General
-
Target
c20ceab7c093c47be023c81164b544ce_JaffaCakes118
-
Size
160KB
-
Sample
240826-ca9q9azepq
-
MD5
c20ceab7c093c47be023c81164b544ce
-
SHA1
de182d48bcc37bcbd1a25f22a0fc6619ce96f69b
-
SHA256
207b3353fa8bcb64966ba9f126e62753a00d22ac3702f2bdd34ec658d6d6144c
-
SHA512
add2c95045cfc9313d03e5b8cc351e90d0d82f2758208f48800db2ad02a39f8f8c60bcf8dce089d5a25e92e9ae2623cb30fc164de384620ce21276d261b32361
-
SSDEEP
1536:LzE8ZQwf8u+MM3PqBmD9PVpVO0Aj7Pbi4eTMluxtXDCntTnICS4Ag9JbMBBjV11l:Kt38mD9P3ILbi4eTMlwDCnumU9zx
Behavioral task
behavioral1
Sample
c20ceab7c093c47be023c81164b544ce_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c20ceab7c093c47be023c81164b544ce_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
sodinokibi
19
35
amyandzac.com
jag.me
circuit-diagramz.com
dentallabor-luenen.de
kiraribeaute-nani.com
ntinasfiloxenia.gr
ikadomus.com
akcadagofis.com
nauticmarine.dk
techybash.com
speiserei-hannover.de
a-zpaperwork.eu
janmorgenstern.com
edvestors.org
peppergreenfarmcatering.com.au
espaciopolitica.com
thepixelfairy.com
antesacademy.it
alharsunindo.com
keuken-prijs.nl
marmarabasin.com
efficiencyconsulting.es
husetsanitas.dk
uci-france.fr
bumbipdeco.site
mariannelemenestrel.com
allinonecampaign.com
ledyoucan.com
dibli.store
leloupblanc.gr
elex.is
physio-lang.de
stathmoulis.gr
hnkns.com
photographycreativity.co.uk
cyberpromote.de
zwemofficial.nl
renehartman.nl
richardkershawwines.co.za
o90.dk
anleggsregisteret.no
watchsale.biz
pxsrl.it
advancedeyecare.com
alattekniksipil.com
atrgroup.it
epicjapanart.com
rentsportsequip.com
goodherbalhealth.com
kemtron.fr
springfieldplumbermo.com
taulunkartano.fi
kenmccallum.com
p-ride.live
nutriwell.com.sg
der-stempelking.de
lollachiro.com
lassocrm.com
tages-geldvergleich.de
medicalsupportco.com
lagschools.ng
test-teleachat.fr
geitoniatonaggelon.gr
crestgood.com
jobstomoveamerica.org
fotoeditores.com
michal-s.co.il
vapiano.fr
gsconcretecoatings.com
adaduga.info
victorvictoria.com
scotlandsroute66.co.uk
eastgrinsteadwingchun.com
sycamoregreenapts.com
hypogenforensic.com
k-zubki.ru
julielusktherapy.com
eyedoctordallas.com
iron-mine.ru
belinda.af
ronaldhendriks.nl
triplettabordeaux.fr
lifeinbreaths.com
studionumerik.fr
bescomedical.de
magnetvisual.com
muni.pe
paprikapod.com
hotjapaneselesbian.com
narca.net
innersurrection.com
n-newmedia.de
jayfurnitureco.com
happycatering.de
adabible.org
fixx-repair.com
prodentalblue.com
corporacionrr.com
mustangmarketinggroup.com
guohedd.com
beauty-traveller.com
3daywebs.com
bookingwheel.com
production-stills.co.uk
whoopingcrane.com
tilldeeke.de
proffteplo.com
banukumbak.com
sbit.ag
handyman-silkeborg.dk
loparnille.se
jmmartinezilustrador.com
ncn.nl
osn.ro
ufovidmag.com
digitale-elite.de
haard-totaal.nl
mieleshopping.it
rapid5kloan.org
fsbforsale.com
profibersan.com
babysitting-hk.helpergo.co
spirello.nl
catalyseurdetransformation.com
almamidwifery.com
buerocenter-butzbach-werbemittel.de
nvisionsigns.com
cap29010.it
mollymccarthydesign.com
anchelor.com
basindentistry.com
