General
-
Target
b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118
-
Size
165KB
-
Sample
240617-f7xdza1akj
-
MD5
b6fcb19eb3bcbf3eaf16c7bf3f134d61
-
SHA1
6211ba0a1160b344c1740654b636a8fdd775fbd8
-
SHA256
58cf92a67428816faa2f2ff2778ecfd8b129deb94b1a2ef1cbb3c13f665ffdac
-
SHA512
8f6ed156e2d55dabc35a6012f5bbc8ce0bc031c7430e814d21f0d6d8d2ccf53e6ae4408c604359e2e4a37ca830d9a61efdf9422e9f4f3183c7c466b00d2bd020
-
SSDEEP
3072:eCEq0R0nZ5ys5n4Y9doh7O79siUs/NadXHX0Fq:lw02sJPi7O93NwHX0Fq
Behavioral task
behavioral1
Sample
b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118.exe
Resource
win10v2004-20240611-en
Malware Config
Extracted
sodinokibi
37
1719
powershell.su
wordpress.idium.no
osn.ro
brighthillgroup.com
rokthetalk.com
finsahome.co.uk
lovetzuchia.com
towelroot.co
latteswithleslie.com
terraflair.de
aoyama.ac
uci-france.fr
tzn.nu
sealgrinderpt.com
frameshift.it
mslp.org
eafx.pro
adabible.org
domaine-des-pothiers.com
ijsselbeton.nl
biketruck.de
verbouwingsdouche.nl
graygreenbiomedservices.com
rossomattonecase.it
nrgvalue.com
matthieupetel.fr
n-newmedia.de
bertbutter.nl
rapid5kloan.org
sarahspics.co.uk
andermattswisswatches.ch
colored-shelves.com
hostaletdelsindians.es
andreaskildegaard.dk
zuerich-umzug.ch
humanviruses.org
kombi-dress.com
redpebblephotography.com
5thactors.com
outstandingminialbums.com
crestgood.com
radishallgood.com
factoriareloj.com
ikadomus.com
onlinetvgroup.com
subquercy.fr
directique.com
janmorgenstern.com
ced-elec.com
apiarista.de
beauty-traveller.com
asiaartgallery.jp
sprintcoach.com
profiz.com
airvapourbarrier.com
qandmmusiccenter.com
animalfood-online.de
therapybusinessacademy.com
drbrianhweeks.com
innovationgames-brabant.nl
lgiwines.com
aslog.fr
fitnessblenderstory.com
billyoart.com
xn--80abehgab4ak0ddz.xn--p1ai
daveystownhouse.com
aidanpublishing.co.uk
biodentify.ai
brannbornfastigheter.se
mbuildinghomes.com
pays-saint-flour.fr
furland.ru
globalcompliancenews.com
geitoniatonaggelon.gr
die-immo-agentur.de
yuanshenghotel.com
dinedrinkdetroit.com
alexwenzel.de
rivermusic.nl
aheadloftladders.co.uk
publicompserver.de
dreamvoiceclub.org
bookingwheel.com
mike.matthies.de
nepal-pictures.com
ceocenters.com
jacquesgarcianoto.com
agora-collectivites.com
eksperdanismanlik.com
wademurray.com
rechtenplicht.be
photonag.com
zdrowieszczecin.pl
rubyaudiology.com
boomerslivinglively.com
mariamalmahdi.com
arthakapitalforvaltning.dk
kroophold-sjaelland.dk
martinipstudios.com
yourhappyevents.fr
spartamovers.com
amyandzac.com
delegationhub.com
global-migrate.com
distrifresh.com
mollymccarthydesign.com
ebible.co
arabianmice.com
deduktia.fi
nevadaruralhousingstudies.org
protoplay.ca
90nguyentuan.com
explora.nl
ddmgen.com
wrinstitute.org
kdbrh.com
slideevents.be
atma.nl
evsynthacademy.org
fbmagazine.ru
pro-gamer.pl
chomiksy.net
cmeow.com
scietech.academy
laylavalentine.com
bonitabeachassociation.com
unexplored.gr
mind2muscle.nl
datatri.be
tanatek.com
cincinnatiphotocompany.org
alattekniksipil.com
riffenmattgarage.ch
