General
-
Target
b63bf2e4a6a0bc89f8375aa0f6672cea_JaffaCakes118
-
Size
164KB
-
Sample
240617-b6cwqasgmk
-
MD5
b63bf2e4a6a0bc89f8375aa0f6672cea
-
SHA1
2c2ec58749b66d1814f27cbc3e8d845a3e7866fc
-
SHA256
3ea8f71bfb79e6547788eb5f2718d8cfc31fe6d99e15e6a8062406aedfcdfa90
-
SHA512
92a96ab7d0e7add812c49013ffc66a4f168becebdd68cf867c7d2655bcf6f2a0bcf1f78199b24b4741d0a832387eeb15ba9ae3c5e3fb0ddcc943e1e084145948
-
SSDEEP
3072:FHixaVZFiOCDJtOicNDWEzZthCcHR6I2qB:FHigLF5CCj5zZt7D
Behavioral task
behavioral1
Sample
b63bf2e4a6a0bc89f8375aa0f6672cea_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b63bf2e4a6a0bc89f8375aa0f6672cea_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
sodinokibi
19
36
cap29010.it
marcandy.com
johnstonmingmanning.com
racefietsenblog.nl
kvetymichalovce.sk
outstandingminialbums.com
ebible.co
napisat-pismo-gubernatoru.ru:443
mrkluttz.com
albcleaner.fr
smartworkplaza.com
m2graph.fr
rechtenplicht.be
tchernia-conseil.fr
breathebettertolivebetter.com
inewsstar.com
nginx.com
blueridgeheritage.com
banukumbak.com
fta-media.com
fbmagazine.ru
justaroundthecornerpetsit.com
transifer.fr
oncarrot.com
sellthewrightway.com
jobstomoveamerica.org
angelsmirrorus.com
devplus.be
schulz-moelln.de
mbuildinghomes.com
studionumerik.fr
mamajenedesigns.com
eshop.design
gazelle-du-web.com
fluzfluzrewards.com
kiraribeaute-nani.com
littlesaints.academy
baptistdistinctives.org
hospitalitytrainingsolutions.co.uk
elitkeramika-shop.com.ua
saboboxtel.uk
auto-opel.ro
dinedrinkdetroit.com
davedavisphotos.com
wademurray.com
block-optic.com
nauticmarine.dk
vipcarrental.ae
morgansconsult.com
gbk-tp1.de
orchardbrickwork.com
husetsanitas.dk
fann.ru
pixelhealth.net
direitapernambuco.com
mensemetgesigte.co.za
kristianboennelykke.dk
sycamoregreenapts.com
rokthetalk.com
rubyaudiology.com
centuryvisionglobal.com
eastgrinsteadwingchun.com
concontactodirecto.com
christopherhannan.com
signamedia.de
ideamode.com
ziliak.com
tutvracks.com
riffenmattgarage.ch
letterscan.de
girlish.ae
slotspinner.com
craftingalegacy.com
traitware.com
nvisionsigns.com
envomask.com
yuanshenghotel.com
stanleyqualitysystems.com
wribrazil.com
werkzeugtrolley.net
blavait.fr
jalkapuu.net
eatyoveges.com
jefersonalessandro.com
tellthebell.website
four-ways.com
g2mediainc.com
nalliasmali.net
aoyama.ac
wyreforest.net
primemarineengineering.com
andermattswisswatches.ch
from02pro.com
ya-elka.ru
jakubrybak.com
alattekniksipil.com
liveyourheartout.co
latteswithleslie.com
stathmoulis.gr
bourchier.org
brannbornfastigheter.se
fsbforsale.com
goodboyscustom.com
ikadomus.com
sambaglow.com
kamin-somnium.de
arazi.eus
stitch-n-bitch.com
sachainchiuk.com
grafikstudio-visuell.de
boyfriendsgoal.site
buffdaddyblog.com
rvside.com
t3brothers.com
ruggestar.ch
metroton.ru
abulanov.com
mariamalmahdi.com
augen-praxisklinik-rostock.de
hensleymarketing.com
startuplive.org
magnetvisual.com
drbenveniste.com
simpleitsolutions.ch
cssp-mediation.org
rishigangoly.com
fi-institutionalfunds.com
scholarquotes.com