baptistdistinctives.org
ncjc.ca
therapybusinessacademy.com
the-cupboard.co.uk
parentsandkids.com
limounie.com
liveyourheartout.co
mediabolmong.com
spartamovers.com
peninggibadan.co.id
tieronechic.com
furland.ru
drbenveniste.com
90nguyentuan.com
saberconcrete.com
cincinnatiphotocompany.org
richardmaybury.co.uk
qrs-international.com
sweetz.fr
comoserescritor.com
atma.nl
sunsolutions.es
netadultere.fr
invela.dk
cainlaw-okc.com
bagaholics.in
yourhappyevents.fr
startuplive.org
rs-danmark.dk
vvego.com
sber-biznes.com
glende-pflanzenparadies.de
pajagus.fr
amorbellezaysalud.com
ykobbqchicken.ca
11.in.ua
uncensoredhentaigif.com
opticahubertruiz.com
fysiotherapierijnmond.nl
skoczynski.eu
lapponiasafaris.com
letterscan.de
linearete.com
suonenjoen.fi
belofloripa.be
hawaiisteelbuilding.com
trivselsguide.dk
domaine-des-pothiers.com
diverfiestas.com.es
livedeveloper.com
encounter-p.net
aciscomputers.com
t3brothers.com
jakubrybak.com
wribrazil.com
amelielecompte.wordpress.com
dogsunlimitedguide.com
outstandingminialbums.com
carmel-york.com
gaearoyals.com
powershell.su
hoteltantra.com
margaretmcshane.com
teamsegeln.ch
signamedia.de
kryddersnapsen.dk
hepishopping.com
altitudeboise.com
buzzneakers.com
aslog.fr
mindfuelers.com
achetrabalhos.com
onlinemarketingsurgery.co.uk
fbmagazine.ru
aquacheck.co.za
oscommunity.de
bjornvanvulpen.nl
littlesaints.academy
evsynthacademy.org
moira-cristescu.com
theatre-embellie.fr
oththukaruva.com
kuriero.pro
rino-gmbh.com
oro.ae
holocine.de
omegamarbella.com
apmollerpension.com
laylavalentine.com
campinglaforetdetesse.com
lidkopingsnytt.nu
mneti.ru
skyscanner.ro
mrkluttz.com
walterman.es
publicompserver.de
tbalp.co.uk
computer-place.de
kvetymichalovce.sk
satoblog.org
agora-collectivites.com
lookandseen.com
foerderverein-vatterschule.de
jlwilsonbooks.com
michaelfiegel.com
bundan.com
factoriareloj.com
lsngroupe.com
jonnyhooley.com
c-sprop.com
theater-lueneburg.de
skolaprome.eu
the3-week-diet.net
nbva.co.uk
azerbaycanas.com
tweedekansenloket.nl
silkeight.com
k-v-f.de
sprintcoach.com
auberives-sur-vareze.fr
paradigmlandscape.com
racefietsenblog.nl
purepreprod4.com
hospitalitytrainingsolutions.co.uk
vipcarrental.ae
animalfood-online.de
gardenpartner.pl
relevantonline.eu
banksrl.co.za
gta-jjb.fr
pvandambv.nl
distrifresh.com
georgemuncey.com
janasfokus.com
thegrinningmanmusical.com
alcye.com
universelle.fr
precisetemp.com
four-ways.com
focuskontur.com
topautoinsurers.net
web865.com
gazelle-du-web.com
lmmont.sk
tramadolhealth.com
jefersonalessandro.com
drbrianhweeks.com
clemenfoto.dk
affligemsehondenschool.be
duthler.nl
miscbo.it
goeppinger-teppichreinigung.de
kdbrh.com
dreamvoiceclub.org
sveneulberg.de
grupoexin10.com
tanatek.com
protoplay.ca
molinum.pt
shortsalemap.com
luvbec.com
berdonllp.com
ruggestar.ch
artcase.pl
pedmanson.com
palmecophilippines.com
letsstopsmoking.co.uk
sachainchiuk.com
dantreranch.com
triavlete.com
broccolisoep.nl
fotoslubna.com
axisoflove.org:443
global-migrate.com
masecologicos.com
carsten.sparen-it.de
