinjames.com
theater-lueneburg.de
mollymccarthydesign.com
drvoip.com
ciga-france.fr
medicalsupportco.com
ahgarage.com
lassocrm.com
jdscenter.com
pxsrl.it
morgansconsult.com
bodet150ans.com
eshop.design
aciscomputers.com
diverfiestas.com.es
fla.se
yvesdoin-aquarelles.fr
proffteplo.com
projektparkiet.pl
cookinn.nl
ykobbqchicken.ca
zealcon.ae
legundschiess.de
piestar.com
redctei.co
fi-institutionalfunds.com
vapiano.fr
frankgoll.com
cmascd.com
graygreenbiomedservices.com
motocrossplace.co.uk
alaskaremote.com
aidanpublishing.co.uk
buonabitare.com
diakonie-weitramsdorf-sesslach.de
pureelements.nl
koncept-m.ru
acornishstudio.co.uk
frameshift.it
vitoriaecoturismo.com.br
levencovka.ru
witraz.pl
markseymourphotography.co.uk
bychowo.pl
lovcase.com
schroederschoembs.com
signededenroth.dk
livedeveloper.com
oro.ae
mensemetgesigte.co.za
perfectgrin.com
blueridgeheritage.com
mariajosediazdemera.com
rhino-storage.co.uk
metcalfe.ca
prodentalblue.com
gsconcretecoatings.com
aktivfriskcenter.se
gatlinburgcottage.com
jollity.hu
rossomattonecase.it
hospitalitytrainingsolutions.co.uk
ijsselbeton.nl
advanced-removals.co.uk
concontactodirecto.com
matthieupetel.fr
ledyoucan.com
texanscan.org
stressreliefadvice.com
die-immo-agentur.de
fridakids.com
stabilisateur.fr
elex.is
thiagoperez.com
keuken-prijs.nl
bruut.online
happycatering.de
johnsonweekly.com
ddmgen.com
loysonbryan.com
kroophold-sjaelland.dk
t3brothers.com
iron-mine.ru
geoweb.software
glennverschueren.be
scietech.academy
condormobile.fr
cormanmarketing.com
g2mediainc.com
paprikapod.com
grancanariaregional.com
innovationgames-brabant.nl
sbit.ag
boyfriendsgoal.site
azerbaycanas.com
airvapourbarrier.com
rentingwell.com
hvitfeldt.dk
tilldeeke.de
phukienbepthanhdat.com
thenalpa.com
eafx.pro
voice2biz.com
direitapernambuco.com
vipcarrental.ae
maxcube24.com.ua
simpleitsolutions.ch
distrifresh.com
letsstopsmoking.co.uk
patassociation.com
beandrivingschool.com.au
pinkxgayvideoawards.com
rubyaudiology.com
thisprettyhair.com
haus-landliebe.de
domilivefurniture.com
cymru.futbol
hinotruckwreckers.com.au
jmmartinezilustrador.com
trainiumacademy.com
oncarrot.com
limounie.com
galatee-couture.com
nevadaruralhousingstudies.org
eksperdanismanlik.com
tellthebell.website
jimprattmediations.com
bourchier.org
mercadodelrio.com
drnelsonpediatrics.com
universelle.fr
dcc-eu.com
lollachiro.com
spectamarketingdigital.com.br
hotelturbo.de
descargandoprogramas.com
zumrutkuyutemel.com
mac-computer-support-hamburg.de
theatre-embellie.fr
xn--billigafrgpatroner-stb.se
pourlabretagne.bzh
111firstdelray.com
chris-anne.com
michal-s.co.il
subquercy.fr
go.labibini.ch
floweringsun.org
acumenconsultingcompany.com
marmarabasin.com
the3-week-diet.net
terraflair.de
andermattswisswatches.ch
queertube.net
modamarfil.com
jobstomoveamerica.org
scotlandsroute66.co.uk
finnergo.eu
carmel-york.com
boloria.de
hnkns.com
bratek-immobilien.de
satoblog.org
jag.me
valiant-voice.com
irizar.com
mike.matthies.de
agendatwentytwenty.com
apogeeconseils.fr
smartspeak.com
innersurrection.com
carsten.sparen-it.de
