General
-
Target
c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118
-
Size
164KB
-
Sample
240826-bly88awgjh
-
MD5
c1fcb12f4bd35ee741098773f58cb31a
-
SHA1
894be87aa90dd634125497f8b8b5e784be1c385f
-
SHA256
8790c52ea21760fde53f3e8003cd23f896c8c7b12ccdf212a615eece41aa5b97
-
SHA512
b67a51c7780d72c5957d4379f6887c10337017979dbd847fa49ceff9100450b2e010974051873dc3675502d249ad4189f7a4f7d89953d297493b5017b4af7ca8
-
SSDEEP
1536:bs2B7p26CaItF5gNHhKWluLpWmRHICS4AH3o/qTneyW7ZZOBml2uBbKbxoVgAy6B:9fg0NBlu9CNTed7/kBazzFbULREgMT
Behavioral task
behavioral1
Sample
c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
sodinokibi
29
1012
drnelsonpediatrics.com
cxcompany.com
skyscanner.ro
bohrlochversicherung.info
alwaysdc.com
baikalflot.ru
cap29010.it
almamidwifery.com
n-newmedia.de
factoriareloj.com
fixx-repair.com
alcye.com
bd2fly.com
111firstdelray.com
cormanmarketing.com
advancedeyecare.com
silkeight.com
vdolg24.online
limounie.com
sppdstats.com
designimage.ae
thehovecounsellingpractice.co.uk
signededenroth.dk
profibersan.com
catalyseurdetransformation.com
georgemuncey.com
spirello.nl
ygallerysalonsoho.com:443
galatee-couture.com
walterman.es
parseport.com
90nguyentuan.com
ninjaki.com
lsngroupe.com
osn.ro
profiz.com
g2mediainc.com
sunsolutions.es
acb-gruppe.ch
polynine.com
zaczytana.com
oscommunity.de
techybash.com
schroederschoembs.com
charlottelhanna.com
leatherjees.com
iron-mine.ru
circuit-diagramz.com
thiagoperez.com
prodentalblue.com
lattalvor.com
ahgarage.com
duthler.nl
ox-home.com
abulanov.com
mariajosediazdemera.com
kuriero.pro
mrmac.com
koncept-m.ru
richardkershawwines.co.za
log-barn.co.uk
goodherbalhealth.com
paprikapod.com
nykfdyrehospital.dk
lesyeuxbleus.net
memphishealthandwellness.com
boomerslivinglively.com
mustangmarketinggroup.com
webforsites.com
internalresults.com
domaine-des-pothiers.com
lagschools.ng
ntinasfiloxenia.gr
leansupremegarcinia.net
eksperdanismanlik.com
cssp-mediation.org
bilius.dk
tradenavigator.ch
cl0nazepamblog.com
agora-collectivites.com
thestudio.academy
bourchier.org
zinnystar.com
bridalcave.com
mursall.de
sveneulberg.de
der-stempelking.de
altitudeboise.com
smartercashsystem.com
csaballoons.com
rokthetalk.com
skidpiping.de
glennverschueren.be
magrinya.net
hostaletdelsindians.es
muni.pe
hom-frisor.dk
switch-made.com
agencewho-aixenprovence.fr
lifeinbreaths.com
peppergreenfarmcatering.com.au
metallbau-hartmann.eu
kenmccallum.com
dantreranch.com
craftron.com
advesa.com
datatri.be
dayenne-styling.nl
factorywizuk.com
sber-biznes.com
lashandbrowenvy.com
jollity.hu
animalfood-online.de
iactechnologies.net
signamedia.de
jacquesgarcianoto.com
sharonalbrightdds.com
barbaramcfadyenjewelry.com
daveystownhouse.com
karelinjames.com
liepertgrafikweb.at
nationnewsroom.com
line-x.co.uk
nourella.com
astrographic.com
stagefxinc.com
bluemarinefoundation.com
jayfurnitureco.com
diverfiestas.com.es
omegamarbella.com
husetsanitas.dk
fascaonline.com
drbrianhweeks.com
kellengatton.com
brannbornfastigheter.se
