General
-
Target
c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118
-
Size
179KB
-
Sample
240829-ddbt3asbqk
-
MD5
c81b771a8e8762a89b54f69a0d7755af
-
SHA1
e884e59df82d2a796c2de1e1c6cbd1e491e16e30
-
SHA256
20684d3edd9d61bbe0a84559c8e197a02a123e697bc8d05bd9305cf1d3984c15
-
SHA512
f2975e6f20bda5c054ea7d4bd385bf9fd52306407a6ae0d01730a340b7bc53582a98e4af4871b01eb5a94c6edfc611014fa17b7e01d7e9150351b5827c99cf2d
-
SSDEEP
3072:LNKQ4JTBg0Q8F63VETed7/kBazzFbULC3pnXSbvYE+l:LNn4FQS63VE6F/M4qe8b4
Behavioral task
behavioral1
Sample
c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
sodinokibi
19
312
beandrivingschool.com.au
husetsanitas.dk
belinda.af
aberdeenartwalk.org
parseport.com
casinodepositors.com
kafkacare.com
dreamvoiceclub.org
kausette.com
metriplica.academy
mahikuchen.com
spectamarketingdigital.com.br
jobkiwi.com.ng
tilldeeke.de
lassocrm.com
ownidentity.com
speakaudible.com
magrinya.net
ufovidmag.com
leansupremegarcinia.net
the3-week-diet.net
skolaprome.eu
istantidigitali.com
designimage.ae
publicompserver.de
teethinadaydentalimplants.com
antesacademy.it
the-cupboard.co.uk
bodymindchallenger.com
tchernia-conseil.fr
condormobile.fr
thepixelfairy.com
wrinstitute.org
triavlete.com
kdbrh.com
albcleaner.fr
ciga-france.fr
riffenmattgarage.ch
jobscore.com
hotelturbo.de
bilius.dk
rino-gmbh.com
pilotgreen.com
physio-lang.de
weddingceremonieswithtim.com
dentourage.com
bubbalucious.com
volta.plus
anleggsregisteret.no
alltagsrassismus-entknoten.de
wasnederland.nl
scietech.academy
aoyama.ac
thestudio.academy
skooppi.fi
mrcar.nl
lyricalduniya.com
protoplay.ca
letterscan.de
jlgraphisme.fr
goddardleadership.org
aciscomputers.com
kickittickets.com
lunoluno.com
gratiocafeblog.wordpress.com
osn.ro
allinonecampaign.com
agrifarm.dk
holocine.de
bratek-immobilien.de
easydental.ae
goeppinger-teppichreinigung.de
axisoflove.org:443
carmel-york.com
rarefoods.ro
stralsund-ansichten.de
artvark.nl
unislaw-narty.pl
natturestaurante.com.br
mensemetgesigte.co.za
hypogenforensic.com
triplettabordeaux.fr
apiarista.de
cleanroomequipment.ie
guohedd.com
gosouldeep.com
morgansconsult.com
memphishealthandwellness.com
nuohous.com
oro.ae
outstandingminialbums.com
1deals.com
ayudaespiritualtamara.com
brownswoodblog.com
santastoy.store
wg-heiligenstadt.de
dr-vita.de
liveyourheartout.co
satoblog.org
eyedoctordallas.com
framemyballs.com
adterium.com
thiagoperez.com
texanscan.org
harleystreetspineclinic.com
slideevents.be
druktemakersheerenveen.nl
ilovefullcircle.com
goodboyscustom.com
kenmccallum.com
rentingwell.com
graygreenbiomedservices.com
bringmehope.org
redpebblephotography.com
apmollerpension.com
prodentalblue.com
theatre-embellie.fr
oththukaruva.com
dnqa.co.uk
profibersan.com
funworx.de
operativadigital.com
cormanmarketing.com
galaniuklaw.com
toranjtuition.org
fridakids.com
suonenjoen.fi
enactusnhlstenden.com
alpesiberie.com
9nar.com
bg.szczecin.pl
theintellect.edu.pk
delegationhub.com
ijsselbeton.nl
jandhpest.com
placermonticello.com
greeneyetattoo.com
citiscapes-art.com
autoteamlast.de
kombi-dress.com
tramadolhealth.com
activeterroristwarningcompany.com
yvesdoin-aquarelles.fr