hutchstyle.co.uk
skoczynski.eu
frimec-international.es
reygroup.pt
cardsandloyalty.com
production-stills.co.uk
ykobbqchicken.ca
mahikuchen.com
oportowebdesign.com
akcadagofis.com
subyard.com
citiscapes-art.com
newonestop.com
advance-refle.com
anleggsregisteret.no
bookingwheel.com
mslp.org
selected-minds.de
adterium.com
thegetawaycollective.com
endlessrealms.net
yourcosmicbeing.com
voice2biz.com
mursall.de
hostastay.com
palmecophilippines.com
myplaywin3.com
schroederschoembs.com
georgemuncey.com
benchbiz.com
asiaartgallery.jp
jglconsultancy.com
breakluckrecords.com
bakingismyyoga.com
hoteltantra.com
pureelements.nl
unexplored.gr
legundschiess.de
pharmeko-group.com
carsten.sparen-it.de
dnqa.co.uk
rs-danmark.dk
specialtyhomeservicesllc.com
smartercashsystem.com
gratiocafeblog.wordpress.com
silkeight.com
rarefoods.ro
chomiksy.net
vitormmcosta.com
brisbaneosteopathic.com.au
phukienbepthanhdat.com
ox-home.com
latableacrepes-meaux.fr
texanscan.org
amyandzac.com
adabible.org
lovetzuchia.com
boloria.de
spirello.nl
richardmaybury.co.uk
indiebizadvocates.org
almamidwifery.com
christianscholz.de
mindfuelers.com
rentsportsequip.com
n-newmedia.de
licensed-public-adjuster.com
nieuwsindeklas.be
wasnederland.nl
grupoexin10.com
blucamp.com
skidpiping.de
neolaiamedispa.com
victorvictoria.com
photographycreativity.co.uk
katherinealy.com
khtrx.com
egpu.fr
lumturo.academy
awaisghauri.com
hawthornsretirement.co.uk
redpebblephotography.com
elex.is
omegamarbella.com
happylublog.wordpress.com
julielusktherapy.com
bundan.com
leopoldineroux.com
endstarvation.com
cormanmarketing.com
animation-pro.co.uk
delegationhub.com
aquacheck.co.za
vapiano.fr
mieleshopping.it
donau-guides.eu
fotoeditores.com
itheroes.dk
aceroprime.com
thesilkroadny.com
cp-bap.de
singletonfinancial.com
mariannelemenestrel.com
acornishstudio.co.uk
volta.plus
entdoctor-durban.com
eksperdanismanlik.com
thenalpa.com
loparnille.se
barbaramcfadyenjewelry.com
dentalcircle.com
martha-frets-ceramics.nl
enactusnhlstenden.com
kosten-vochtbestrijding.be
domaine-des-pothiers.com
prodentalblue.com
soncini.ch
jollity.hu
bluetenreich-brilon.de
xn--billigafrgpatroner-stb.se
glas-kuck.de
marmarabasin.com
palema.gr
catalyseurdetransformation.com
housesofwa.com
cmeow.com
ivancacu.com
greeneyetattoo.com
vedsegaard.dk
circlecitydj.com
docarefoundation.org
theater-lueneburg.de
catchup-mag.com
naukaip.ru
osn.ro
anchelor.com
advanced-removals.co.uk
nevadaruralhousingstudies.org
ketomealprep.academy
insane.agency
thisprettyhair.com
awaitspain.com
voetbalhoogeveen.nl
oraweb.net
lifeinbreaths.com
motocrosshideout.com
plbinsurance.com
pourlabretagne.bzh
therapybusinessacademy.com
azloans.com
funworx.de
randyabrown.com
walterman.es
wg-heiligenstadt.de
letsstopsmoking.co.uk
111firstdelray.com
topautoinsurers.net
digitale-elite.de
easydental.ae
reizenmetkinderen.be
fire-space.com
zdrowieszczecin.pl
jacquesgarcianoto.com
kartuindonesia.com
zaczytana.com
techybash.com
lollachiro.com
powershell.su