wrinstitute.org
fsbforsale.com
hensleymarketing.com
bcmets.info
bellesiniacademy.org
lagschools.ng
eatyoveges.com
forextimes.ru
omegamarbella.com
omnicademy.com
mustangmarketinggroup.com
asiaartgallery.jp
miscbo.it
thegrinningmanmusical.com
landgoedspica.nl
3daywebs.com
spacebel.be
enews-qca.com
makingmillionaires.net
autoteamlast.de
spirello.nl
o90.dk
ronielyn.com
belinda.af
sealgrinderpt.com
ramirezprono.com
tramadolhealth.com
business-basic.de
wasnederland.nl
ivancacu.com
globalcompliancenews.com
aoyama.ac
otpusk.zp.ua
mazzaropi.com.br
dmlcpa.com
carolynfriedlander.com
jeanmonti.com
eventosvirtualesexitosos.com
supercarhire.co.uk
janmorgenstern.com
beauty-traveller.com
parentsandkids.com
kenmccallum.com
mursall.de
adabible.org
lyricalduniya.com
professionetata.com
startuplive.org
animalfood-online.de
johnstonmingmanning.com
salonlamar.nl
claudiakilian.de
trivselsguide.dk
muller.nl
physio-lang.de
bluetenreich-brilon.de
tzn.nu
drbenveniste.com
qwikcoach.com
ufovidmag.com
aquacheck.co.za
zdrowieszczecin.pl
encounter-p.net
liepertgrafikweb.at
gratiocafeblog.wordpress.com
aslog.fr
epicjapanart.com
yournextshoes.com
kiraribeaute-nani.com
xn--80abehgab4ak0ddz.xn--p1ai
maryairbnb.wordpress.com
xn--80addfr4ahr.dp.ua
nauticmarine.dk
kellengatton.com
mrmac.com
edrickennedymacfoy.com
techybash.com
triplettagaite.fr
cainlaw-okc.com
kdbrh.com
clinic-beethovenstrasse-ag.ch
voetbalhoogeveen.nl
margaretmcshane.com
monstarrsoccer.com
dantreranch.com
elitkeramika-shop.com.ua
nrgvalue.com
nationnewsroom.com
manzel.tn
fysiotherapierijnmond.nl
skinkeeper.li
babysitting-hk.helpergo.co
humanviruses.org
premier-iowa.com
brinkdoepke.eu
therapybusinessacademy.com
aheadloftladders.co.uk
malevannye.ru
sachainchiuk.com
baumfinancialservices.com
citydogslife.com
parksideseniorliving.net
druktemakersheerenveen.nl
bundan.com
istantidigitali.com
ikadomus.com
jefersonalessandro.com
wordpress.idium.no
nutriwell.com.sg
liverpoolabudhabi.ae
walterman.es
jayfurnitureco.com
opticahubertruiz.com
wg-heiligenstadt.de
denverwynkoopdentist.com
secrets-clubs.co.uk
vitormmcosta.com
prometeyagro.com.ua
a-zpaperwork.eu
11.in.ua
trevi-vl.ru
duthler.nl
tchernia-conseil.fr
tutvracks.com
teutoradio.de
adaduga.info
motocrosshideout.com
chorusconsulting.net
test-teleachat.fr
richardkershawwines.co.za
auberives-sur-vareze.fr
atrgroup.it
dinedrinkdetroit.com
artvark.nl
pansionatblago.ru
directique.com
jobscore.com
kausette.com
tradenavigator.ch
vdolg24.online
sber-biznes.com
narca.net
energosbit-rp.ru
fazagostar.co
xn--ziinoapte-6ld.ro
thestudio.academy
annida.it
innervisions-id.com
tothebackofthemoon.com
midwestschool.org
randyabrown.com
riffenmattgarage.ch
oraweb.net
web865.com
belofloripa.be
blavait.fr
justaroundthecornerpetsit.com
atelierkomon.com
fire-space.com
delegationhub.com
bertbutter.nl
pajagus.fr
licensed-public-adjuster.com
pazarspor.org.tr
chatterchatterchatter.com
awaisghauri.com
affligemsehondenschool.be
bd2fly.com
four-ways.com
agora-collectivites.com
osn.ro
biketruck.de
mjk.digital
solutionshosting.co.uk