iexpert99.com
golfclublandgoednieuwkerk.nl
ilovefullcircle.com
pazarspor.org.tr
rivermusic.nl
kausette.com
newonestop.com
the-beauty-guides.com
ingresosextras.online
diakonie-weitramsdorf-sesslach.de
block-optic.com
kellengatton.com
leansupremegarcinia.net
electricianul.com
arabianmice.com
mediahub.co.nz
mesajjongeren.nl
ketomealprep.academy
mensemetgesigte.co.za
hutchstyle.co.uk
mamajenedesigns.com
subyard.com
afbudsrejserallinclusive.dk
agendatwentytwenty.com
stressreliefadvice.com
elitkeramika-shop.com.ua
muller.nl
animation-pro.co.uk
cc-experts.de
mslp.org
advance-refle.com
bringmehope.org
lashandbrowenvy.com
datatri.be
ijsselbeton.nl
curtsdiscountguns.com
frimec-international.es
andrealuchesi.it
domilivefurniture.com
weddingceremonieswithtim.com
activeterroristwarningcompany.com
ya-elka.ru
dcc-eu.com
brighthillgroup.com
cmeow.com
coachpreneuracademy.com
inewsstar.com
thehovecounsellingpractice.co.uk
jeanmonti.com
tradenavigator.ch
angelika-schwarz.com
awaitspain.com
bmw-i-pure-impulse.com
mike.matthies.de
ox-home.com
loysonbryan.com
globalcompliancenews.com
jaaphoekzema.nl
larchwoodmarketing.com
successcolony.com.ng
artvark.nl
shortysspices.com
enews-qca.com
pixelhealth.net
devplus.be
chatterchatterchatter.com
pays-saint-flour.fr
logosindustries.com
bratek-immobilien.de
deziplan.ru
bluetenreich-brilon.de
avtoboss163.ru:443
agencewho-aixenprovence.fr
mikegoodfellow.co.uk
vitoriaecoturismo.com.br
aoyama.ac
hm-com.com
jacquesgarcianoto.com
blavait.fr
mahikuchen.com
hostingbangladesh.net
subquercy.fr
lunoluno.com
schluesseldienste-hannover.de
chatberlin.de
breathebettertolivebetter.com
fskhjalmar.se
signededenroth.dk
sambaglow.com
hom-frisor.dk
premiumweb.com.ua:443
qandmmusiccenter.com
factorywizuk.com
oexebusiness.com
buonabitare.com
wirmuessenreden.com
limmortelyouth.com
chomiksy.net
cops4causes.org
hiddensee-buhne11.de
saint-malo-developpement.fr
strauchs-wanderlust.info
eksperdanismanlik.com
mariamalmahdi.com
floweringsun.org
xn--ziinoapte-6ld.ro
bulyginnikitav.000webhostapp.com
memphishealthandwellness.com
klapanvent.ru
cormanmarketing.com
circlecitydj.com
aheadloftladders.co.uk
alabamaroofingllc.com
zealcon.ae
kafkacare.com
finnergo.eu
ivancacu.com
delegationhub.com
fanuli.com.au
bluemarinefoundation.com
airvapourbarrier.com
mrmac.com
chorusconsulting.net
drvoip.com
iactechnologies.net
benchbiz.com
reizenmetkinderen.be
mursall.de
leatherjees.com
alaskaremote.com
ciga-france.fr
kroophold-sjaelland.dk
azloans.com
rsidesigns.com
dieetuniversiteit.nl
dierenambulancealkmaar.nl
b3b.ch
eventosvirtualesexitosos.com
nepal-pictures.com
davedavisphotos.com
teutoradio.de
bruut.online
nykfdyrehospital.dk
angeleyezstripclub.com
parseport.com
mediogiro.com.ar
billyoart.com
g2mediainc.com
speakaudible.com
pokemonturkiye.com
annenymus.com
randyabrown.com
avisioninthedesert.com
theintellect.edu.pk
innovationgames-brabant.nl
awag-blog.de
druktemakersheerenveen.nl
bakingismyyoga.com
rtc24.com
brunoimmobilier.com
bellesiniacademy.org
cp-bap.de