noda.com.ua
tetameble.pl
proffteplo.com
rivermusic.nl
skooppi.fi
creohn.de
agrifarm.dk
alwaysdc.com
finnergo.eu
explora.nl
sshomme.com
hameghlim.com
deziplan.ru
cookinn.nl
deduktia.fi
acb-gruppe.ch
astrographic.com
poems-for-the-soul.ch
janellrardon.com
jandhpest.com
fitnessblenderstory.com
annenymus.com
wordpress.idium.no
apiarista.de
muni.pe
turing.academy
martinipstudios.com
cotton-avenue.co.il
lovcase.com
acibademmobil.com.tr
veggienessa.com
goodherbalhealth.com
metriplica.academy
heimdalbygg.no
awag-blog.de
go.labibini.ch
terraflair.de
linearete.com
claudiakilian.de
brinkdoepke.eu
unislaw-narty.pl
solutionshosting.co.uk
opt4cdi.com
cuadc.org
sber-biznes.com
magrinya.net
broccolisoep.nl
spectamarketingdigital.com.br
pazarspor.org.tr
catering.com
sochi-okna23.ru
mike.matthies.de
landgoedspica.nl
verbouwingsdouche.nl
bg.szczecin.pl
profiz.com
chinowarehousespace.com
skolaprome.eu
flossmoordental.com
pubcon.com
fotoslubna.com
bcabattoirs.org
spacebel.be
logosindustries.com
pxsrl.it
basindentistry.com
pajagus.fr
handyman-silkeborg.dk
golfclublandgoednieuwkerk.nl
distrifresh.com
b3b.ch
projektparkiet.pl
vvego.com
askstaffing.com
leijstrom.com
biblica.com
kerstliedjeszingen.nl
springfieldplumbermo.com
devus.de
kausette.com
markseymourphotography.co.uk
jax-interim-and-projectmanagement.com
kenmccallum.com
dennisverschuur.com
mediabolmong.com
ced-elec.com
aktivfriskcenter.se
kdbrh.com
dentourage.com
kombi-dress.com
adedesign.com
mind2muscle.nl
rossomattonecase.it
ownidentity.com
customroasts.com
mazzaropi.com.br
andreaskildegaard.dk
stringnosis.academy
yournextshoes.com
purepreprod4.com
afbudsrejserallinclusive.dk
richardkershawwines.co.za
greatofficespaces.net
imaginekithomes.co.nz
fixx-repair.com
geitoniatonaggelon.gr
klapanvent.ru
triavlete.com
rhino-turf.com
wrinstitute.org
dierenambulancealkmaar.nl
fascaonline.com
aciscomputers.com
miscbo.it
parentsandkids.com
comoserescritor.com
vitoriaecoturismo.com.br
shortsalemap.com
trainiumacademy.com
casinodepositors.com
frameshift.it
computer-place.de
fskhjalmar.se
teethinadaydentalimplants.com
internalresults.com
reputation-medical.online
theboardroomafrica.com
parisschool.ru
dogsunlimitedguide.com
raeoflightmusic.com
ultimatelifesource.com
yayasanprimaunggul.org
carolynfriedlander.com
groovedealers.ru
dentallabor-luenen.de
tweedekansenloket.nl
hostaletdelsindians.es
innovationgames-brabant.nl
internestdigital.com
bohrlochversicherung.info
apogeeconseils.fr
lmmont.sk
signededenroth.dk
bmw-i-pure-impulse.com
maryairbnb.wordpress.com
jlgraphisme.fr
mesajjongeren.nl
janasfokus.com
netadultere.fr
ceocenters.com
patriotcleaning.net
nuohous.com
annida.it
nepal-pictures.com
salonlamar.nl
rtc24.com
tecleados.com
malzomattalar.com
initconf.com
professionetata.com
carmel-york.com
heuvelland-oaze.nl
mikegoodfellow.co.uk
redctei.co
leadforensics.com
guohedd.com
altocontatto.net
operativadigital.com
drnelsonpediatrics.com
der-stempelking.de
amorbellezaysalud.com
renderbox.ch
