General
-
Target
7562724773496ecb41bfb251d4e80ac9_JaffaCakes118
-
Size
238KB
-
Sample
240726-x36khszbmq
-
MD5
7562724773496ecb41bfb251d4e80ac9
-
SHA1
7c0eb4553c962153b63bd56df108cf607c31fdd7
-
SHA256
304925750c2c72dfce65780bc6b2383b3d9129683efdeb9fd9eb45441d6ff234
-
SHA512
30a345b02e7d08382443df8b987253b9c4fd9e029dd070605190bcf66a26bf9b8e835d373048c8847af1678b9d35375b35ac491605344db774cfabd41ba529f3
-
SSDEEP
6144:52nRR7hBiHDzNQKCQiNs8YvMfmznqKa3UxnJvLE2BOWOqANTwmOD:IUviNssOzn+3ITE2vqkf
Static task
static1
Behavioral task
behavioral1
Sample
7562724773496ecb41bfb251d4e80ac9_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
7562724773496ecb41bfb251d4e80ac9_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Malware Config
Extracted
sodinokibi
$2a$10$RO.LCr6jdP9VjRAMxCJY3ejtqThl60/x5fKwpmZd.2YvkbcNCIITS
6825
rocketccw.com
nhadatcanho247.com
xn--thucmctc-13a1357egba.com
mylolis.com
phantastyk.com
haremnick.com
vibethink.net
manutouchmassage.com
patrickfoundation.net
jenniferandersonwriter.com
deoudedorpskernnoordwijk.nl
gporf.fr
cleliaekiko.online
handi-jack-llc.com
bunburyfreightservices.com.au
lenreactiv-shop.ru
fatfreezingmachines.com
rerekatu.com
otsu-bon.com
arteservicefabbro.com
appsformacpc.com
8449nohate.org
grelot-home.com
coding-marking.com
upmrkt.co
mrsfieldskc.com
troegs.com
tophumanservicescourses.com
zflas.com
loprus.pl
digi-talents.com
crowd-patch.co.uk
limassoldriving.com
lusak.at
schoellhammer.com
centrospgolega.com
cursoporcelanatoliquido.online
theletter.company
mountsoul.de
richard-felix.co.uk
citymax-cr.com
darrenkeslerministries.com
liikelataamo.fi
iqbalscientific.com
boisehosting.net
happyeasterimages.org
solerluethi-allart.ch
galleryartfair.com
bargningharnosand.se
bowengroup.com.au
burkert-ideenreich.de
whittier5k.com
catholicmusicfest.com
iwelt.de
architekturbuero-wagner.net
herbstfeststaefa.ch
dpo-as-a-service.com
geekwork.pl
highimpactoutdoors.net
kidbucketlist.com.au
mymoneyforex.com
schutting-info.nl
ki-lowroermond.nl
sporthamper.com
mir-na-iznanku.com
extensionmaison.info
architecturalfiberglass.org
argos.wityu.fund
abogadoengijon.es
groupe-cets.com
synlab.lt
iviaggisonciliegie.it
coffreo.biz
bricotienda.com
cnoia.org
paymybill.guru
qualitaetstag.de
airconditioning-waalwijk.nl
ikads.org
bouquet-de-roses.com
boompinoy.com
homesdollar.com
bingonearme.org
kaliber.co.jp
simoneblum.de
modestmanagement.com
kingfamily.construction
resortmtn.com
backstreetpub.com
nurturingwisdom.com
devlaur.com
i-arslan.de
dubscollective.com
walter-lemm.de
abogadosaccidentetraficosevilla.es
drfoyle.com
austinlchurch.com
jasonbaileystudio.com
partnertaxi.sk
employeesurveys.com
tanciu.com
accountancywijchen.nl
makeitcount.at
itelagen.com
greenpark.ch
caribbeansunpoker.com
hmsdanmark.dk
softsproductkey.com
kissit.ca
bouncingbonanza.com
ceid.info.tr
kafu.ch
creamery201.com
candyhouseusa.com
hardinggroup.com
igrealestate.com
zenderthelender.com
spd-ehningen.de
eglectonk.online
cursosgratuitosnainternet.com
bigasgrup.com
longislandelderlaw.com