forskolinslimeffect.net
natturestaurante.com.br
eafx.pro
orchardbrickwork.com
jollity.hu
schulz-moelln.de
scentedlair.com
mac-computer-support-hamburg.de
globalskills.pt
eos-horlogerie.com
adedesign.com
imaginekithomes.co.nz
arearugcleaningnyc.com
denhaagfoodie.nl
cssp-mediation.org
billigeflybilletter.dk
stanleyqualitysystems.com
happylublog.wordpress.com
tetameble.pl
yuanshenghotel.com
mjk.digital
o2o-academy.com
polynine.com
alpesiberie.com
insane.agency
andreaskildegaard.dk
slotspinner.com
flossmoordental.com
queertube.net
customroasts.com
donau-guides.eu
oportowebdesign.com
kartuindonesia.com
nxtstg.org
khtrx.com
rename.kz
biblica.com
denverwynkoopdentist.com
baumfinancialservices.com
skidpiping.de
istantidigitali.com
metcalfe.ca
hvitfeldt.dk
primemarineengineering.com
dinecorp.com
kombi-dress.com
tesisatonarim.com
futurenetworking.com
easydental.ae
sharonalbrightdds.com
ownidentity.com
supercarhire.co.uk
zaczytana.com
boomerslivinglively.com
internestdigital.com
boloria.de
jimprattmediations.com
werkzeugtrolley.net
maryairbnb.wordpress.com
landgoedspica.nl
agenceassemble.fr
sololibrerie.it
kookooo.com
galaniuklaw.com
pisofare.co
akwaba-safaris.com
glas-kuck.de
transifer.fr
metroton.ru
midwestschool.org
mbuildinghomes.com
hotelturbo.de
enactusnhlstenden.com
unexplored.gr
concontactodirecto.com
groovedealers.ru
livelai.com
explora.nl
otpusk.zp.ua
fi-institutionalfunds.com
rattanwarehouse.co.uk
soundseeing.net
framemyballs.com
texanscan.org
charlesfrancis.photos
toranjtuition.org
bayshoreelite.com
solidhosting.nl
justaroundthecornerpetsit.com
secrets-clubs.co.uk
endstarvation.com
rhino-turf.com
forumsittard.nl
apogeeconseils.fr
nationnewsroom.com
yvesdoin-aquarelles.fr
fidelitytitleoregon.com
photonag.com
lumturo.academy
smartspeak.com
advanced-removals.co.uk
atelierkomon.com
boyfriendsgoal.site
reputation-medical.online
betterce.com
tellthebell.website
patassociation.com
sjtpo.org
pankiss.ru
altocontatto.net
fire-space.com
biketruck.de
wrinstitute.org
airserviceunlimited.com
mayprogulka.ru
creohn.de
schroederschoembs.com
stoneridgemontessori.com
trevi-vl.ru
cac2040.com
latteswithleslie.com
smartworkplaza.com
biodentify.ai
vedsegaard.dk
johnsonweekly.com
m2graph.fr
terraflair.de
alene.co
citydogslife.com
mondolandscapes.com
placermonticello.com
envomask.com
yayasanprimaunggul.org
eatyoveges.com
professionetata.com
interlinkone.com
dinedrinkdetroit.com
olry-cloisons.fr
craftron.com
goodboyscustom.com
matteoruzzaofficial.com
omnicademy.com
stage-infirmier.fr
selected-minds.de
myfbateam.com
chinowarehousespace.com
eshop.design
xtensifi.com
itheroes.dk
amco.net.au
smartercashsystem.com
martinipstudios.com
bertbutter.nl
morgansconsult.com
nexstagefinancial.com
nourella.com
devus.de
thenalpa.com
aceroprime.com
glennverschueren.be
burg-zelem.de
fann.ru
haus-landliebe.de
pubcon.com
malzomattalar.com
salonlamar.nl
sealgrinderpt.com
solutionshosting.co.uk
optigas.com
kickittickets.com
cotton-avenue.co.il
hinotruckwreckers.com.au
daveystownhouse.com