mieleshopping.it
acornishstudio.co.uk
animation-pro.co.uk
jag.me
test-teleachat.fr
manzel.tn
markseymourphotography.co.uk
dieetuniversiteit.nl
soncini.ch
so-sage.fr
memphishealthandwellness.com
berdonllp.com
johnsonweekly.com
annida.it
auberives-sur-vareze.fr
midwestschool.org
belofloripa.be
cymru.futbol
smartmind.net
maxcube24.com.ua
plbinsurance.com
keuken-prijs.nl
thenalpa.com
factorywizuk.com
irizar.com
parksideseniorliving.net
devplus.be
sunsolutions.es
rhino-turf.com
kosten-vochtbestrijding.be
duthler.nl
myfbateam.com
alharsunindo.com
alnectus.com
chatberlin.de
happylublog.wordpress.com
scotlandsroute66.co.uk
ahgarage.com
livelai.com
paradigmlandscape.com
catering.com
queertube.net
artvark.nl
makingmillionaires.net
elitkeramika-shop.com.ua
motocrossplace.co.uk
denverwynkoopdentist.com
malzomattalar.com
speiserei-hannover.de
projektparkiet.pl
eyedoctordallas.com
citydogslife.com
stressreliefadvice.com
hypogenforensic.com
craftingalegacy.com
phukienbepthanhdat.com
acb-gruppe.ch
clinic-beethovenstrasse-ag.ch
imagine-entertainment.com
1deals.com
oscommunity.de
angeleyezstripclub.com
sochi-okna23.ru
belinda.af
lyricalduniya.com
paardcentraal.nl
andrealuchesi.it
metroton.ru
internestdigital.com
tesisatonarim.com
electricianul.com
buerocenter-butzbach-werbemittel.de
michaelfiegel.com
nykfdyrehospital.dk
signededenroth.dk
innervisions-id.com
leatherjees.com
rhino-storage.co.uk
chinowarehousespace.com
jalkapuu.net
fidelitytitleoregon.com
elex.is
b3b.ch
luvbec.com
fanuli.com.au
bendel-partner.de
ya-elka.ru
greenrider.nl
csaballoons.com
cops4causes.org
vvego.com
medicalsupportco.com
subyard.com
easydental.ae
citiscapes-art.com
mayprogulka.ru
vedsegaard.dk
chainofhopeeurope.eu
penumbuhrambutkeiskei.com
bluetenreich-brilon.de
linearete.com
magrinya.net
krishnabrawijaya.com
husetsanitas.dk
nginx.com
profibersan.com
brunoimmobilier.com
allinonecampaign.com
annenymus.com
peppergreenfarmcatering.com.au
centuryvisionglobal.com
rentsportsequip.com
babysitting-hk.helpergo.co
internalresults.com
innersurrection.com
werkzeugtrolley.net
paprikapod.com
metriplica.academy
abulanov.com
housesofwa.com
johnstonmingmanning.com
tastevirginia.com
lollachiro.com
stathmoulis.gr
broccolisoep.nl
stanleyqualitysystems.com
spacebel.be
salonlamar.nl
baikalflot.ru
greatofficespaces.net
axisoflove.org:443
bluemarinefoundation.com
burg-zelem.de
istantidigitali.com
2020hindsight.info
signamedia.de
mazzaropi.com.br
pureelements.nl
agencewho-aixenprovence.fr
jax-interim-and-projectmanagement.com
advance-refle.com
johnkoen.com
iexpert99.com
circuit-diagramz.com
newonestop.com
expohomes.com
altocontatto.net
justaroundthecornerpetsit.com
relevantonline.eu
egpu.fr
carsten.sparen-it.de
artcase.pl
rolleepollee.com
fi-institutionalfunds.com
worldproskitour.com
acibademmobil.com.tr
sber-biznes.com
rentingwell.com
amelielecompte.wordpress.com
avtoboss163.ru:443
taulunkartano.fi
rozmata.com
donau-guides.eu
linkbuilding.life
atelierkomon.com
lexced.com