trulynolen.co.uk
foryourhealth.live
kalkulator-oszczednosci.pl
pogypneu.sk
smale-opticiens.nl
antonmack.de
first-2-aid-u.com
sloverse.com
klusbeter.nl
webcodingstudio.com
petnest.ir
irinaverwer.com
rksbusiness.com
sanyue119.com
stampagrafica.es
educar.org
hebkft.hu
edrcreditservices.nl
coursio.com
321play.com.hk
ditog.fr
koko-nora.dk
beautychance.se
better.town
biortaggivaldelsa.com
kosterra.com
maryloutaylor.com
sterlingessay.com
sanaia.com
figura.team
blossombeyond50.com
seagatesthreecharters.com
psc.de
hhcourier.com
nijaplay.com
samnewbyjax.com
jeanlouissibomana.com
icpcnj.org
love30-chanko.com
urist-bogatyr.ru
autofolierung-lu.de
365questions.org
kevinjodea.com
xltyu.com
christ-michael.net
ino-professional.ru
botanicinnovations.com
forskolorna.org
foretprivee.ca
crediacces.com
freie-gewerkschaften.de
wacochamber.com
hiddencitysecrets.com.au
myteamgenius.com
no-plans.com
insp.bi
centromarysalud.com
thailandholic.com
outcomeisincome.com
verbisonline.com
filmvideoweb.com
mylovelybluesky.com
projetlyonturin.fr
sofavietxinh.com
www1.proresult.no
fitnessbazaar.com
gasolspecialisten.se
acomprarseguidores.com
huissier-creteil.com
slupetzky.at
humancondition.com
poultrypartners.nl
saka.gr
ncuccr.org
odiclinic.org
plastidip.com.ar
craftleathermnl.com
dutchcoder.nl
iphoneszervizbudapest.hu
fundaciongregal.org
schmalhorst.de
dw-css.de
corelifenutrition.com
glennroberts.co.nz
renergysolution.com
parking.netgateway.eu
wychowanieprzedszkolne.pl
marketingsulweb.com
faronics.com
wmiadmin.com
ulyssemarketing.com
sinal.org
labobit.it
apprendrelaudit.com
presseclub-magdeburg.de
cuppacap.com
planchaavapor.net
devstyle.org
mooreslawngarden.com
commonground-stories.com
effortlesspromo.com
chatizel-paysage.fr
streamerzradio1.site
solhaug.tk
new.devon.gov.uk
siluet-decor.ru
slimidealherbal.com
toreria.es
slashdb.com
brandl-blumen.de
heliomotion.com
jacquin-maquettes.com
bastutunnan.se
lionware.de
starsarecircular.org
rimborsobancario.net
calxplus.eu
freie-baugutachterpraxis.de
comparatif-lave-linge.fr
ecopro-kanto.com
testzandbakmetmening.online
alvinschwartz.wordpress.com
sw1m.ru
havecamerawilltravel2017.wordpress.com
lightair.com
bsaship.com
danubecloud.com
tandartspraktijkheesch.nl
manijaipur.com
drugdevice.org
mezhdu-delom.ru
parkcf.nl
philippedebroca.com
daniel-akermann-architektur-und-planung.ch
schlafsack-test.net
greenfieldoptimaldentalcare.com
schoolofpassivewealth.com
ftf.or.at
fransespiegels.nl
pinkexcel.com
thomasvicino.com
autodujos.lt
heurigen-bauer.at
wurmpower.at
smogathon.com
praxis-foerderdiagnostik.de
gopackapp.com
bristolaeroclub.co.uk
sobreholanda.com
ilive.lt
juneauopioidworkgroup.org
takeflat.com
centuryrs.com
thaysa.com
stacyloeb.com
executiveairllc.com
vitalyscenter.es
wien-mitte.co.at
nativeformulas.com
liliesandbeauties.org
tulsawaterheaterinstallation.com
xn--singlebrsen-vergleich-nec.com
atmos-show.com
ivivo.es
rosavalamedahr.com
blgr.be
highlinesouthasc.com
shiftinspiration.com
ai-spt.jp
bargningavesta.se
fannmedias.com