invela.dk
billigeflybilletter.dk
klapanvent.ru
o2o-academy.com
basindentistry.com
ceocenters.com
metcalfe.ca
cmeow.com
hotjapaneselesbian.com
energosbit-rp.ru
condormobile.fr
arabianmice.com
tatyanakopieva.ru
axisoflove.org:443
topautoinsurers.net
hospitalitytrainingsolutions.co.uk
avisioninthedesert.com
chinowarehousespace.com
lmmont.sk
muller.nl
qrs-international.com
bodymindchallenger.com
alaskaremote.com
banukumbak.com
modamarfil.com
katherinealy.com
auto-opel.ro
5thactors.com
triplettagaite.fr
thepixelfairy.com
diakonie-weitramsdorf-sesslach.de
baumfinancialservices.com
digitale-elite.de
kvetymichalovce.sk
chatberlin.de
heimdalbygg.no
epsondriversforwindows.com
min-virksomhed.dk
altocontatto.net
finsahome.co.uk
elex.is
triavlete.com
paardcentraal.nl
floweringsun.org
pvandambv.nl
concontactodirecto.com
b3b.ch
chainofhopeeurope.eu
reizenmetkinderen.be
go.labibini.ch
imagine-entertainment.com
skooppi.fi
mercadodelrio.com
avtoboss163.ru:443
hutchstyle.co.uk
annenymus.com
denhaagfoodie.nl
kelsigordon.com
oro.ae
mikegoodfellow.co.uk
anleggsregisteret.no
k-v-f.de
domilivefurniture.com
cainlaw-okc.com
computer-place.de
ronielyn.com
noda.com.ua
universelle.fr
golfclublandgoednieuwkerk.nl
protoplay.ca
direitapernambuco.com
sarahspics.co.uk
louiedager.com
campusce.com
agrifarm.dk
pajagus.fr
atelierkomon.com
letsstopsmoking.co.uk
subquercy.fr
coachpreneuracademy.com
makingmillionaires.net
galaniuklaw.com
pokemonturkiye.com
edrickennedymacfoy.com
promus.ca
jeanmonti.com
mindfuelers.com
midwestschool.org
gratiocafeblog.wordpress.com
tellthebell.website
glende-pflanzenparadies.de
nuohous.com
trainiumacademy.com
volta.plus
salonlamar.nl
proffteplo.com
khtrx.com
greatofficespaces.net
leopoldineroux.com
chomiksy.net
slotenmakerszwijndrecht.nl
pedmanson.com
eurethicsport.eu
geitoniatonaggelon.gr
flossmoordental.com
rvside.com
onesynergyinternational.com
groovedealers.ru
theintellect.edu.pk
secrets-clubs.co.uk
elitkeramika-shop.com.ua
kryptos72.com
therapybusinessacademy.com
slideevents.be
cincinnatiphotocompany.org
breakluckrecords.com
luvinsburger.fr
nepressurecleaning.com
gurutechnologies.net
licensed-public-adjuster.com
geoweb.software
birthplacemag.com
citiscapes-art.com
enews-qca.com
ufovidmag.com
hoteltantra.com
1deals.com
simpleitsolutions.ch
pinthelook.com
lisa-poncon.fr
wineandgo.hu
fitnessblenderstory.com
mensemetgesigte.co.za
singletonfinancial.com
towelroot.co
jobkiwi.com.ng
chatterchatterchatter.com
premier-iowa.com
prometeyagro.com.ua
globalcompliancenews.com
ncn.nl
blueridgeheritage.com
eshop.design
smartspeak.com
gazelle-du-web.com
insane.agency
amyandzac.com
xn--80abehgab4ak0ddz.xn--p1ai
yvesdoin-aquarelles.fr
gta-jjb.fr
epicjapanart.com
renderbox.ch
grafikstudio-visuell.de
mazzaropi.com.br
cac2040.com
tramadolhealth.com
stoneridgemontessori.com
outstandingminialbums.com
fi-institutionalfunds.com
bringmehope.org
eventosvirtualesexitosos.com
artcase.pl
azerbaycanas.com
medicalsupportco.com
cmascd.com
craftstone.co.nz