tchernia-conseil.fr
mazift.dk
blavait.fr
thegetawaycollective.com
bringmehope.org
drvoip.com
voice2biz.com
physio-lang.de
futurenetworking.com
jobstomoveamerica.org
fta-media.com
spirello.nl
rattanwarehouse.co.uk
redctei.co
lsngroupe.com
cookinn.nl
tothebackofthemoon.com
frimec-international.es
skoczynski.eu
efficiencyconsulting.es
skyboundnutrition.co.uk
fridakids.com
fla.se
cxcompany.com
sbit.ag
imajyuku-sozoku.com
prodentalblue.com
teethinadaydentalimplants.com
deziplan.ru
mensemetgesigte.co.za
goddardleadership.org
cardsandloyalty.com
solutionshosting.co.uk
buonabitare.com
frankgoll.com
3daywebs.com
epicjapanart.com
modamarfil.com
mediahub.co.nz
casinodepositors.com
envomask.com
ikzoekgod.be
astrographic.com
fazagostar.co
drnelsonpediatrics.com
drbenveniste.com
sambaglow.com
stage-infirmier.fr
aceroprime.com
scentedlair.com
biblica.com
margaretmcshane.com
afbudsrejserallinclusive.dk
arazi.eus
elliemaccreative.wordpress.com
ziliak.com
production-stills.co.uk
sjtpo.org
tramadolhealth.com
curtsdiscountguns.com
glennverschueren.be
ledyoucan.com
banksrl.co.za
piestar.com
cl0nazepamblog.com
juergenblaetz.de
awag-blog.de
grancanariaregional.com
sachainchiuk.com
metcalfe.ca
triavlete.com
site.markkit.com.br
cainlaw-okc.com
onlinemarketingsurgery.co.uk
jakubrybak.com
miscbo.it
klapanvent.ru
parentsandkids.com
specialtyhomeservicesllc.com
ciga-france.fr
oportowebdesign.com
benchbiz.com
dayenne-styling.nl
customroasts.com
iron-mine.ru
topautoinsurers.net
eatyoveges.com
kiraribeaute-nani.com
jefersonalessandro.com
agenceassemble.fr
creohn.de
sshomme.com
jobscore.com
yournextshoes.com
ultimatelifesource.com
holocine.de
min-virksomhed.dk
otpusk.zp.ua
nationnewsroom.com
jollity.hu
rtc24.com
arearugcleaningnyc.com
startuplive.org
karmeliterviertel.com
marcandy.com
the3-week-diet.net
azerbaycanas.com
koncept-m.ru
dennisverschuur.com
suonenjoen.fi
peninggibadan.co.id
mariannelemenestrel.com
akcadagofis.com
solidhosting.nl
parseport.com
carmel-york.com
p-ride.live
acumenconsultingcompany.com
santastoy.store
mamajenedesigns.com
satoblog.org
techybash.com
mrmac.com
kerstliedjeszingen.nl
shortysspices.com
albcleaner.fr
mursall.de
alpesiberie.com
lunoluno.com
almamidwifery.com
rishigangoly.com
hinotruckwreckers.com.au
rizplakatjaya.com
handyman-silkeborg.dk
littlesaints.academy
diverfiestas.com.es
condormobile.fr
globalskills.pt
omegamarbella.com
pajagus.fr
perfectgrin.com
bourchier.org
tradenavigator.ch
mariajosediazdemera.com
block-optic.com
designimage.ae
vdolg24.online
clemenfoto.dk
domilivefurniture.com
nauticmarine.dk
supercarhire.co.uk
kookooo.com
forskolinslimeffect.net
ilveshistoria.com
nalliasmali.net
dnqa.co.uk
cesep2019.com
unislaw-narty.pl
adterium.com
glende-pflanzenparadies.de
pankiss.ru
bakingismyyoga.com
reputation-medical.online
proffteplo.com
dr-vita.de
netadultere.fr
amorbellezaysalud.com
teutoradio.de
switch-made.com
c-sprop.com
tages-geldvergleich.de
natturestaurante.com.br
wyreforest.net
orchardbrickwork.com