eventosvirtualesexitosos.com
descargandoprogramas.com
bumbipdeco.site
crestgood.com
skyscanner.ro
cmascd.com
bertbutter.nl
midwestschool.org
nationnewsroom.com
zinnystar.com
zumrutkuyutemel.com
paardcentraal.nl
ilveshistoria.com
smartspeak.com
margaretmcshane.com
sololibrerie.it
lexced.com
kuriero.pro
atrgroup.it
olry-cloisons.fr
cac2040.com
lyricalduniya.com
bd2fly.com
9nar.com
uncensoredhentaigif.com
xn--80addfr4ahr.dp.ua
thestudio.academy
biodentify.ai
pisofare.co
lashandbrowenvy.com
loysonbryan.com
mayprogulka.ru
rino-gmbh.com
sytzedevries.com
stagefxinc.com
global-migrate.com
suonenjoen.fi
arthakapitalforvaltning.dk
xrresources.com
bilius.dk
luvinsburger.fr
lesyeuxbleus.net
humanviruses.org
jag.me
spartamovers.com
istantidigitali.com
hypogenforensic.com
bluelakevision.com
billyoart.com
ncjc.ca
pinkxgayvideoawards.com
alcye.com
metcalfe.ca
focuskontur.com
fridakids.com
lsngroupe.com
neonodi.be
rentingwell.com
chatberlin.de
hnkns.com
belinda.af
foerderverein-vatterschule.de
perceptdecor.com
teamsegeln.ch
medicalsupportco.com
cleanroomequipment.ie
mercadodelrio.com
condormobile.fr
saberconcrete.com
speakaudible.com
agendatwentytwenty.com
floweringsun.org
tzn.nu
billscars.net
the5thquestion.com
tieronechic.com
onlinemarketingsurgery.co.uk
bonitabeachassociation.com
soundseeing.net
chris-anne.com
ncn.nl
hinotruckwreckers.com.au
placermonticello.com
encounter-p.net
betterce.com
fazagostar.co
kickittickets.com
pokemonturkiye.com
aberdeenartwalk.org
quitescorting.com
makingmillionaires.net
rsidesigns.com
lookandseen.com
metallbau-hartmann.eu
craftstone.co.nz
sjtpo.org
bodymindchallenger.com
penumbuhrambutkeiskei.com
trivselsguide.dk
cc-experts.de
arearugcleaningnyc.com
baikalflot.ru
mazift.dk
buonabitare.com
chainofhopeeurope.eu
globalskills.pt
hartofurniture.com
topvijesti.net
dmlcpa.com
peninggibadan.co.id
ayudaespiritualtamara.com
gavelmasters.com
forumsittard.nl
acumenconsultingcompany.com
berdonllp.com
agenceassemble.fr
supercarhire.co.uk
pedmanson.com
monstarrsoccer.com
cascinarosa33.it
finsahome.co.uk
azerbaycanas.com
clinic-beethovenstrasse-ag.ch
hiddensee-buhne11.de
livelai.com
physio-lang.de
pro-gamer.pl
jaaphoekzema.nl
michal-s.co.il
gatlinburgcottage.com
taulunkartano.fi
ninjaki.com
piestar.com
amco.net.au
teutoradio.de
zuerich-umzug.ch
daveystownhouse.com
alharsunindo.com
mangimirossana.it
curtsdiscountguns.com
elliemaccreative.wordpress.com
rhino-storage.co.uk
eyedoctordallas.com
stage-infirmier.fr
slideevents.be
leloupblanc.gr
kelsigordon.com
allinonecampaign.com
the-beauty-guides.com
schlagbohrmaschinetests.com
achetrabalhos.com
sppdstats.com
belofloripa.be
bescomedical.de
o90.dk
stralsund-ansichten.de
tages-geldvergleich.de
valiant-voice.com
hawaiisteelbuilding.com
tanatek.com
secrets-clubs.co.uk
worldproskitour.com
jobscore.com
mundo-pieces-auto.fr
tbalp.co.uk
mgimalta.com
pinthelook.com
tilldeeke.de
speiserei-hannover.de
jimprattmediations.com
shortysspices.com
qwikcoach.com
o2o-academy.com
xtensifi.com