metriplica.academy
utilisacteur.fr
descargandoprogramas.com
irizar.com
agrifarm.dk
johnkoen.com
quitescorting.com
sppdstats.com
skinkeeper.li
hameghlim.com
premier-iowa.com
9nar.com
lesyeuxbleus.net
cascinarosa33.it
marcandy.com
craftingalegacy.com
designimage.ae
entdoctor-durban.com
csaballoons.com
bg.szczecin.pl
sochi-okna23.ru
operativadigital.com
ravage-webzine.nl
nevadaruralhousingstudies.org
chainofhopeeurope.eu
dentourage.com
clinic-beethovenstrasse-ag.ch
kosten-vochtbestrijding.be
frankgoll.com
go.labibini.ch
wordpress.idium.no
ocduiblog.com
wasnederland.nl
manzel.tn
scholarquotes.com
qwikcoach.com
heimdalbygg.no
cesep2019.com
indiebizadvocates.org
housesofwa.com
drnelsonpediatrics.com
triplettagaite.fr
tecleados.com
traitware.com
palmenhaus-erfurt.de
towelroot.co
min-virksomhed.dk
dentalcircle.com
stabilisateur.fr
gbk-tp1.de
line-x.co.uk
raeoflightmusic.com
modamarfil.com
hensleymarketing.com
lattalvor.com
greeneyetattoo.com
asiaartgallery.jp
rizplakatjaya.com
luvinsburger.fr
lexced.com
ceocenters.com
askstaffing.com
pourlabretagne.bzh
sellthewrightway.com
brownswoodblog.com
pinkxgayvideoawards.com
santastoy.store
keyboardjournal.com
cl0nazepamblog.com
mazift.dk
gavelmasters.com
fazagostar.co
billscars.net
liepertgrafikweb.at
bridalcave.com
sytzedevries.com
innervisions-id.com
greatofficespaces.net
jalkapuu.net
jlgraphisme.fr
veggienessa.com
angelsmirrorus.com
paardcentraal.nl
koncept-m.ru
charlottelhanna.com
ilveshistoria.com
piestar.com
thiagoperez.com
brinkdoepke.eu
bubbalucious.com
edrickennedymacfoy.com
naukaip.ru
bohrlochversicherung.info
vdolg24.online
ayudaespiritualtamara.com
directique.com
thesilkroadny.com
simpleitsolutions.ch
motocrosshideout.com
cookinn.nl
plbinsurance.com
alnectus.com
motocrossplace.co.uk
laaisterplakky.nl
phoenixcrane.com
heuvelland-oaze.nl
wallflowersandrakes.com
martha-frets-ceramics.nl
saboboxtel.uk
kamin-somnium.de
putzen-reinigen.com
vitormmcosta.com
carolynfriedlander.com
penumbuhrambutkeiskei.com
skooppi.fi
frameshift.it
abulanov.com
theboardroomafrica.com
smarttourism.academy
jobkiwi.com.ng
wademurray.com
from02pro.com
jglconsultancy.com
noda.com.ua
pansionatblago.ru
galatee-couture.com
webforsites.com
5pointpt.com
schlagbohrmaschinetests.com
karmeliterviertel.com
endlessrealms.net
matthieupetel.fr
bonitabeachassociation.com
tastevirginia.com
onlinetvgroup.com
verbouwingsdouche.nl
blueridgeheritage.com
leadforensics.com
bluelakevision.com
imagine-entertainment.com
baita.ac
rolleepollee.com
hostastay.com
yourcosmicbeing.com
rossomattonecase.it
kristianboennelykke.dk
mangimirossana.it
rishigangoly.com
mundo-pieces-auto.fr
5thactors.com
nrgvalue.com
rokthetalk.com
juergenblaetz.de
lovetzuchia.com
volta.plus
cardsandloyalty.com
perceptdecor.com
cymru.futbol
mariajosediazdemera.com
stringnosis.academy
ronielyn.com
topvijesti.net
jameswilliamspainting.com
kompresory-opravy.com
riffenmattgarage.ch
slotenmakerszwijndrecht.nl
magrinya.net
zuerich-umzug.ch
bodet150ans.com
markseymourphotography.co.uk