from02pro.com
alnectus.com
bonitabeachassociation.com
unislaw-narty.pl
sealgrinderpt.com
jlgraphisme.fr
shortsalemap.com
jameswilliamspainting.com
entdoctor-durban.com
zuerich-umzug.ch
alattekniksipil.com
innovationgames-brabant.nl
kryddersnapsen.dk
piestar.com
bjornvanvulpen.nl
trevi-vl.ru
amco.net.au
cymru.futbol
claudiakilian.de
naukaip.ru
zumrutkuyutemel.com
billscars.net
biodentify.ai
nginx.com
johnstonmingmanning.com
grupoexin10.com
aoyama.ac
marcandy.com
ivancacu.com
specialtyhomeservicesllc.com
activeterroristwarningcompany.com
schulz-moelln.de
denverwynkoopdentist.com
acumenconsultingcompany.com
lookandseen.com
ultimatelifesource.com
blucamp.com
sprintcoach.com
skyboundnutrition.co.uk
pharmeko-group.com
babysitting-hk.helpergo.co
soncini.ch
bruut.online
site.markkit.com.br
powershell.su
randyabrown.com
bcabattoirs.org
kdbrh.com
donau-guides.eu
johnsonweekly.com
phukienbepthanhdat.com
jefersonalessandro.com
putzen-reinigen.com
cp-bap.de
welovecustomers.fr
strauchs-wanderlust.info
istantidigitali.com
speakaudible.com
endlessrealms.net
akcadagofis.com
ravage-webzine.nl
ilovefullcircle.com
onlinemarketingsurgery.co.uk
lassocrm.com
unboxtherapy.site
aidanpublishing.co.uk
airvapourbarrier.com
mind2muscle.nl
charlesfrancis.photos
wallflowersandrakes.com
citydogslife.com
legundschiess.de
cc-experts.de
alexwenzel.de
startuplive.org
bg.szczecin.pl
schluesseldienste-hannover.de
cardsandloyalty.com
test-teleachat.fr
brighthillgroup.com
morgansconsult.com
fsbforsale.com
fta-media.com
jlwilsonbooks.com
jalkapuu.net
cotton-avenue.co.il
xn--ziinoapte-6ld.ro
easydental.ae
wademurray.com
ronaldhendriks.nl
production-stills.co.uk
julielusktherapy.com
pixelhealth.net
docarefoundation.org
cookinn.nl
renehartman.nl
lollachiro.com
mjk.digital
zealcon.ae
studionumerik.fr
azloans.com
zorgboerderijravensbosch.nl
worldproskitour.com
masecologicos.com
rsidesigns.com
onlinetvgroup.com
pinkxgayvideoawards.com
photonag.com
xtensifi.com
maryairbnb.wordpress.com
mariamalmahdi.com
apogeeconseils.fr
tesisatonarim.com
kombi-dress.com
nxtstg.org
rapid5kloan.org
ncjc.ca
dmlcpa.com
electricianul.com
shrinkingplanet.com
haard-totaal.nl
palema.gr
etgdogz.de
quitescorting.com
livelai.com
rentsportsequip.com
fridakids.com
handyman-silkeborg.dk
precisetemp.com
phoenixcrane.com
betterce.com
xn--80addfr4ahr.dp.ua
kosten-vochtbestrijding.be
lidkopingsnytt.nu
aciscomputers.com
tanatek.com
witraz.pl
patriotcleaning.net
buzzneakers.com
kamin-somnium.de
successcolony.com.ng
explora.nl
mesajjongeren.nl
vipcarrental.ae
shortysspices.com
die-immo-agentur.de
nicksrock.com
logosindustries.com
acibademmobil.com.tr
kickittickets.com
gsconcretecoatings.com
afbudsrejserallinclusive.dk
placermonticello.com
littlesaints.academy
manzel.tn
ayudaespiritualtamara.com
holocine.de
bajova.sk
hnkns.com
jobstomoveamerica.org
bagaholics.in
qandmmusiccenter.com
angeleyezstripclub.com
nexstagefinancial.com
artvark.nl
bluelakevision.com
pilotgreen.com
alpesiberie.com