xtptrack.com
reddysbakery.com
spacecitysisters.org
dsl-ip.de
atozdistribution.co.uk
modelmaking.nl
nestor-swiss.ch
michaelsmeriglioracing.com
psa-sec.de
homecomingstudio.com
proudground.org
fensterbau-ziegler.de
quickyfunds.com
dramagickcom.wordpress.com
lebellevue.fr
lecantou-coworking.com
cheminpsy.fr
gaiam.nl
creative-waves.co.uk
trackyourconstruction.com
ralister.co.uk
edelman.jp
cityorchardhtx.com
nmiec.com
deltacleta.cat
senson.fi
serce.info.pl
perbudget.com
danskretursystem.dk
simulatebrain.com
bockamp.com
vloeren-nu.nl
syndikat-asphaltfieber.de
hellohope.com
csgospeltips.se
greenko.pl
irishmachineryauctions.com
teknoz.net
thee.network
faroairporttransfers.net
johnsonfamilyfarmblog.wordpress.com
cortec-neuro.com
vannesteconstruct.be
knowledgemuseumbd.com
scenepublique.net
eadsmurraypugh.com
4net.guru
bierensgebakkramen.nl
mrtour.site
uimaan.fi
hkr-reise.de
kamahouse.net
baumkuchenexpo.jp
conasmanagement.de
parkstreetauto.net
baptisttabernacle.com
ussmontanacommittee.us
tomaso.gr
div-vertriebsforschung.de
monark.com
firstpaymentservices.com
kikedeoliveira.com
norovirus-ratgeber.de
musictreehouse.net
jorgobe.at
smhydro.com.pl
helikoptervluchtnewyork.nl
strandcampingdoonbeg.com
y-archive.com
tinyagency.com
stupbratt.no
qlog.de
trapiantofue.it
c-a.co.in
montrium.com
lloydconstruction.com
baronloan.org
ledmes.ru
upplandsspar.se
nachhilfe-unterricht.com
oldschoolfun.net
waynela.com
sotsioloogia.ee
transportesycementoshidalgo.es
kuntokeskusrok.fi
shhealthlaw.com
socialonemedia.com
notmissingout.com
sachnendoc.com
sevenadvertising.com
allamatberedare.se
pasvenska.se
you-bysia.com.au
chrissieperry.com
milsing.hr
bxdf.info
kedak.de
tigsltd.com
tecnojobsnet.com
milanonotai.it
lmtprovisions.com
nuzech.com
mank.de
woodleyacademy.org
vanswigchemdesign.com
dnepr-beskid.com.ua
myhostcloud.com
bridgeloanslenders.com
marathonerpaolo.com
euro-trend.pl
aco-media.nl
levihotelspa.fi
noskierrenteria.com
rehabilitationcentersinhouston.net
cwsitservices.co.uk
bradynursery.com
anteniti.com
nacktfalter.de
siliconbeach-realestate.com
argenblogs.com.ar
ampisolabergeggi.it
dutchbrewingcoffee.com
qualitus.com
ontrailsandboulevards.com
agence-referencement-naturel-geneve.net
id-et-d.fr
myhealth.net.au
vetapharma.fr
2ekeus.nl
satyayoga.de
hokagestore.com
darnallwellbeing.org.uk
brevitempore.net
chaotrang.com
minipara.com
smejump.co.th
mmgdouai.fr
miriamgrimm.de
buymedical.biz
vihannesporssi.fi
trystana.com
buroludo.nl
servicegsm.net
hvccfloorcare.com
urmasiimariiuniri.ro
webhostingsrbija.rs
thomas-hospital.de
lykkeliv.net
deschl.net
abl1.net
triactis.com
delchacay.com.ar
pomodori-pizzeria.de
ctrler.cn
beyondmarcomdotcom.wordpress.com
liveottelut.com
c2e-poitiers.com
katketytaanet.fi
precisionbevel.com
dlc.berlin
123vrachi.ru
yamalevents.com
yousay.site
thedresserie.com
lefumetdesdombes.com
triggi.de
campus2day.de
puertamatic.es
kath-kirche-gera.de
pierrehale.com
alsace-first.com
naturalrapids.com
yassir.pro
aselbermachen.com
humanityplus.org
macabaneaupaysflechois.com