coachpreneuracademy.com
galaniuklaw.com
andrealuchesi.it
muller.nl
welovecustomers.fr
paradigmlandscape.com
campusescalade.com
satoblog.org
globalcompliancenews.com
optigas.com
rizplakatjaya.com
kryptos72.com
birthplacemag.com
nourella.com
oscommunity.de
lisa-poncon.fr
etgdogz.de
eafx.pro
leatherjees.com
nepressurecleaning.com
successcolony.com.ng
beandrivingschool.com.au
apmollerpension.com
stabilisateur.fr
mariajosediazdemera.com
forskolinslimeffect.net
chorusconsulting.net
duthler.nl
bodet150ans.com
brownswoodblog.com
90nguyentuan.com
natturestaurante.com.br
line-x.co.uk
keuken-prijs.nl
tothebackofthemoon.com
p-ride.live
dcc-eu.com
limounie.com
cl0nazepamblog.com
michaelfiegel.com
factoriareloj.com
tramadolhealth.com
sunsolutions.es
tesisatonarim.com
designimage.ae
boomerslivinglively.com
rozmata.com
avisioninthedesert.com
mediogiro.com.ar
cops4causes.org
aheadloftladders.co.uk
galatee-couture.com
activeterroristwarningcompany.com
suitesartemis.gr
cxcompany.com
skinkeeper.li
agora-collectivites.com
baumfinancialservices.com
web865.com
epsondriversforwindows.com
bagaholics.in
invela.dk
5thactors.com
tradenavigator.ch
iron-mine.ru
5pointpt.com
mjk.digital
biketruck.de
1deals.com
the-cupboard.co.uk
buerocenter-butzbach-werbemittel.de
drbrianhweeks.com
dreamvoiceclub.org
scotlandsroute66.co.uk
jdscenter.com
laylavalentine.com
utilisacteur.fr
happycatering.de
agencewho-aixenprovence.fr
ufovidmag.com
rename.kz
hvitfeldt.dk
cyberpromote.de
glennverschueren.be
malevannye.ru
levelseven.be
advancedeyecare.com
wallflowersandrakes.com
goeppinger-teppichreinigung.de
sveneulberg.de
jlwilsonbooks.com
3daywebs.com
clemenfoto.dk
jobkiwi.com.ng
thepixelfairy.com
banksrl.co.za
triplettabordeaux.fr
altitudeboise.com
lidkopingsnytt.nu
shrinkingplanet.com
gurutechnologies.net
larchwoodmarketing.com
jeanmonti.com
animalfood-online.de
hotjapaneselesbian.com
forextimes.ru
karelinjames.com
ronielyn.com
ikzoekgod.be
narca.net
xn--ziinoapte-6ld.ro
auberives-sur-vareze.fr
alpesiberie.com
atelierkomon.com
theatre-embellie.fr
imagine-entertainment.com
ygallerysalonsoho.com:443
cincinnatiphotocompany.org
nrgvalue.com
xn--80abehgab4ak0ddz.xn--p1ai
espaciopolitica.com
scietech.academy
karmeliterviertel.com
directique.com
pilotgreen.com
protoplay.ca
krishnabrawijaya.com
sweetz.fr
the3-week-diet.net
expohomes.com
limmortelyouth.com
pansionatblago.ru
kemtron.fr
kafkacare.com
wirmuessenreden.com
pankiss.ru
parseport.com
autoteamlast.de
eurethicsport.eu
ciga-france.fr
sprintcoach.com
slotenmakerszwijndrecht.nl
linkbuilding.life
bendel-partner.de
keyboardjournal.com
bajova.sk
thegrinningmanmusical.com
dibli.store
imajyuku-sozoku.com
mustangmarketinggroup.com
witraz.pl
irizar.com
wineandgo.hu
manzel.tn
billigeflybilletter.dk
nicksrock.com
mindsparkescape.com
testitjavertailut.net
precisetemp.com
weddingceremonieswithtim.com
smarttourism.academy
bubbalucious.com
polynine.com
energosbit-rp.ru
rapid5kloan.org
pvandambv.nl
livedeveloper.com