laaisterplakky.nl
xrresources.com
rhino-storage.co.uk
valiant-voice.com
skolaprome.eu
rentingwell.com
omnicademy.com
dogsunlimitedguide.com
ziliak.com
devus.de
internestdigital.com
nepal-pictures.com
adedesign.com
tetameble.pl
chris-anne.com
speiserei-hannover.de
animation-pro.co.uk
skinkeeper.li
sochi-okna23.ru
spectamarketingdigital.com.br
supercarhire.co.uk
hepishopping.com
linkbuilding.life
tothebackofthemoon.com
initconf.com
victorvictoria.com
encounter-p.net
smartmind.net
pro-gamer.pl
wordpress.idium.no
burg-zelem.de
aceroprime.com
fann.ru
scotlandsroute66.co.uk
arearugcleaningnyc.com
poems-for-the-soul.ch
oraweb.net
ruggestar.ch
michal-s.co.il
mariannelemenestrel.com
cyberpromote.de
mediahub.co.nz
vitormmcosta.com
fotoslubna.com
mindsparkescape.com
ledyoucan.com
anchelor.com
penumbuhrambutkeiskei.com
ketomealprep.academy
9nar.com
clinic-beethovenstrasse-ag.ch
bakingismyyoga.com
linearete.com
raeoflightmusic.com
antesacademy.it
hypogenforensic.com
wg-heiligenstadt.de
springfieldplumbermo.com
forumsittard.nl
zwemofficial.nl
palmenhaus-erfurt.de
mbuildinghomes.com
metroton.ru
scholarquotes.com
xn--billigafrgpatroner-stb.se
awaitspain.com
ykobbqchicken.ca
interlinkone.com
t3brothers.com
rtc24.com
harleystreetspineclinic.com
block-optic.com
the-cupboard.co.uk
teamsegeln.ch
sjtpo.org
rishigangoly.com
k-zubki.ru
kroophold-sjaelland.dk
endstarvation.com
voice2biz.com
physio-lang.de
sbit.ag
sachainchiuk.com
nalliasmali.net
stanleyqualitysystems.com
sshomme.com
ikadomus.com
brunoimmobilier.com
chorusconsulting.net
dentourage.com
goddardleadership.org
the5thquestion.com
traitware.com
taulunkartano.fi
oththukaruva.com
bluetenreich-brilon.de
gavelmasters.com
sycamoregreenapts.com
imaginekithomes.co.nz
dcc-eu.com
leijstrom.com
netadultere.fr
skoczynski.eu
jag.me
ced-elec.com
irizar.com
nieuwsindeklas.be
greeneyetattoo.com
corporacionrr.com
cuadc.org
rename.kz
comoserescritor.com
hm-com.com
tutvracks.com
perfectgrin.com
circlecitydj.com
gardenpartner.pl
deziplan.ru
professionetata.com
dieetuniversiteit.nl
clemenfoto.dk
bendel-partner.de
pourlabretagne.bzh
carolynfriedlander.com
magnetvisual.com
kompresory-opravy.com
framemyballs.com
drvoip.com
expohomes.com
rarefoods.ro
markseymourphotography.co.uk
girlish.ae
rechtenplicht.be
satoblog.org
asiaartgallery.jp
pays-saint-flour.fr
arazi.eus
stage-infirmier.fr
campinglaforetdetesse.com
awaisghauri.com
advance-refle.com
rozmata.com
mgimalta.com
adterium.com
itheroes.dk
malzomattalar.com
purepreprod4.com
o90.dk
rs-danmark.dk
pansionatblago.ru
imajyuku-sozoku.com
alisodentalcare.com
aquacheck.co.za
nutriwell.com.sg
fskhjalmar.se
lovcase.com
uncensoredhentaigif.com
andermattswisswatches.ch
innersurrection.com
kookooo.com
miscbo.it
airserviceunlimited.com
mrkluttz.com
envomask.com
lumturo.academy
werkzeugtrolley.net
premiumweb.com.ua:443
jandhpest.com
pankiss.ru
loparnille.se
belofloripa.be
latableacrepes-meaux.fr
pisofare.co
askstaffing.com
narca.net
the-beauty-guides.com