stoneridgemontessori.com
axisoflove.org:443
catering.com
c-sprop.com
finsahome.co.uk
keyboardjournal.com
zorgboerderijravensbosch.nl
palmecophilippines.com
bohrlochversicherung.info
cp-bap.de
ceocenters.com
bmw-i-pure-impulse.com
advancedeyecare.com
linkbuilding.life
placermonticello.com
kombi-dress.com
jlgraphisme.fr
dnqa.co.uk
bjornvanvulpen.nl
mrkluttz.com
juergenblaetz.de
onesynergyinternational.com
altitudeboise.com
ketomealprep.academy
block-optic.com
birthplacemag.com
forumsittard.nl
anchelor.com
hawthornsretirement.co.uk
netadultere.fr
jax-interim-and-projectmanagement.com
latteswithleslie.com
allinonecampaign.com
guohedd.com
computer-place.de
topvijesti.net
jaaphoekzema.nl
silverbird.dk
ygallerysalonsoho.com:443
mesajjongeren.nl
ox-home.com
kerstliedjeszingen.nl
ncjc.ca
daveystownhouse.com
mariannelemenestrel.com
billyoart.com
enactusnhlstenden.com
janellrardon.com
polynine.com
donau-guides.eu
patriotcleaning.net
magnetvisual.com
amelielecompte.wordpress.com
slotenmakerszwijndrecht.nl
global-migrate.com
littlesaints.academy
mindfuelers.com
naukaip.ru
nexstagefinancial.com
testitjavertailut.net
handyman-silkeborg.dk
karmeliterviertel.com
natturestaurante.com.br
kookooo.com
oththukaruva.com
mariamalmahdi.com
purepreprod4.com
advance-refle.com
advesa.com
ravage-webzine.nl
nuohous.com
nxtstg.org
studionumerik.fr
golfclublandgoednieuwkerk.nl
sveneulberg.de
kafkacare.com
invela.dk
brighthillgroup.com
selected-minds.de
circuit-diagramz.com
benchbiz.com
reygroup.pt
m2graph.fr
hom-frisor.dk
myfbateam.com
pixelhealth.net
rename.kz
bendel-partner.de
airserviceunlimited.com
bodymindchallenger.com
p-ride.live
designimage.ae
parseport.com
fascaonline.com
dieetuniversiteit.nl
bavovrienden.nl
endstarvation.com
sweetz.fr
artcase.pl
unexplored.gr
rechtenplicht.be
alattekniksipil.com
agriturismocastagneto.it
abulanov.com
silkeight.com
kristianboennelykke.dk
unboxtherapy.site
expohomes.com
larchwoodmarketing.com
greatofficespaces.net
mindsparkescape.com
lisa-poncon.fr
martha-frets-ceramics.nl
groovedealers.ru
nourella.com
dreamvoiceclub.org
richardiv.com
dr-vita.de
hekecrm.com
rattanwarehouse.co.uk
dibli.store
wademurray.com
dentalcircle.com
grafikstudio-visuell.de
buzzneakers.com
moira-cristescu.com
gazelle-du-web.com
laylavalentine.com
yuanshenghotel.com
logosindustries.com
springfieldplumbermo.com
nepressurecleaning.com
bookingwheel.com
opt4cdi.com
ilveshistoria.com
espaciopolitica.com
aberdeenartwalk.org
jlwilsonbooks.com
holocine.de
kryddersnapsen.dk
brisbaneosteopathic.com.au
teethinadaydentalimplants.com
rapid5kloan.org
matteoruzzaofficial.com
leopoldineroux.com
traitware.com
cleanroomequipment.ie
amorbellezaysalud.com
arazi.eus
saberconcrete.com
hostastay.com
thehovecounsellingpractice.co.uk
banukumbak.com
akcadagofis.com
agrifarm.dk
alpesiberie.com
imaginekithomes.co.nz
acb-gruppe.ch
iexpert99.com
richardmaybury.co.uk
stathmoulis.gr
breathebettertolivebetter.com
denhaagfoodie.nl
bulyginnikitav.000webhostapp.com
stanleyqualitysystems.com
xtensifi.com
renehartman.nl