krlosdavid.com
pcp-nc.com
layrshift.eu
saxtec.com
behavioralmedicinespecialists.com
asteriag.com
heidelbergartstudio.gallery
wasmachtmeinfonds.at
ncid.bc.ca
hairnetty.wordpress.com
bodyforwife.com
elpa.se
jvanvlietdichter.nl
daklesa.de
advizewealth.com
plotlinecreative.com
remcakram.com
besttechie.com
mariposapropaneaz.com
gonzalezfornes.es
artige.com
simplyblessedbykeepingitreal.com
stoneys.ch
id-vet.com
mrsplans.net
pasivect.co.uk
sportsmassoren.com
hotelzentral.at
pier40forall.org
financescorecard.com
durganews.com
iyahayki.nl
allentownpapershow.com
ecoledansemulhouse.fr
muamuadolls.com
ungsvenskarna.se
woodworkersolution.com
testcoreprohealthuk.com
joyeriaorindia.com
allure-cosmetics.at
luxurytv.jp
corona-handles.com
raschlosser.de
artallnightdc.com
nakupunafoundation.org
tetinfo.in
pridoxmaterieel.nl
fitovitaforum.com
operaslovakia.sk
vancouver-print.ca
interactcenter.org
waywithwords.net
broseller.com
ateliergamila.com
stormwall.se
ftlc.es
assurancesalextrespaille.fr
pcprofessor.com
retroearthstudio.com
slwgs.org
gmto.fr
tomoiyuma.com
hihaho.com
charlesreger.com
berliner-versicherungsvergleich.de
bimnapratica.com
surespark.org.uk
filmstreamingvfcomplet.be
dirittosanitario.biz
tampaallen.com
verytycs.com
embracinghiscall.com
classycurtainsltd.co.uk
romeguidedvisit.com
rozemondcoaching.nl
theduke.de
kunze-immobilien.de
denifl-consulting.at
ilso.net
bee4win.com
101gowrie.com
connectedace.com
solinegraphic.com
beaconhealthsystem.org
fayrecreations.com
conexa4papers.trade
maxadams.london
ivfminiua.com
caribdoctor.org
body-guards.it
sarbatkhalsafoundation.org
hrabritelefon.hr
jandaonline.com
real-estate-experts.com
mirjamholleman.nl
jbbjw.com
ilcdover.com
jakekozmor.com
live-con-arte.de
aminaboutique247.com
crowcanyon.com
farhaani.com
rota-installations.co.uk
coding-machine.com
punchbaby.com
porno-gringo.com
penco.ie
garage-lecompte-rouen.fr
withahmed.com
completeweddingkansas.com
gadgetedges.com
1team.es
villa-marrakesch.de
eaglemeetstiger.de
leeuwardenstudentcity.nl
htchorst.nl
rafaut.com
fiscalsort.com
elimchan.com
answerstest.ru
campusoutreach.org
southeasternacademyofprosthodontics.org
stefanpasch.me
katiekerr.co.uk
geoffreymeuli.com
vickiegrayimages.com
logopaedie-blomberg.de
balticdermatology.lt
onlybacklink.com
directwindowco.com
stoeferlehalle.de
zervicethai.co.th
madinblack.com
vorotauu.ru
erstatningsadvokaterne.dk
desert-trails.com
edv-live.de
profectis.de
oncarrot.com
sandd.nl
koken-voor-baby.nl
pay4essays.net
stemplusacademy.com
team-montage.dk
physiofischer.de
healthyyworkout.com
dezatec.es
croftprecision.co.uk
journeybacktolife.com
personalenhancementcenter.com
anthonystreetrimming.com
aakritpatel.com
supportsumba.nl
navyfederalautooverseas.com
artotelamsterdam.com
oemands.dk
art2gointerieurprojecten.nl
seevilla-dr-sturm.at
yourobgyn.net
offroadbeasts.com
kenhnoithatgo.com
smessier.com
thewellnessmimi.com
dr-tremel-rednitzhembach.de
maasreusel.nl
stoeberstuuv.de
amerikansktgodis.se
cranleighscoutgroup.org