dentalcircle.com
carolynfriedlander.com
jlwilsonbooks.com
bohrlochversicherung.info
karelinjames.com
vapiano.fr
9nar.com
bubbalucious.com
kamin-somnium.de
cap29010.it
kryddersnapsen.dk
adaduga.info
hostingbangladesh.net
shrinkingplanet.com
leloupblanc.gr
nbva.co.uk
richardiv.com
trainiumacademy.com
web865.com
patriotcleaning.net
bumbipdeco.site
eos-horlogerie.com
pokemonturkiye.com
log-barn.co.uk
weddingceremonieswithtim.com
masecologicos.com
pubcon.com
devus.de
voetbalhoogeveen.nl
thepixelfairy.com
groovedealers.ru
fsbforsale.com
walterman.es
patassociation.com
victorvictoria.com
campusescalade.com
mondolandscapes.com
olry-cloisons.fr
mjk.digital
keyboardjournal.com
advesa.com
trevi-vl.ru
energosbit-rp.ru
advanced-removals.co.uk
kenmccallum.com
indiebizadvocates.org
renehartman.nl
photographycreativity.co.uk
gatlinburgcottage.com
mustangmarketinggroup.com
mahikuchen.com
webforsites.com
angelika-schwarz.com
druktemakersheerenveen.nl
bundan.com
qwikcoach.com
jlgraphisme.fr
topvijesti.net
stabilisateur.fr
limmortelyouth.com
wirmuessenreden.com
digitale-elite.de
studionumerik.fr
promus.ca
comoserescritor.com
bd2fly.com
charlesfrancis.photos
o90.dk
gsconcretecoatings.com
wineandgo.hu
boloria.de
alisodentalcare.com
diakonie-weitramsdorf-sesslach.de
bodymindchallenger.com
motocrosshideout.com
rsidesigns.com
smartworkplaza.com
kafkacare.com
descargandoprogramas.com
placermonticello.com
stringnosis.academy
geoweb.software
hiddensee-buhne11.de
the5thquestion.com
greeneyetattoo.com
breakluckrecords.com
kausette.com
yvesdoin-aquarelles.fr
lovcase.com
eastgrinsteadwingchun.com
the-cupboard.co.uk
katherinealy.com
heuvelland-oaze.nl
sytzedevries.com
galaniuklaw.com
jdscenter.com
ncn.nl
inewsstar.com
hoteltantra.com
hm-com.com
prometeyagro.com.ua
turing.academy
lesyeuxbleus.net
richardkershawwines.co.za
campinglaforetdetesse.com
craftron.com
lisa-poncon.fr
corporacionrr.com
denhaagfoodie.nl
fluzfluzrewards.com
alltagsrassismus-entknoten.de
tatyanakopieva.ru
jameswilliamspainting.com
oraweb.net
bavovrienden.nl
mediogiro.com.ar
xtensifi.com
rarefoods.ro
liveyourheartout.co
silkeight.com
cmascd.com
reizenmetkinderen.be
bodet150ans.com
reygroup.pt
grupoexin10.com
autoteamlast.de
ramirezprono.com
beandrivingschool.com.au
altitudeboise.com
hekecrm.com
xn--80addfr4ahr.dp.ua
perceptdecor.com
licensed-public-adjuster.com
gratiocafeblog.wordpress.com
oncarrot.com
xn--ziinoapte-6ld.ro
mindfuelers.com
schluesseldienste-hannover.de
anchelor.com
hameghlim.com
valiant-voice.com
bcabattoirs.org
naukaip.ru
jimprattmediations.com
mediabolmong.com
buffdaddyblog.com
mesajjongeren.nl
ntinasfiloxenia.gr
campusce.com
ronielyn.com
leijstrom.com
landgoedspica.nl
look.academy
onesynergyinternational.com
concontactodirecto.com
etgdogz.de
thesilkroadny.com
bescomedical.de
bychowo.pl
lagschools.ng
khtrx.com
raeoflightmusic.com
fascaonline.com
dmlcpa.com
scholarquotes.com
janasfokus.com
veggienessa.com
letsstopsmoking.co.uk
nutriwell.com.sg
from02pro.com