cmascd.com
bendel-partner.de
katherinealy.com
suitesartemis.gr
bd2fly.com
jobscore.com
rvside.com
dmlcpa.com
graygreenbiomedservices.com
annida.it
latableacrepes-meaux.fr
promus.ca
so-sage.fr
mindsparkescape.com
perfectgrin.com
alltagsrassismus-entknoten.de
grafikstudio-visuell.de
log-barn.co.uk
jandhpest.com
zinnystar.com
skyboundnutrition.co.uk
lyricalduniya.com
richardiv.com
ideamode.com
campusescalade.com
oncarrot.com
neolaiamedispa.com
pharmeko-group.com
ultimatelifesource.com
ced-elec.com
gratiocafeblog.wordpress.com
wineandgo.hu
fta-media.com
greenrider.nl
bavovrienden.nl
alisodentalcare.com
colored-shelves.com
site.markkit.com.br
docarefoundation.org
onesynergyinternational.com
louiedager.com
liverpoolabudhabi.ae
spacebel.be
acornishstudio.co.uk
direitapernambuco.com
palema.gr
agriturismocastagneto.it
fluzfluzrewards.com
rozmata.com
shrinkingplanet.com
beandrivingschool.com.au
dr-vita.de
epsondriversforwindows.com
dayenne-styling.nl
linkbuilding.life
unboxtherapy.site
alexwenzel.de
baikalflot.ru
parisschool.ru
cxcompany.com
business-basic.de
finsahome.co.uk
thisprettyhair.com
hostaletdelsindians.es
zumrutkuyutemel.com
xrresources.com
gatlinburgcottage.com
krishnabrawijaya.com
tutvracks.com
auto-opel.ro
expohomes.com
ninjaki.com
fridakids.com
harleystreetspineclinic.com
malevannye.ru
pureelements.nl
the5thquestion.com
reygroup.pt
aktivfriskcenter.se
specialtyhomeservicesllc.com
licensed-public-adjuster.com
imajyuku-sozoku.com
mazzaropi.com.br
adterium.com
patriotcleaning.net
thegetawaycollective.com
initconf.com
tchernia-conseil.fr
bilius.dk
ziliak.com
bychowo.pl
renderbox.ch
napisat-pismo-gubernatoru.ru:443
catchup-mag.com
unislaw-narty.pl
funworx.de
elliemaccreative.wordpress.com
parksideseniorliving.net
acibademmobil.com.tr
etgdogz.de
aberdeenartwalk.org
goddardleadership.org
levencovka.ru
pilotgreen.com
acumenconsultingcompany.com
deduktia.fi
gurutechnologies.net
monstarrsoccer.com
energosbit-rp.ru
smartmind.net
lisa-poncon.fr
aidanpublishing.co.uk
nuohous.com
janellrardon.com
albcleaner.fr
rhino-storage.co.uk
ludoil.it
rubyaudiology.com
radishallgood.com
slideevents.be
legundschiess.de
lovcase.com
arthakapitalforvaltning.dk
yournextshoes.com
turing.academy
1deals.com
avis.mantova.it
teethinadaydentalimplants.com
sarahspics.co.uk
barbaramcfadyenjewelry.com
tatyanakopieva.ru
nginx.com
claudiakilian.de
look.academy
leopoldineroux.com
hartofurniture.com
mind2muscle.nl
ddmgen.com
acb-gruppe.ch
alwaysdc.com
bcabattoirs.org
bodymindchallenger.com
ebible.co
projektparkiet.pl
apiarista.de
blucamp.com
makingmillionaires.net
voetbalhoogeveen.nl
scietech.academy
pro-gamer.pl
phukienbepthanhdat.com
kelsigordon.com
welovecustomers.fr
voice2biz.com
catering.com
christianscholz.de
tothebackofthemoon.com
leijstrom.com
fascaonline.com
kryptos72.com
silverbird.dk
wg-heiligenstadt.de
cuadc.org
campusce.com
2020hindsight.info
sshomme.com
forextimes.ru
mgimalta.com
stralsund-ansichten.de
metallbau-hartmann.eu
myplaywin3.com
chris-anne.com