cuspdental.com
quizzingbee.com
licor43.de
oneheartwarriors.at
bloggyboulga.net
xn--logopdie-leverkusen-kwb.de
ruralarcoiris.com
veybachcenter.de
shsthepapercut.com
naswrrg.org
the-domain-trader.com
xn--vrftet-pua.biz
tongdaifpthaiphong.net
stopilhan.com
uranus.nl
pt-arnold.de
mbxvii.com
i-trust.dk
tennisclubetten.nl
roadwarrior.app
binder-buerotechnik.at
femxarxa.cat
pelorus.group
cafemattmeera.com
dushka.ua
merzi.info
aniblinova.wordpress.com
advokathuset.dk
unetica.fr
winrace.no
themadbotter.com
spinheal.ru
songunceliptv.com
mousepad-direkt.de
otto-bollmann.de
vermoote.de
zimmerei-deboer.de
noixdecocom.fr
noesis.tech
portoesdofarrobo.com
35-40konkatsu.net
theshungiteexperience.com.au
tanzschule-kieber.de
neuschelectrical.co.za
theadventureedge.com
psnacademy.in
polzine.net
dr-pipi.de
mountaintoptinyhomes.com
igfap.com
joseconstela.com
gastsicht.de
paulisdogshop.de
kindersitze-vergleich.de
eraorastudio.com
sojamindbody.com
drinkseed.com
simpliza.com
global-kids.info
entopic.com
walkingdeadnj.com
carriagehousesalonvt.com
dublikator.com
denovofoodsgroup.com
lapmangfpt.info.vn
sexandfessenjoon.wordpress.com
micro-automation.de
henricekupper.com
intecwi.com
vdberg-autoimport.nl
blood-sports.net
biapi-coaching.fr
spargel-kochen.de
lillegrandpalais.com
xn--rumung-bua.online
bhwlawfirm.com
ziegler-praezisionsteile.de
ausair.com.au
girlillamarketing.com
castillobalduz.es
4youbeautysalon.com
all-turtles.com
kadesignandbuild.co.uk
ogdenvision.com
lachofikschiet.nl
spectrmash.ru
makeurvoiceheard.com
hushavefritid.dk
sauschneider.info
caffeinternet.it
crosspointefellowship.church
cirugiauretra.es
mepavex.nl
hypozentrum.com
slimani.net
deprobatehelp.com
devok.info
importardechina.info
sagadc.com
abitur-undwieweiter.de
destinationclients.fr
controldekk.com
danholzmann.com
alysonhoward.com
baylegacy.com
julis-lsa.de
podsosnami.ru
evergreen-fishing.com
sairaku.net
harpershologram.wordpress.com
ouryoungminds.wordpress.com
prochain-voyage.net
pmc-services.de
idemblogs.com
victoriousfestival.co.uk
zweerscreatives.nl
toponlinecasinosuk.co.uk
gratispresent.se
brigitte-erler.com
revezlimage.com
bigbaguettes.eu
sla-paris.com
kao.at
teczowadolina.bytom.pl
sweering.fr
luckypatcher-apkz.com
kaminscy.com
piajeppesen.dk
huesges-gruppe.de
shadebarandgrillorlando.com
vox-surveys.com
opatrovanie-ako.sk
gamesboard.info
seitzdruck.com
fotoscondron.com
mapawood.com
kmbshipping.co.uk
restaurantesszimmer.de
groupe-frayssinet.fr
falcou.fr
travelffeine.com
xoabigail.com
werkkring.nl
leather-factory.co.jp
judithjansen.com
securityfmm.com
tandartspraktijkhartjegroningen.nl
bordercollie-nim.nl
unim.su
web.ion.ag
rebeccarisher.com
collaborativeclassroom.org
jerling.de
makeflowers.ru
ohidesign.com
aodaichandung.com
midmohandyman.com
oceanastudios.com
bayoga.co.uk
celeclub.org
the-virtualizer.com
norpol-yachting.com
galserwis.pl
nvwoodwerks.com
delawarecorporatelaw.com
abuelos.com
verifort-capital.de
mindpackstudios.com
kirkepartner.dk
rhinosfootballacademy.com
blog.solutionsarchitect.guru