tieronechic.com
grancanariaregional.com
fanuli.com.au
aberdeenartwalk.org
pubcon.com
reputation-medical.online
catering.com
m2graph.fr
customroasts.com
schlagbohrmaschinetests.com
acornishstudio.co.uk
dierenambulancealkmaar.nl
martinipstudios.com
kerstliedjeszingen.nl
palmecophilippines.com
bulyginnikitav.000webhostapp.com
frankgoll.com
evsynthacademy.org
indiebizadvocates.org
kartuindonesia.com
larchwoodmarketing.com
molade.nl
broccolisoep.nl
wasnederland.nl
adaduga.info
stathmoulis.gr
nvisionsigns.com
saint-malo-developpement.fr
sytzedevries.com
ludoil.it
dibli.store
goodboyscustom.com
catchup-mag.com
kemtron.fr
jaaphoekzema.nl
centuryvisionglobal.com
thegetawaycollective.com
eos-horlogerie.com
biketruck.de
mazift.dk
glas-kuck.de
marmarabasin.com
qwikcoach.com
mahikuchen.com
boyfriendsgoal.site
focuskontur.com
brinkdoepke.eu
advanced-removals.co.uk
p-ride.live
latteswithleslie.com
aheadloftladders.co.uk
perceptdecor.com
devplus.be
otpusk.zp.ua
wyreforest.net
publicompserver.de
look.academy
espaciopolitica.com
beandrivingschool.com.au
hawthornsretirement.co.uk
richardmaybury.co.uk
natturestaurante.com.br
dennisverschuur.com
operativadigital.com
a-zpaperwork.eu
funworx.de
metriplica.academy
napisat-pismo-gubernatoru.ru:443
redctei.co
forextimes.ru
wirmuessenreden.com
laylavalentine.com
the3-week-diet.net
atma.nl
globalskills.pt
plbinsurance.com
martha-frets-ceramics.nl
scentedlair.com
eyedoctordallas.com
hotelturbo.de
bavovrienden.nl
eastgrinsteadwingchun.com
buffdaddyblog.com
jonnyhooley.com
maxcube24.com.ua
cascinarosa33.it
thisprettyhair.com
levelseven.be
achetrabalhos.com
fluzfluzrewards.com
solidhosting.nl
santastoy.store
stringnosis.academy
enactusnhlstenden.com
hostastay.com
frimec-international.es
nevadaruralhousingstudies.org
janasfokus.com
hinotruckwreckers.com.au
forskolinslimeffect.net
belinda.af
matthieupetel.fr
texanscan.org
thenalpa.com
michaelfiegel.com
voetbalhoogeveen.nl
jobscore.com
allinonecampaign.com
haus-landliebe.de
jdscenter.com
nauticmarine.dk
liveyourheartout.co
vitoriaecoturismo.com.br
innervisions-id.com
mac-computer-support-hamburg.de
3daywebs.com
amelielecompte.wordpress.com
directique.com
tbalp.co.uk
greenrider.nl
jglconsultancy.com
tastevirginia.com
collegetennis.info
hartofurniture.com
dentalcircle.com
topvijesti.net
eatyoveges.com
jakubrybak.com
myplaywin3.com
teutoradio.de
furland.ru
mslp.org
newonestop.com
parentsandkids.com
auberives-sur-vareze.fr
jmmartinezilustrador.com
aslog.fr
agriturismocastagneto.it
rossomattonecase.it
baita.ac
landgoedspica.nl
mamajenedesigns.com
theater-lueneburg.de
transifer.fr
bundan.com
opt4cdi.com
ownidentity.com
alltagsrassismus-entknoten.de
tchernia-conseil.fr
wribrazil.com
opticahubertruiz.com
ingresosextras.online
avis.mantova.it
lexced.com
tzn.nu
hiddensee-buhne11.de
kiraribeaute-nani.com
frameshift.it
soundseeing.net
goeppinger-teppichreinigung.de
paradigmlandscape.com
fla.se
lapponiasafaris.com
stressreliefadvice.com
iexpert99.com
vapiano.fr