cac2040.com
taulunkartano.fi
epsondriversforwindows.com
alexwenzel.de
palema.gr
bonitabeachassociation.com
so-sage.fr
metallbau-hartmann.eu
insane.agency
alwaysdc.com
sshomme.com
precisetemp.com
vedsegaard.dk
imagine-entertainment.com
onlinetvgroup.com
awag-blog.de
ced-elec.com
centuryvisionglobal.com
molinum.pt
cssp-mediation.org
cuadc.org
astrographic.com
devplus.be
ronaldhendriks.nl
powershell.su
rino-gmbh.com
suitesartemis.gr
oportowebdesign.com
bajova.sk
efficiencyconsulting.es
curtsdiscountguns.com
unislaw-narty.pl
rhino-turf.com
volta.plus
reizenmetkinderen.be
switch-made.com
lapponiasafaris.com
from02pro.com
watchsale.biz
eyedoctordallas.com
jacquesgarcianoto.com
futurenetworking.com
billigeflybilletter.dk
bubbalucious.com
verbouwingsdouche.nl
entdoctor-durban.com
nalliasmali.net
antesacademy.it
klapanvent.ru
clemenfoto.dk
webforsites.com
campinglaforetdetesse.com
stralsund-ansichten.de
relevantonline.eu
tetameble.pl
fta-media.com
andreaskildegaard.dk
activeterroristwarningcompany.com
bagaholics.in
breakluckrecords.com
hutchstyle.co.uk
onlinemarketingsurgery.co.uk
alharsunindo.com
arabianmice.com
tesisatonarim.com
heuvelland-oaze.nl
alisodentalcare.com
protoplay.ca
baikalflot.ru
metriplica.academy
werkzeugtrolley.net
production-stills.co.uk
ingresosextras.online
slideevents.be
sambaglow.com
funworx.de
cascinarosa33.it
avisioninthedesert.com
devus.de
wallflowersandrakes.com
penumbuhrambutkeiskei.com
mahikuchen.com
sharonalbrightdds.com
envomask.com
apmollerpension.com
smartercashsystem.com
campusce.com
santastoy.store
min-virksomhed.dk
saboboxtel.uk
bluelakevision.com
5pointpt.com
burg-zelem.de
subyard.com
krishnabrawijaya.com
adedesign.com
mikegoodfellow.co.uk
line-x.co.uk
publicompserver.de
ya-elka.ru
acibademmobil.com.tr
racefietsenblog.nl
banksrl.co.za
chainofhopeeurope.eu
mgimalta.com
fann.ru
site.markkit.com.br
lsngroupe.com
der-stempelking.de
yayasanprimaunggul.org
ninjaki.com
nbva.co.uk
nicksrock.com
tecleados.com
b3b.ch
bakingismyyoga.com
deduktia.fi
hepishopping.com
myplaywin3.com
sytzedevries.com
liveyourheartout.co
crestgood.com
jakubrybak.com
fidelitytitleoregon.com
lesyeuxbleus.net
napisat-pismo-gubernatoru.ru:443
lookandseen.com
mazift.dk
lattalvor.com
mieleshopping.it
goddardleadership.org
circlecitydj.com
albcleaner.fr
ntinasfiloxenia.gr
furland.ru
fluzfluzrewards.com
neonodi.be
nykfdyrehospital.dk
indiebizadvocates.org
wyreforest.net
askstaffing.com
sarahspics.co.uk
stagefxinc.com
cardsandloyalty.com
zwemofficial.nl
factorywizuk.com
perceptdecor.com
redpebblephotography.com
buerocenter-butzbach-werbemittel.de
rtc24.com
pro-gamer.pl
jameswilliamspainting.com
itheroes.dk
arearugcleaningnyc.com
cincinnatiphotocompany.org
bridalcave.com
ebible.co
explora.nl
fotoslubna.com
kamin-somnium.de
craftron.com
ikzoekgod.be
chinowarehousespace.com
wirmuessenreden.com
orchardbrickwork.com
rsidesigns.com
bg.szczecin.pl
mrcar.nl
optigas.com
initconf.com
hameghlim.com
stringnosis.academy
ideamode.com
endlessrealms.net
weddingceremonieswithtim.com
thepixelfairy.com