elliemaccreative.wordpress.com
askstaffing.com
dibli.store
ikadomus.com
cincinnatiphotocompany.org
amorbellezaysalud.com
ziliak.com
techybash.com
rvside.com
palema.gr
girlish.ae
palmecophilippines.com
latableacrepes-meaux.fr
sbit.ag
duthler.nl
peninggibadan.co.id
ykobbqchicken.ca
pays-saint-flour.fr
innersurrection.com
computer-place.de
kvetymichalovce.sk
onlinemarketingsurgery.co.uk
xtensifi.com
comoserescritor.com
linkbuilding.life
dinedrinkdetroit.com
johnstonmingmanning.com
linearete.com
plbinsurance.com
radishallgood.com
curtsdiscountguns.com
licensed-public-adjuster.com
mediabolmong.com
the-beauty-guides.com
birthplacemag.com
furland.ru
tatyanakopieva.ru
terraflair.de
yuanshenghotel.com
go.labibini.ch
forextimes.ru
lesyeuxbleus.net
annenymus.com
boyfriendsgoal.site
naukaip.ru
premier-iowa.com
bjornvanvulpen.nl
apogeeconseils.fr
acumenconsultingcompany.com
drbenveniste.com
tellthebell.website
yourhappyevents.fr
astrographic.com
leatherjees.com
jlwilsonbooks.com
rechtenplicht.be
nieuwsindeklas.be
piestar.com
charlesfrancis.photos
cp-bap.de
hensleymarketing.com
mursall.de
augen-praxisklinik-rostock.de
perfectgrin.com
o2o-academy.com
drvoip.com
oncarrot.com
diakonie-weitramsdorf-sesslach.de
kristianboennelykke.dk
auto-opel.ro
amyandzac.com
smarttourism.academy
gsconcretecoatings.com
thegetawaycollective.com
hm-com.com
log-barn.co.uk
interlinkone.com
ronaldhendriks.nl
paardcentraal.nl
happycatering.de
precisetemp.com
k-v-f.de
corporacionrr.com
mustangmarketinggroup.com
cssp-mediation.org
a-zpaperwork.eu
uncensoredhentaigif.com
qandmmusiccenter.com
kamin-somnium.de
hotjapaneselesbian.com
hostingbangladesh.net
jameswilliamspainting.com
pankiss.ru
taulunkartano.fi
xn--80addfr4ahr.dp.ua
proffteplo.com
domaine-des-pothiers.com
iexpert99.com
p-ride.live
koncept-m.ru
elitkeramika-shop.com.ua
wyreforest.net
successcolony.com.ng
jollity.hu
billyoart.com
n-newmedia.de
solidhosting.nl
putzen-reinigen.com
direitapernambuco.com
carsten.sparen-it.de
edvestors.org
patriotcleaning.net
catchup-mag.com
endlessrealms.net
fidelitytitleoregon.com
b3b.ch
oraweb.net
ceocenters.com
martinipstudios.com
matthieupetel.fr
bruut.online
janasfokus.com
kartuindonesia.com
beauty-traveller.com
reputation-medical.online
floweringsun.org
saberconcrete.com
hoteltantra.com
ikzoekgod.be
galatee-couture.com
cl0nazepamblog.com
mjk.digital
catalyseurdetransformation.com
parksideseniorliving.net
sambaglow.com
wineandgo.hu
dieetuniversiteit.nl
voetbalhoogeveen.nl
lagschools.ng
bmw-i-pure-impulse.com
ocduiblog.com
bendel-partner.de
arabianmice.com
carolynfriedlander.com
mazzaropi.com.br
futurenetworking.com
aidanpublishing.co.uk
thehovecounsellingpractice.co.uk
lumturo.academy
aquacheck.co.za
hekecrm.com
dayenne-styling.nl
speiserei-hannover.de
annida.it
ninjaki.com
jmmartinezilustrador.com
t3brothers.com
janmorgenstern.com
parisschool.ru
silverbird.dk
advancedeyecare.com
yournextshoes.com
thegrinningmanmusical.com
sochi-okna23.ru
amelielecompte.wordpress.com
m2graph.fr
kelsigordon.com
jeanmonti.com
clinic-beethovenstrasse-ag.ch
ilveshistoria.com
netadultere.fr
collegetennis.info
factoriareloj.com
2020hindsight.info