gsconcretecoatings.com
atma.nl
uci-france.fr
avtoboss163.ru:443
agriturismocastagneto.it
radishallgood.com
jameswilliamspainting.com
diverfiestas.com.es
matthieupetel.fr
onlinetvgroup.com
evsynthacademy.org
kryddersnapsen.dk
rattanwarehouse.co.uk
dantreranch.com
goddardleadership.org
ravage-webzine.nl
airserviceunlimited.com
collegetennis.info
enews-qca.com
craftron.com
alltagsrassismus-entknoten.de
qrs-international.com
haard-totaal.nl
glende-pflanzenparadies.de
factorywizuk.com
alabamaroofingllc.com
diakonie-weitramsdorf-sesslach.de
prometeyagro.com.ua
zorgboerderijravensbosch.nl
whoopingcrane.com
lunoluno.com
alaskaremote.com
ingresosextras.online
test-teleachat.fr
druktemakersheerenveen.nl
iactechnologies.net
graygreenbiomedservices.com
adaduga.info
nutriwell.com.sg
mrcar.nl
louiedager.com
watchsale.biz
alene.co
thiagoperez.com
nykfdyrehospital.dk
smartmind.net
haus-landliebe.de
fanuli.com.au
patassociation.com
alexwenzel.de
liepertgrafikweb.at
oro.ae
aidanpublishing.co.uk
business-basic.de
kroophold-sjaelland.dk
stoneridgemontessori.com
switch-made.com
interlinkone.com
frankgoll.com
campinglaforetdetesse.com
vdolg24.online
bavovrienden.nl
bridalcave.com
onesynergyinternational.com
domilivefurniture.com
sharonalbrightdds.com
grancanariaregional.com
phoenixcrane.com
min-virksomhed.dk
bulyginnikitav.000webhostapp.com
matteoruzzaofficial.com
schluesseldienste-hannover.de
k-v-f.de
artcase.pl
rolleepollee.com
janmorgenstern.com
dayenne-styling.nl
ramirezprono.com
bcmets.info
fysiotherapierijnmond.nl
bellesiniacademy.org
citydogslife.com
campusce.com
trevi-vl.ru
premiumweb.com.ua:443
amelielecompte.wordpress.com
putzen-reinigen.com
mollymccarthydesign.com
futurenetworking.com
cainlaw-okc.com
myfbateam.com
maxcube24.com.ua
laaisterplakky.nl
nexstagefinancial.com
die-immo-agentur.de
mondolandscapes.com
framemyballs.com
innervisions-id.com
tatyanakopieva.ru
gosouldeep.com
charlesfrancis.photos
ocduiblog.com
bjornvanvulpen.nl
jonnyhooley.com
theintellect.edu.pk
solidhosting.nl
innersurrection.com
mediahub.co.nz
ronaldhendriks.nl
johnsonweekly.com
saint-malo-developpement.fr
advesa.com
lattalvor.com
renehartman.nl
ludoil.it
perfectgrin.com
log-barn.co.uk
sbit.ag
bluemarinefoundation.com
dinecorp.com
motocrossplace.co.uk
lagschools.ng
cesep2019.com
hekecrm.com
leansupremegarcinia.net
stressreliefadvice.com
angelika-schwarz.com
mneti.ru
oththukaruva.com
masecologicos.com
corporacionrr.com
thehovecounsellingpractice.co.uk
promus.ca
artvark.nl
csaballoons.com
mac-computer-support-hamburg.de
colored-shelves.com
tastevirginia.com
efficiencyconsulting.es
ijsselbeton.nl
luvbec.com
charlottelhanna.com
ahgarage.com
babysitting-hk.helpergo.co
drvoip.com
greenrider.nl
otpusk.zp.ua
ddmgen.com
arabianmice.com
akwaba-safaris.com
denhaagfoodie.nl
universelle.fr
sealgrinderpt.com
premier-iowa.com
antesacademy.it
k-zubki.ru
geoweb.software
paprikapod.com
jayfurnitureco.com
juergenblaetz.de
pays-saint-flour.fr
relevantonline.eu
unboxtherapy.site