christianscholz.de
rino-gmbh.com
mundo-pieces-auto.fr
trivselsguide.dk
neonodi.be
egpu.fr
awag-blog.de
tilldeeke.de
liverpoolabudhabi.ae
web865.com
limmortelyouth.com
graygreenbiomedservices.com
11.in.ua
saboboxtel.uk
aktivfriskcenter.se
buonabitare.com
oportowebdesign.com
blavait.fr
suonenjoen.fi
hameghlim.com
watchsale.biz
andrealuchesi.it
solutionshosting.co.uk
motocrosshideout.com
leadforensics.com
stabilisateur.fr
sololibrerie.it
gaearoyals.com
mediabolmong.com
janellrardon.com
utilisacteur.fr
krishnabrawijaya.com
whoopingcrane.com
oexebusiness.com
subyard.com
mneti.ru
weddingceremonieswithtim.com
baptistdistinctives.org
ilveshistoria.com
tecleados.com
kausette.com
scietech.academy
so-sage.fr
yournextshoes.com
bookingwheel.com
cesep2019.com
yourcosmicbeing.com
ikzoekgod.be
apiarista.de
stitch-n-bitch.com
ijsselbeton.nl
gosouldeep.com
finnergo.eu
zdrowieszczecin.pl
cleanroomequipment.ie
lgiwines.com
vvego.com
amorbellezaysalud.com
banksrl.co.za
gbk-tp1.de
mayprogulka.ru
fire-space.com
margaretmcshane.com
ddmgen.com
malevannye.ru
biblica.com
agenceassemble.fr
atrgroup.it
bratek-immobilien.de
futurenetworking.com
spartamovers.com
racefietsenblog.nl
humanviruses.org
lyricalduniya.com
annida.it
c-sprop.com
pazarspor.org.tr
dinecorp.com
breathebettertolivebetter.com
billyoart.com
housesofwa.com
craftingalegacy.com
motocrossplace.co.uk
thesilkroadny.com
dinedrinkdetroit.com
teethinadaydentalimplants.com
drbenveniste.com
efficiencyconsulting.es
radishallgood.com
bescomedical.de
angelsmirrorus.com
veggienessa.com
hensleymarketing.com
ciga-france.fr
primemarineengineering.com
pureelements.nl
rolleepollee.com
brisbaneosteopathic.com.au
2020hindsight.info
hekecrm.com
mrcar.nl
matteoruzzaofficial.com
foerderverein-vatterschule.de
dr-vita.de
karmeliterviertel.com
parisschool.ru
tweedekansenloket.nl
nrgvalue.com
bychowo.pl
guohedd.com
fysiotherapierijnmond.nl
luvbec.com
bubbalucious.com
bumbipdeco.site
creohn.de
lovetzuchia.com
davedavisphotos.com
terraflair.de
silverbird.dk
rattanwarehouse.co.uk
deduktia.fi
molinum.pt
parksideseniorliving.net
mondolandscapes.com
gatlinburgcottage.com
alabamaroofingllc.com
rubyaudiology.com
wrinstitute.org
theatre-embellie.fr
richardiv.com
campusescalade.com
selected-minds.de
ebible.co
andreaskildegaard.dk
slotspinner.com
nbva.co.uk
apmollerpension.com
casinodepositors.com
bcmets.info
theboardroomafrica.com
neolaiamedispa.com
levencovka.ru
global-migrate.com
bayshoreelite.com
agendatwentytwenty.com
augen-praxisklinik-rostock.de
triplettabordeaux.fr
janmorgenstern.com
ya-elka.ru
redpebblephotography.com
livedeveloper.com
delegationhub.com
mieleshopping.it
hawaiisteelbuilding.com
christopherhannan.com
fbmagazine.ru
patassociation.com
akwaba-safaris.com
unexplored.gr
curtsdiscountguns.com
mangimirossana.it
carsten.sparen-it.de
rivermusic.nl
keuken-prijs.nl
fidelitytitleoregon.com
inewsstar.com
keyboardjournal.com
sellthewrightway.com
dnqa.co.uk
smartworkplaza.com
orchardbrickwork.com