log-barn.co.uk
dentallabor-luenen.de
renderbox.ch
baptistdistinctives.org
qandmmusiccenter.com
utilisacteur.fr
hm-com.com
pedmanson.com
awaitspain.com
xrresources.com
lgiwines.com
coachpreneuracademy.com
leloupblanc.gr
tieronechic.com
gta-jjb.fr
smartworkplaza.com
topautoinsurers.net
alcye.com
slotspinner.com
radishallgood.com
kosten-vochtbestrijding.be
masecologicos.com
gardenpartner.pl
ocduiblog.com
victorvictoria.com
hypogenforensic.com
kelsigordon.com
alabamaroofingllc.com
pilotgreen.com
jobkiwi.com.ng
agenceassemble.fr
alltagsrassismus-entknoten.de
parisschool.ru
ilovefullcircle.com
skyboundnutrition.co.uk
atma.nl
arthakapitalforvaltning.dk
cotton-avenue.co.il
pays-saint-flour.fr
lovetzuchia.com
towelroot.co
linearete.com
mayprogulka.ru
internalresults.com
nepal-pictures.com
pisofare.co
paradigmlandscape.com
domaine-des-pothiers.com
louiedager.com
skolaprome.eu
sprintcoach.com
outstandingminialbums.com
toranjtuition.org
reputation-medical.online
avtoboss163.ru:443
buffdaddyblog.com
leansupremegarcinia.net
dentourage.com
gaearoyals.com
husetsanitas.dk
craftingalegacy.com
anleggsregisteret.no
collegetennis.info
interlinkone.com
signamedia.de
tastevirginia.com
look.academy
sunsolutions.es
girlish.ae
johnkoen.com
apiarista.de
ayudaespiritualtamara.com
corporacionrr.com
dennisverschuur.com
heimdalbygg.no
primemarineengineering.com
triavlete.com
raeoflightmusic.com
poems-for-the-soul.ch
rivermusic.nl
cesep2019.com
photonag.com
zuerich-umzug.ch
ludoil.it
rvside.com
90nguyentuan.com
limmortelyouth.com
schulz-moelln.de
promus.ca
teamsegeln.ch
soundseeing.net
k-zubki.ru
cap29010.it
levelseven.be
harleystreetspineclinic.com
hotjapaneselesbian.com
latableacrepes-meaux.fr
rizplakatjaya.com
augen-praxisklinik-rostock.de
imajyuku-sozoku.com
flossmoordental.com
angeleyezstripclub.com
amco.net.au
geitoniatonaggelon.gr
n-newmedia.de
barbaramcfadyenjewelry.com
whoopingcrane.com
mslp.org
inewsstar.com
the5thquestion.com
kvetymichalovce.sk
leijstrom.com
cyberpromote.de
2020hindsight.info
kompresory-opravy.com
creohn.de
tages-geldvergleich.de
galaniuklaw.com
achetrabalhos.com
hartofurniture.com
jalkapuu.net
cc-experts.de
hiddensee-buhne11.de
bilius.dk
vvego.com
kryptos72.com
jglconsultancy.com
dinecorp.com
quitescorting.com
pvandambv.nl
neolaiamedispa.com
rishigangoly.com
nginx.com
leatherjees.com
gavelmasters.com
mneti.ru
ultimatelifesource.com
brownswoodblog.com
egpu.fr
tbalp.co.uk
blucamp.com
campusescalade.com
successcolony.com.ng
saint-malo-developpement.fr
thegetawaycollective.com
annenymus.com
lidkopingsnytt.nu
kartuindonesia.com
paardcentraal.nl
the-cupboard.co.uk
catchup-mag.com
speiserei-hannover.de
profibersan.com
theintellect.edu.pk
lifeinbreaths.com
eos-horlogerie.com
tanatek.com
triplettabordeaux.fr
rolleepollee.com
the-beauty-guides.com
speakaudible.com
broccolisoep.nl
factoriareloj.com
qrs-international.com
catalyseurdetransformation.com
cxcompany.com
nieuwsindeklas.be
gbk-tp1.de
metroton.ru
ownidentity.com
biblica.com
uci-france.fr
o2o-academy.com
rarefoods.ro
suonenjoen.fi