gosouldeep.com
bourchier.org
astrographic.com
jdscenter.com
centuryvisionglobal.com
maxcube24.com.ua
ikzoekgod.be
hekecrm.com
bajova.sk
trainiumacademy.com
girlish.ae
breakluckrecords.com
johnstonmingmanning.com
nicksrock.com
ahgarage.com
fitnessblenderstory.com
collegetennis.info
111firstdelray.com
craftstone.co.nz
grancanariaregional.com
witraz.pl
molade.nl
nalliasmali.net
mrcar.nl
andermattswisswatches.ch
mercadodelrio.com
thestudio.academy
soncini.ch
internalresults.com
karelinjames.com
egpu.fr
birthplacemag.com
kerstliedjeszingen.nl
die-immo-agentur.de
prometeyagro.com.ua
nepressurecleaning.com
tzn.nu
ygallerysalonsoho.com:443
worldproskitour.com
brannbornfastigheter.se
profiz.com
christopherhannan.com
singletonfinancial.com
testitjavertailut.net
wyreforest.net
citiscapes-art.com
bcmets.info
neonodi.be
ramirezprono.com
geoweb.software
stitch-n-bitch.com
lgiwines.com
xn--80abehgab4ak0ddz.xn--p1ai
stagefxinc.com
advesa.com
xn--80addfr4ahr.dp.ua
buffdaddyblog.com
switch-made.com
arazi.eus
awaisghauri.com
brisbaneosteopathic.com.au
augen-praxisklinik-rostock.de
casinodepositors.com
xn--billigafrgpatroner-stb.se
cleanroomequipment.ie
pinthelook.com
hawthornsretirement.co.uk
redctei.co
zdrowieszczecin.pl
rentingwell.com
fla.se
opt4cdi.com
dennisverschuur.com
oraweb.net
dnqa.co.uk
levelseven.be
nieuwsindeklas.be
jax-interim-and-projectmanagement.com
condormobile.fr
eurethicsport.eu
valiant-voice.com
autoteamlast.de
redpebblephotography.com
rarefoods.ro
poems-for-the-soul.ch
rechtenplicht.be
humanviruses.org
spectamarketingdigital.com.br
zorgboerderijravensbosch.nl
-
net
true
-
pid
19
-
prc
isqlplussvc.exe
visio.exe
dbsnmp.exe
sqlagent.exe
dbeng50.exe
oracle.exe
mysqld.exe
powerpnt.exe
msaccess.exe
onenote.exe
sqlbrowser.exe
mydesktopqos.exe
excel.exe
ocautoupds.exe
tbirdconfig.exe
msftesql.exe
mysqld_nt.exe
firefoxconfig.exe
mysqld_opt.exe
thebat.exe
xfssvccon.exe
sqbcoreservice.exe
winword.exe
mydesktopservice.exe
wordpad.exe
thebat64.exe
sqlwriter.exe
infopath.exe
ocomm.exe
ocssd.exe
outlook.exe
agntsvc.exe
steam.exe
encsvc.exe
mspub.exe
sqlservr.exe
thunderbird.exe
synctime.exe
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
35
Extracted
C:\Users\92btn-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/1BEC11C8D837290B
http://decryptor.top/1BEC11C8D837290B
Extracted
C:\Users\82c6u0wh3i-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/1C2E4F6D2C2D4181
http://decryptor.top/1C2E4F6D2C2D4181
Targets
-
-
Target
c20ceab7c093c47be023c81164b544ce_JaffaCakes118
-
Size
160KB
-
MD5
c20ceab7c093c47be023c81164b544ce
-
SHA1
de182d48bcc37bcbd1a25f22a0fc6619ce96f69b
-
SHA256
207b3353fa8bcb64966ba9f126e62753a00d22ac3702f2bdd34ec658d6d6144c
-
SHA512
add2c95045cfc9313d03e5b8cc351e90d0d82f2758208f48800db2ad02a39f8f8c60bcf8dce089d5a25e92e9ae2623cb30fc164de384620ce21276d261b32361
-
SSDEEP
1536:LzE8ZQwf8u+MM3PqBmD9PVpVO0Aj7Pbi4eTMluxtXDCntTnICS4Ag9JbMBBjV11l:Kt38mD9P3ILbi4eTMlwDCnumU9zx
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1