askstaffing.com
oththukaruva.com
levelseven.be
gosouldeep.com
pansionatblago.ru
renderbox.ch
toranjtuition.org
baptistdistinctives.org
insane.agency
zealcon.ae
avis.mantova.it
barbaramcfadyenjewelry.com
pharmeko-group.com
smartercashsystem.com
go.labibini.ch
sycamoregreenapts.com
schlagbohrmaschinetests.com
myplaywin3.com
saberconcrete.com
triplettabordeaux.fr
muni.pe
logosindustries.com
nepressurecleaning.com
alwaysdc.com
hotjapaneselesbian.com
aquacheck.co.za
zinnystar.com
pinkxgayvideoawards.com
texanscan.org
bratek-immobilien.de
hostastay.com
goodboyscustom.com
zorgboerderijravensbosch.nl
dinecorp.com
selected-minds.de
ykobbqchicken.ca
matteoruzzaofficial.com
framemyballs.com
yayasanprimaunggul.org
liverpoolabudhabi.ae
magnetvisual.com
lifeinbreaths.com
hutchstyle.co.uk
eventosvirtualesexitosos.com
jmmartinezilustrador.com
traitware.com
basindentistry.com
angelsmirrorus.com
legundschiess.de
successcolony.com.ng
kompresory-opravy.com
phoenixcrane.com
kemtron.fr
funworx.de
fskhjalmar.se
blucamp.com
muller.nl
chatterchatterchatter.com
boyfriendsgoal.site
pilotgreen.com
augen-praxisklinik-rostock.de
g2mediainc.com
gurutechnologies.net
focuskontur.com
christopherhannan.com
epsondriversforwindows.com
xn--billigafrgpatroner-stb.se
loysonbryan.com
latableacrepes-meaux.fr
leadforensics.com
jandhpest.com
cotton-avenue.co.il
collegetennis.info
premiumweb.com.ua:443
nxtstg.org
auto-opel.ro
putzen-reinigen.com
aktivfriskcenter.se
sellthewrightway.com
catalyseurdetransformation.com
testitjavertailut.net
skinkeeper.li
ox-home.com
primemarineengineering.com
bridalcave.com
cuadc.org
theater-lueneburg.de
skooppi.fi
apogeeconseils.fr
theboardroomafrica.com
dentallabor-luenen.de
livedeveloper.com
business-basic.de
nicksrock.com
craftstone.co.nz
bluelakevision.com
premier-iowa.com
singletonfinancial.com
schroederschoembs.com
yourcosmicbeing.com
rs-danmark.dk
laaisterplakky.nl
molade.nl
atrgroup.it
floweringsun.org
gbk-tp1.de
itheroes.dk
ownidentity.com
hensleymarketing.com
alcye.com
kristianboennelykke.dk
adedesign.com
cormanmarketing.com
silverbird.dk
iactechnologies.net
schulz-moelln.de
goodherbalhealth.com
ravage-webzine.nl
martha-frets-ceramics.nl
goeppinger-teppichreinigung.de
aberdeenartwalk.org
michal-s.co.il
thehovecounsellingpractice.co.uk
pisofare.co
ayudaespiritualtamara.com
alabamaroofingllc.com
finnergo.eu
eshop.design
stitch-n-bitch.com
bcmets.info
molinum.pt
pedmanson.com
ninjaki.com
hepishopping.com
bajova.sk
dentourage.com
spectamarketingdigital.com.br
brinkdoepke.eu
guohedd.com
fixx-repair.com
dibli.store
bg.szczecin.pl
mercadodelrio.com
hawthornsretirement.co.uk
racefietsenblog.nl
kelsigordon.com
circlecitydj.com
11.in.ua
julielusktherapy.com
lattalvor.com
oro.ae
a-zpaperwork.eu
theatre-embellie.fr
liepertgrafikweb.at
opticahubertruiz.com
zaczytana.com
xrresources.com
ruggestar.ch
palmenhaus-erfurt.de
alene.co
hnkns.com
jaaphoekzema.nl
birthplacemag.com
opt4cdi.com
coachpreneuracademy.com
charlottelhanna.com