bratek-immobilien.de
molade.nl
hepishopping.com
gaearoyals.com
2020hindsight.info
bruut.online
affligemsehondenschool.be
beauty-traveller.com
toranjtuition.org
qandmmusiccenter.com
ntinasfiloxenia.gr
alisodentalcare.com
brighthillgroup.com
silverbird.dk
avis.mantova.it
electricianul.com
hostingbangladesh.net
peppergreenfarmcatering.com.au
santastoy.store
ledyoucan.com
koncept-m.ru
queertube.net
site.markkit.com.br
triplettagaite.fr
strauchs-wanderlust.info
iexpert99.com
liverpoolabudhabi.ae
zealcon.ae
modamarfil.com
aslog.fr
palmenhaus-erfurt.de
look.academy
dr-vita.de
c-sprop.com
angeleyezstripclub.com
a-zpaperwork.eu
datatri.be
lgiwines.com
oexebusiness.com
mrmac.com
so-sage.fr
axisoflove.org:443
memphishealthandwellness.com
richardiv.com
zwemofficial.nl
brunoimmobilier.com
photonag.com
ilovefullcircle.com
bringmehope.org
eos-horlogerie.com
11.in.ua
sarahspics.co.uk
dieetuniversiteit.nl
bayshoreelite.com
chatterchatterchatter.com
kellengatton.com
baita.ac
towelroot.co
johnkoen.com
opticahubertruiz.com
airvapourbarrier.com
cymru.futbol
jmmartinezilustrador.com
scentedlair.com
circuit-diagramz.com
webforsites.com
fidelitytitleoregon.com
hotelturbo.de
nxtstg.org
alnectus.com
epicjapanart.com
denverwynkoopdentist.com
subquercy.fr
edvestors.org
edrickennedymacfoy.com
nbva.co.uk
hm-com.com
profibersan.com
buzzneakers.com
gta-jjb.fr
yvesdoin-aquarelles.fr
lassocrm.com
furland.ru
harleystreetspineclinic.com
omnicademy.com
burg-zelem.de
moira-cristescu.com
skyboundnutrition.co.uk
lapponiasafaris.com
holocine.de
kompresory-opravy.com
fla.se
gardenpartner.pl
yourhappyevents.fr
levencovka.ru
bychowo.pl
hom-frisor.dk
kookooo.com
publicompserver.de
molinum.pt
parksideseniorliving.net
-
net
true
-
pid
19
-
prc
synctime
oracle
mysqld_nt
sqlbrowser
encsvc
infopath
winword
thebat64
onenote
wordpad
firefoxconfig
outlook
mysqld
visio
steam
ocssd
xfssvccon
sqlagent
sqbcoreservice
tbirdconfig
isqlplussvc
sqlservr
ocomm
thebat
excel
dbeng50
agntsvc
msftesql
ocautoupds
mydesktopqos
thunderbird
mydesktopservice
mspub
powerpnt
mysqld_opt
sqlwriter
dbsnmp
msaccess
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
36
-
svc
sophos
memtas
veeam
vss
mepocs
sql
backup
svc$
Extracted
C:\Users\x60g282nk-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/AD56BF6C294F0C5A
http://decryptor.top/AD56BF6C294F0C5A
Extracted
C:\Users\5317f-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7BBD560A9F7B1515
http://decryptor.top/7BBD560A9F7B1515
Targets
-
-
Target
b63bf2e4a6a0bc89f8375aa0f6672cea_JaffaCakes118
-
Size
164KB
-
MD5
b63bf2e4a6a0bc89f8375aa0f6672cea
-
SHA1
2c2ec58749b66d1814f27cbc3e8d845a3e7866fc
-
SHA256
3ea8f71bfb79e6547788eb5f2718d8cfc31fe6d99e15e6a8062406aedfcdfa90
-
SHA512
92a96ab7d0e7add812c49013ffc66a4f168becebdd68cf867c7d2655bcf6f2a0bcf1f78199b24b4741d0a832387eeb15ba9ae3c5e3fb0ddcc943e1e084145948
-
SSDEEP
3072:FHixaVZFiOCDJtOicNDWEzZthCcHR6I2qB:FHigLF5CCj5zZt7D
Score10/10-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-