agence-chocolat-noir.com
fibrofolliculoma.info
baustb.de
urclan.net
insidegarage.pl
tinkoff-mobayl.ru
videomarketing.pro
parebrise-tla.fr
dr-seleznev.com
saarland-thermen-resort.com
pickanose.com
vibehouse.rw
evangelische-pfarrgemeinde-tuniberg.de
waermetauscher-berechnen.de
familypark40.com
autodemontagenijmegen.nl
hugoversichert.de
craigvalentineacademy.com
finediningweek.pl
xn--fnsterputssollentuna-39b.se
corola.es
selfoutlet.com
skiltogprint.no
strategicstatements.com
sportiomsportfondsen.nl
carrybrands.nl
edgewoodestates.org
lubetkinmediacompanies.com
vitavia.lt
ostheimer.at
tastewilliamsburg.com
alhashem.net
extraordinaryoutdoors.com
digivod.de
boosthybrid.com.au
autopfand24.de
homng.net
allfortheloveofyou.com
clos-galant.com
christinarebuffetcourses.com
run4study.com
aurum-juweliere.de
levdittliv.se
xn--fn-kka.no
lorenacarnero.com
compliancesolutionsstrategies.com
12starhd.online
rumahminangberdaya.com
people-biz.com
lichencafe.com
herbayupro.com
chandlerpd.com
bogdanpeptine.ro
notsilentmd.org
fairfriends18.de
moveonnews.com
readberserk.com
memaag.com
frontierweldingllc.com
n1-headache.com
peterstrobos.com
symphonyenvironmental.com
mirkoreisser.de
work2live.de
zimmerei-fl.de
mikeramirezcpa.com
kariokids.com
oneplusresource.org
dareckleyministries.com
1kbk.com.ua
stallbyggen.se
kampotpepper.gives
polychromelabs.com
houseofplus.com
hannah-fink.de
sipstroysochi.ru
nosuchthingasgovernment.com
ymca-cw.org.uk
gantungankunciakrilikbandung.com
ligiercenter-sachsen.de
seproc.hn
datacenters-in-europe.com
visiativ-industry.fr
danielblum.info
bodyfulls.com
vesinhnha.com.vn
geisterradler.de
xlarge.at
kamienny-dywan24.pl
huehnerauge-entfernen.de
igorbarbosa.com
promesapuertorico.com
lapinvihreat.fi
bauertree.com
todocaracoles.com
gw2guilds.org
wari.com.pe
morawe-krueger.de
charlottepoudroux-photographie.fr
cactusthebrand.com
narcert.com
turkcaparbariatrics.com
nicoleaeschbachorg.wordpress.com
newyou.at
alfa-stroy72.com
friendsandbrgrs.com
milestoneshows.com
malychanieruchomoscipremium.com
hexcreatives.co
dinslips.se
bookspeopleplaces.com
ianaswanson.com
justinvieira.com
hatech.io
camsadviser.com
brawnmediany.com
hairstylesnow.site
drnice.de
globedivers.wordpress.com
associacioesportivapolitg.cat
sportverein-tambach.de
blacksirius.de
echtveilig.nl
epwritescom.wordpress.com
iwr.nl
tips.technology
mytechnoway.com
officehymy.com
DupontSellsHomes.com
kisplanning.com.au
lucidinvestbank.com
marcuswhitten.site
blogdecachorros.com
zewatchers.com
wsoil.com.sg
admos-gleitlager.de
iyengaryogacharlotte.com
marietteaernoudts.nl
transliminaltribe.wordpress.com
anybookreader.de
maureenbreezedancetheater.org
zso-mannheim.de
jolly-events.com
degroenetunnel.com
radaradvies.nl
diversiapsicologia.es
berlin-bamboo-bikes.org
leda-ukraine.com.ua
atalent.fi
parks-nuernberg.de
apolomarcas.com
pivoineetc.fr
cyntox.com
ccpbroadband.com
truenyc.co
imaginado.de
platformier.com
hotelsolbh.com.br
teresianmedia.org
analiticapublica.es
nataschawessels.com