oscommunity.de
craftstone.co.nz
schluesseldienste-hannover.de
lunoluno.com
tatyanakopieva.ru
animation-pro.co.uk
memphishealthandwellness.com
hawaiisteelbuilding.com
bescomedical.de
goeppinger-teppichreinigung.de
angelsmirrorus.com
smarttourism.academy
malzomattalar.com
cl0nazepamblog.com
smartmind.net
sjtpo.org
skooppi.fi
stitch-n-bitch.com
easydental.ae
julielusktherapy.com
docarefoundation.org
mondolandscapes.com
bumbipdeco.site
hoteltantra.com
lashandbrowenvy.com
edvestors.org
almamidwifery.com
christopherhannan.com
9nar.com
welovecustomers.fr
shortysspices.com
shortsalemap.com
framemyballs.com
pankiss.ru
oexebusiness.com
etgdogz.de
aceroprime.com
akwaba-safaris.com
solidhosting.nl
customroasts.com
kuriero.pro
scentedlair.com
fixx-repair.com
nvisionsigns.com
fbmagazine.ru
cmeow.com
bluemarinefoundation.com
strauchs-wanderlust.info
pharmeko-group.com
livelai.com
sololibrerie.it
mbuildinghomes.com
comoserescritor.com
sppdstats.com
bringmehope.org
spartamovers.com
bcabattoirs.org
alnectus.com
lmmont.sk
molade.nl
muni.pe
davedavisphotos.com
iactechnologies.net
focuskontur.com
plbinsurance.com
adterium.com
gurutechnologies.net
haard-totaal.nl
brunoimmobilier.com
georgemuncey.com
rokthetalk.com
yourhappyevents.fr
leadforensics.com
letterscan.de
noda.com.ua
biodentify.ai
skoczynski.eu
glende-pflanzenparadies.de
singletonfinancial.com
greenrider.nl
jonnyhooley.com
goodboyscustom.com
rentsportsequip.com
mediogiro.com.ar
luvinsburger.fr
operativadigital.com
hostingbangladesh.net
boomerslivinglively.com
internestdigital.com
katherinealy.com
rs-danmark.dk
deziplan.ru
hostaletdelsindians.es
stage-infirmier.fr
angelika-schwarz.com
kemtron.fr
ncn.nl
profiz.com
andrealuchesi.it
fitnessblenderstory.com
auto-opel.ro
uncensoredhentaigif.com
berdonllp.com
laaisterplakky.nl
grupoexin10.com
charlottelhanna.com
frimec-international.es
greeneyetattoo.com
fskhjalmar.se
fanuli.com.au
putzen-reinigen.com
worldproskitour.com
michaelfiegel.com
chomiksy.net
5thactors.com
shrinkingplanet.com
cops4causes.org
colored-shelves.com
-
net
true
-
pid
5
-
prc
winword
dbsnmp
onenote
oracle
powerpnt
infopath
wordpa
dbeng50
excel
ocomm
sqbcoreservice
mydesktopqos
encsvc
isqlplussvc
outlook
thebat
msaccess
ocautoupds
ocssd
agntsvc
thunderbird
steam
tbirdconfig
firefox
mspub
mydesktopservice
synctime
sql
xfssvccon
visio
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
983
-
svc
mepocs
svc$
backup
sophos
memtas
veeam
vss
sql
Signatures
-
Sodinokibi family
-
Sodinokibi/Revil sample 1 IoCs
resource yara_rule sample family_sodinokobi -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource aad705e43f95a736d120d1a8cda30519_JaffaCakes118
Files
-
aad705e43f95a736d120d1a8cda30519_JaffaCakes118.exe windows:5 windows x86 arch:x86
c88f20b29592f2107a629e815db6afae
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetErrorMode
Sections
.text Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 57KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.wtq999 Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