cp-bap.de
whoopingcrane.com
gazelle-du-web.com
kuriero.pro
narca.net
cascinarosa33.it
palema.gr
baita.ac
morgansconsult.com
witraz.pl
avisioninthedesert.com
stoneridgemontessori.com
hawaiisteelbuilding.com
parisschool.ru
mrcar.nl
k-v-f.de
haard-totaal.nl
skyscanner.ro
stralsund-ansichten.de
simpleitsolutions.ch
tellthebell.website
four-ways.com
fann.ru
richardmaybury.co.uk
mindsparkescape.com
polynine.com
smarttourism.academy
agrifarm.dk
malevannye.ru
tweedekansenloket.nl
napisat-pismo-gubernatoru.ru:443
invela.dk
unboxtherapy.site
dierenambulancealkmaar.nl
springfieldplumbermo.com
teamsegeln.ch
tutvracks.com
chorusconsulting.net
nourella.com
flossmoordental.com
apmollerpension.com
initconf.com
loparnille.se
docarefoundation.org
dcc-eu.com
agriturismocastagneto.it
skolaprome.eu
brisbaneosteopathic.com.au
oexebusiness.com
sveneulberg.de
moira-cristescu.com
tecleados.com
strauchs-wanderlust.info
claudiakilian.de
rvside.com
nvisionsigns.com
forextimes.ru
welovecustomers.fr
levencovka.ru
lmmont.sk
ketomealprep.academy
hotelturbo.de
transifer.fr
happycatering.de
secrets-clubs.co.uk
breathebettertolivebetter.com
pourlabretagne.bzh
kvetymichalovce.sk
optigas.com
triplettagaite.fr
airserviceunlimited.com
rename.kz
cyberpromote.de
davedavisphotos.com
bmw-i-pure-impulse.com
shortsalemap.com
jobkiwi.com.ng
thisprettyhair.com
mac-computer-support-hamburg.de
saboboxtel.uk
forumsittard.nl
sololibrerie.it
billscars.net
palmecophilippines.com
bruut.online
smartspeak.com
luvinsburger.fr
der-stempelking.de
pvandambv.nl
noda.com.ua
bilius.dk
georgemuncey.com
espaciopolitica.com
blueridgeheritage.com
advancedeyecare.com
haus-landliebe.de
mangimirossana.it
anleggsregisteret.no
interlinkone.com
enactusnhlstenden.com
quitescorting.com
thegrinningmanmusical.com
fire-space.com
randyabrown.com
fotoslubna.com
dogsunlimitedguide.com
sharonalbrightdds.com
stagefxinc.com
nexstagefinancial.com
kickittickets.com
heimdalbygg.no
jayfurnitureco.com
direitapernambuco.com
endstarvation.com
thiagoperez.com
ocduiblog.com
uncensoredhentaigif.com
glas-kuck.de
sweetz.fr
tilldeeke.de
pinthelook.com
pazarspor.org.tr
zwemofficial.nl
poems-for-the-soul.ch
tieronechic.com
tetameble.pl
wribrazil.com
chris-anne.com
t3brothers.com
letterscan.de
professionetata.com
lashandbrowenvy.com
speakaudible.com
mrkluttz.com
leansupremegarcinia.net
agendatwentytwenty.com
banukumbak.com
volta.plus
fysiotherapierijnmond.nl
entdoctor-durban.com
amco.net.au
gardenpartner.pl
pixelhealth.net
monstarrsoccer.com
akwaba-safaris.com
janellrardon.com
endlessrealms.net
jonnyhooley.com
5pointpt.com
ronaldhendriks.nl
buzzneakers.com
trivselsguide.dk
antesacademy.it
billigeflybilletter.dk
neolaiamedispa.com
wasnederland.nl
achetrabalhos.com
lumturo.academy
soundseeing.net
o2o-academy.com
tbalp.co.uk
pxsrl.it
zumrutkuyutemel.com
neonodi.be
lapponiasafaris.com
bayshoreelite.com
mgimalta.com
ufovidmag.com
hospitalitytrainingsolutions.co.uk
slotenmakerszwijndrecht.nl
affligemsehondenschool.be