torgbodenbollnas.se
tsklogistik.eu
x-ray.ca
mrxermon.de
harveybp.com
instatron.net
mdacares.com
rostoncastings.co.uk
abogados-en-alicante.es
almosthomedogrescue.dog
antenanavi.com
americafirstcommittee.org
carlosja.com
fizzl.ru
enovos.de
jobcenterkenya.com
refluxreducer.com
coastalbridgeadvisors.com
wellplast.se
ladelirante.fr
imperfectstore.com
kojima-shihou.com
facettenreich27.de
braffinjurylawfirm.com
pferdebiester.de
actecfoundation.org
smalltownideamill.wordpress.com
commercialboatbuilding.com
mooglee.com
ora-it.de
fitnessingbyjessica.com
tstaffing.nl
celularity.com
webmaster-peloton.com
systemate.dk
maratonaclubedeportugal.com
corendonhotels.com
zzyjtsgls.com
goodgirlrecovery.com
shonacox.com
marchand-sloboda.com
tradiematepro.com.au
shiresresidential.com
latestmodsapks.com
ahouseforlease.com
twohourswithlena.wordpress.com
space.ua
waveneyrivercentre.co.uk
rieed.de
exenberger.at
cerebralforce.net
newstap.com.ng
thefixhut.com
panelsandwichmadrid.es
tuuliautio.fi
faizanullah.com
tarotdeseidel.com
izzi360.com
paradicepacks.com
consultaractadenacimiento.com
copystar.co.uk
micahkoleoso.de
whyinterestingly.ru
ihr-news.jp
schraven.de
evologic-technologies.com
manifestinglab.com
stemenstilte.nl
naturstein-hotte.de
boldcitydowntown.com
wraithco.com
bildungsunderlebnis.haus
hoteledenpadova.it
andersongilmour.co.uk
jyzdesign.com
pubweb.carnet.hr
lascuola.nl
flexicloud.hk
nokesvilledentistry.com
ncs-graphic-studio.com
expandet.dk
pocket-opera.de
worldhealthbasicinfo.com
polymedia.dk
onlyresultsmarketing.com
vietlawconsultancy.com
blewback.com
ventti.com.ar
olejack.ru
deko4you.at
lapinlviasennus.fi
modamilyon.com
mbfagency.com
bestbet.com
dontpassthepepper.com
milltimber.aberdeen.sch.uk
jameskibbie.com
pawsuppetlovers.com
international-sound-awards.com
fotoideaymedia.es
linnankellari.fi
krcove-zily.eu
pmcimpact.com
gasbarre.com
despedidascostablanca.es
mdk-mediadesign.de
em-gmbh.ch
suncrestcabinets.ca
adultgamezone.com
zieglerbrothers.de
lukeshepley.wordpress.com
helenekowalsky.com
theapifactory.com
craigmccabe.fun
wolf-glas-und-kunst.de
miraclediet.fun
maineemploymentlawyerblog.com
boulderwelt-muenchen-west.de
mediaclan.info
bouldercafe-wuppertal.de
aprepol.com
socstrp.org
launchhubl.com
steampluscarpetandfloors.com
oslomf.no
sahalstore.com
deepsouthclothingcompany.com
cite4me.org
latribuessentielle.com
osterberg.fi
lbcframingelectrical.com
tanzprojekt.com
seminoc.com
calabasasdigest.com
ravensnesthomegoods.com
smartypractice.com
tonelektro.nl
haar-spange.com
cimanchesterescorts.co.uk
babcockchurch.org
bbsmobler.se
spylista.com
adoptioperheet.fi
thenewrejuveme.com
forestlakeuca.org.au
plv.media
naturavetal.hr
rollingrockcolumbia.com
chavesdoareeiro.com
aglend.com.au
bundabergeyeclinic.com.au
mooshine.com
jobmap.at
insigniapmg.com
praxis-management-plus.de
funjose.org.gt
stingraybeach.com
summitmarketingstrategies.com
grupocarvalhoerodrigues.com.br
mercantedifiori.com
mastertechengineering.com
plantag.de
birnam-wood.com
fax-payday-loans.com
talentwunder.com