jax-interim-and-projectmanagement.com
yuanshenghotel.com
testitjavertailut.net
berdonllp.com
edvestors.org
uci-france.fr
stralsund-ansichten.de
hvitfeldt.dk
juergenblaetz.de
yourhappyevents.fr
reygroup.pt
brownswoodblog.com
mollymccarthydesign.com
riffenmattgarage.ch
descargandoprogramas.com
ideamode.com
jimprattmediations.com
cops4causes.org
fotoeditores.com
rhino-turf.com
johnkoen.com
mike.matthies.de
thegrinningmanmusical.com
eafx.pro
affligemsehondenschool.be
vedsegaard.dk
leloupblanc.gr
ocduiblog.com
monstarrsoccer.com
happycatering.de
adabible.org
bertbutter.nl
autoteamlast.de
projektparkiet.pl
turing.academy
alharsunindo.com
toranjtuition.org
optigas.com
kristianboennelykke.dk
suitesartemis.gr
bodet150ans.com
heuvelland-oaze.nl
hostingbangladesh.net
lunoluno.com
sambaglow.com
tages-geldvergleich.de
justaroundthecornerpetsit.com
queertube.net
boloria.de
fazagostar.co
benchbiz.com
bmw-i-pure-impulse.com
druktemakersheerenveen.nl
alene.co
verbouwingsdouche.nl
ramirezprono.com
moira-cristescu.com
happylublog.wordpress.com
four-ways.com
beauty-traveller.com
distrifresh.com
saberconcrete.com
arthakapitalforvaltning.dk
buerocenter-butzbach-werbemittel.de
carmel-york.com
olry-cloisons.fr
kafkacare.com
business-basic.de
loysonbryan.com
elliemaccreative.wordpress.com
crestgood.com
yayasanprimaunggul.org
peninggibadan.co.id
mediogiro.com.ar
rizplakatjaya.com
albcleaner.fr
relevantonline.eu
letterscan.de
smarttourism.academy
colored-shelves.com
bellesiniacademy.org
pxsrl.it
oncarrot.com
dentallabor-luenen.de
photographycreativity.co.uk
spacebel.be
sweetz.fr
angelika-schwarz.com
myfbateam.com
5pointpt.com
dreamvoiceclub.org
-
net
true
-
pid
29
-
prc
ocomm
dbeng50
agntsvc
thunderbird
mydesktopqos
msaccess
powerpnt
thebat
onenote
sql
steam
outlook
ocssd
ocautoupds
synctime
winword
dbsnmp
mspub
wordpa
tbirdconfig
firefox
encsvc
mydesktopservice
excel
infopath
visio
isqlplussvc
sqbcoreservice
oracle
xfssvccon
-
ransom_oneliner
All of your files are encrypted! Find how to decrypt {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
1012
-
svc
sophos
*backup*
*vss*
svc$
memtas
veeam
*sql*
mepocs
Extracted
C:\Recovery\how to decrypt h3lp55538-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/408C73ED4C715AAE
http://decryptor.top/408C73ED4C715AAE
Extracted
C:\Recovery\how to decrypt 29d080u3i3-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5986525EDB942762
http://decryptor.top/5986525EDB942762
Targets
-
-
Target
c1fcb12f4bd35ee741098773f58cb31a_JaffaCakes118
-
Size
164KB
-
MD5
c1fcb12f4bd35ee741098773f58cb31a
-
SHA1
894be87aa90dd634125497f8b8b5e784be1c385f
-
SHA256
8790c52ea21760fde53f3e8003cd23f896c8c7b12ccdf212a615eece41aa5b97
-
SHA512
b67a51c7780d72c5957d4379f6887c10337017979dbd847fa49ceff9100450b2e010974051873dc3675502d249ad4189f7a4f7d89953d297493b5017b4af7ca8
-
SSDEEP
1536:bs2B7p26CaItF5gNHhKWluLpWmRHICS4AH3o/qTneyW7ZZOBml2uBbKbxoVgAy6B:9fg0NBlu9CNTed7/kBazzFbULREgMT
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1