brownswoodblog.com
ygallerysalonsoho.com:443
ivancacu.com
metallbau-hartmann.eu
m2graph.fr
christianscholz.de
awaitspain.com
precisetemp.com
hvitfeldt.dk
k-zubki.ru
nuohous.com
louiedager.com
edvestors.org
kartuindonesia.com
harleystreetspineclinic.com
cssp-mediation.org
watchsale.biz
computer-place.de
dantreranch.com
jeanmonti.com
lassocrm.com
operativadigital.com
thestudio.academy
lookandseen.com
111firstdelray.com
jglconsultancy.com
bellesiniacademy.org
edrickennedymacfoy.com
nieuwsindeklas.be
ncjc.ca
maryairbnb.wordpress.com
imaginekithomes.co.nz
ilovefullcircle.com
awaisghauri.com
qrs-international.com
rino-gmbh.com
sppdstats.com
saint-malo-developpement.fr
bulyginnikitav.000webhostapp.com
limounie.com
utilisacteur.fr
betterce.com
cc-experts.de
vitoriaecoturismo.com.br
galatee-couture.com
leopoldineroux.com
suitesartemis.gr
girlish.ae
purepreprod4.com
cac2040.com
gavelmasters.com
bjornvanvulpen.nl
omnicademy.com
catchup-mag.com
azloans.com
mundo-pieces-auto.fr
hartofurniture.com
slotspinner.com
kryptos72.com
golfclublandgoednieuwkerk.nl
hom-frisor.dk
the-beauty-guides.com
cleanroomequipment.ie
kellengatton.com
alaskaremote.com
universelle.fr
larchwoodmarketing.com
ideamode.com
line-x.co.uk
lidkopingsnytt.nu
bagaholics.in
wg-heiligenstadt.de
grafikstudio-visuell.de
skidpiping.de
mneti.ru
aciscomputers.com
gaearoyals.com
encounter-p.net
wallflowersandrakes.com
gta-jjb.fr
vipcarrental.ae
mikegoodfellow.co.uk
ludoil.it
ingresosextras.online
fotoeditores.com
foerderverein-vatterschule.de
baumfinancialservices.com
theintellect.edu.pk
marmarabasin.com
activeterroristwarningcompany.com
vitormmcosta.com
eurethicsport.eu
enews-qca.com
-
net
true
-
pid
37
-
prc
encsvc
excel
tbirdconfig
ocssd
msaccess
wordpa
steam
powerpnt
visio
isqlplussvc
mydesktopqos
sqbcoreservice
thebat
sql
mspub
outlook
infopath
dbsnmp
oracle
ocomm
mydesktopservice
synctime
thunderbird
vss
winword
agntsvc
xfssvccon
firefox
ocautoupds
onenote
dbeng50
-
ransom_oneliner
All of your files are encrypted! Find how to decrypt {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
1719
-
svc
svc$
sophos
vss
veeam
backup
mepocs
memtas
sql
Extracted
C:\Recovery\How to decrypt sa5n92qybx-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5E8DE5371A38494D
http://decryptor.top/5E8DE5371A38494D
Extracted
C:\Users\How to decrypt 0b11bm229-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DE648EE015A5A3AA
http://decryptor.top/DE648EE015A5A3AA
Targets
-
-
Target
b6fcb19eb3bcbf3eaf16c7bf3f134d61_JaffaCakes118
-
Size
165KB
-
MD5
b6fcb19eb3bcbf3eaf16c7bf3f134d61
-
SHA1
6211ba0a1160b344c1740654b636a8fdd775fbd8
-
SHA256
58cf92a67428816faa2f2ff2778ecfd8b129deb94b1a2ef1cbb3c13f665ffdac
-
SHA512
8f6ed156e2d55dabc35a6012f5bbc8ce0bc031c7430e814d21f0d6d8d2ccf53e6ae4408c604359e2e4a37ca830d9a61efdf9422e9f4f3183c7c466b00d2bd020
-
SSDEEP
3072:eCEq0R0nZ5ys5n4Y9doh7O79siUs/NadXHX0Fq:lw02sJPi7O93NwHX0Fq
Score10/10-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1