pointos.com
innote.fi
purposeadvisorsolutions.com
tux-espacios.com
associationanalytics.com
vyhino-zhulebino-24.ru
klimt2012.info
ra-staudte.de
nsec.se
live-your-life.jp
basisschooldezonnewijzer.nl
tenacitytenfold.com
alten-mebel63.ru
pv-design.de
jsfg.com
comarenterprises.com
spsshomeworkhelp.com
d1franchise.com
imadarchid.com
thedad.com
bigler-hrconsulting.ch
hashkasolutindo.com
promalaga.es
asiluxury.com
blumenhof-wegleitner.at
aarvorg.com
asgestion.com
simpkinsedwards.co.uk
lescomtesdemean.be
bafuncs.org
mediaacademy-iraq.org
amylendscrestview.com
theclubms.com
westdeptfordbuyrite.com
kaotikkustomz.com
skanah.com
mediaplayertest.net
ecpmedia.vn
nandistribution.nl
mardenherefordshire-pc.gov.uk
carolinepenn.com
ceres.org.au
antiaginghealthbenefits.com
d2marketing.co.uk
lynsayshepherd.co.uk
markelbroch.com
body-armour.online
karacaoglu.nl
lange.host
littlebird.salon
jadwalbolanet.info
aunexis.ch
jusibe.com
courteney-cox.net
microcirc.net
balticdentists.com
esope-formation.fr
gymnasedumanagement.com
gemeentehetkompas.nl
zonamovie21.net
smithmediastrategies.com
kostenlose-webcams.com
roygolden.com
pixelarttees.com
bptdmaluku.com
kojinsaisei.info
smokeysstoves.com
meusharklinithome.wordpress.com
easytrans.com.au
abogadosadomicilio.es
eco-southafrica.com
finde-deine-marke.de
ausbeverage.com.au
nancy-informatique.fr
rushhourappliances.com
jiloc.com
leoben.at
sabel-bf.com
chefdays.de
colorofhorses.com
augenta.com
higadograsoweb.com
dubnew.com
quemargrasa.net
dekkinngay.com
smart-light.co.uk
myzk.site
-
net
false
-
pid
$2a$10$RO.LCr6jdP9VjRAMxCJY3ejtqThl60/x5fKwpmZd.2YvkbcNCIITS
-
prc
ocomm
thunderbird
tbirdconfig
encsvc
isqlplussvc
agntsvc
mydesktopservice
wordpad
winword
visio
dbeng50
onenote
sqbcoreservice
firefox
oracle
mydesktopqos
outlook
ocautoupds
infopath
dbsnmp
mspub
ocssd
powerpnt
xfssvccon
thebat
msaccess
synctime
sql
excel
steam
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} =========Attention!!!========= Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. ============================== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
6825
-
svc
sophos
mepocs
backup
veeam
svc$
vss
sql
memtas
Extracted
C:\Recovery\777f1042-3af1-11ef-b4bd-d2f1755c8afd\7zkh4-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/279D4423218DDEEF
http://decoder.re/279D4423218DDEEF
Extracted
C:\Users\Admin\s8y85509p-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/2499497BAA213718
http://decoder.re/2499497BAA213718
Targets
-
-
Target
7562724773496ecb41bfb251d4e80ac9_JaffaCakes118
-
Size
238KB
-
MD5
7562724773496ecb41bfb251d4e80ac9
-
SHA1
7c0eb4553c962153b63bd56df108cf607c31fdd7
-
SHA256
304925750c2c72dfce65780bc6b2383b3d9129683efdeb9fd9eb45441d6ff234
-
SHA512
30a345b02e7d08382443df8b987253b9c4fd9e029dd070605190bcf66a26bf9b8e835d373048c8847af1678b9d35375b35ac491605344db774cfabd41ba529f3
-
SSDEEP
6144:52nRR7hBiHDzNQKCQiNs8YvMfmznqKa3UxnJvLE2BOWOqANTwmOD:IUviNssOzn+3ITE2vqkf
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1