teutoradio.de
fanuli.com.au
kuriero.pro
utilisacteur.fr
diverfiestas.com.es
suitesartemis.gr
oexebusiness.com
aheadloftladders.co.uk
billigeflybilletter.dk
tieronechic.com
valiant-voice.com
topautoinsurers.net
explora.nl
line-x.co.uk
andermattswisswatches.ch
cxcompany.com
happylublog.wordpress.com
glas-kuck.de
hawaiisteelbuilding.com
sber-biznes.com
smartercashsystem.com
witraz.pl
gazelle-du-web.com
entdoctor-durban.com
atelierkomon.com
jdscenter.com
qwikcoach.com
lashandbrowenvy.com
berdonllp.com
111firstdelray.com
breakluckrecords.com
thesilkroadny.com
kryddersnapsen.dk
luvinsburger.fr
ahgarage.com
testitjavertailut.net
hospitalitytrainingsolutions.co.uk
nrgvalue.com
leijstrom.com
supercarhire.co.uk
frimec-international.es
leadforensics.com
descargandoprogramas.com
marcandy.com
craftron.com
ultimatelifesource.com
ivancacu.com
artcase.pl
belofloripa.be
rentsportsequip.com
nepressurecleaning.com
o90.dk
karelinjames.com
production-stills.co.uk
michaelfiegel.com
nepal-pictures.com
liepertgrafikweb.at
cops4causes.org
min-virksomhed.dk
gta-jjb.fr
tanatek.com
cardsandloyalty.com
onesynergyinternational.com
initconf.com
jglconsultancy.com
rtc24.com
bluetenreich-brilon.de
soundseeing.net
walterman.es
poems-for-the-soul.ch
fi-institutionalfunds.com
malevannye.ru
block-optic.com
fire-space.com
domilivefurniture.com
focuskontur.com
basindentistry.com
cmeow.com
angelsmirrorus.com
avtoboss163.ru:443
photographycreativity.co.uk
catering.com
wordpress.idium.no
coachpreneuracademy.com
agora-collectivites.com
gardenpartner.pl
silkeight.com
wallflowersandrakes.com
chatberlin.de
bayshoreelite.com
internalresults.com
leopoldineroux.com
dierenambulancealkmaar.nl
espaciopolitica.com
medicalsupportco.com
bulyginnikitav.000webhostapp.com
landgoedspica.nl
dcc-eu.com
molinum.pt
acornishstudio.co.uk
mrkluttz.com
kroophold-sjaelland.dk
eos-horlogerie.com
pixelhealth.net
bescomedical.de
alabamaroofingllc.com
johnsonweekly.com
ravage-webzine.nl
schulz-moelln.de
schroederschoembs.com
chainofhopeeurope.eu
daveystownhouse.com
imaginekithomes.co.nz
flossmoordental.com
maxcube24.com.ua
sololibrerie.it
jax-interim-and-projectmanagement.com
so-sage.fr
watchsale.biz
pxsrl.it
electricianul.com
site.markkit.com.br
lattalvor.com
traitware.com
buzzneakers.com
distrifresh.com
fixx-repair.com
mariamalmahdi.com
arthakapitalforvaltning.dk
nbva.co.uk
spirello.nl
scotlandsroute66.co.uk
billscars.net
khtrx.com
handyman-silkeborg.dk
dennisverschuur.com
orchardbrickwork.com
startuplive.org
kosten-vochtbestrijding.be
baptistdistinctives.org
dantreranch.com
buffdaddyblog.com
digitale-elite.de
hartofurniture.com
shortsalemap.com
skyboundnutrition.co.uk
onlinetvgroup.com
saboboxtel.uk
signamedia.de
biketruck.de
photonag.com
singletonfinancial.com
kiraribeaute-nani.com
tbalp.co.uk
stathmoulis.gr
zdrowieszczecin.pl
tecleados.com
otpusk.zp.ua
spacebel.be
skyscanner.ro
crestgood.com
vitoriaecoturismo.com.br
airserviceunlimited.com
envomask.com
goodherbalhealth.com
sycamoregreenapts.com
ygallerysalonsoho.com:443
endstarvation.com
vipcarrental.ae
alnectus.com
drbrianhweeks.com
finsahome.co.uk
mac-computer-support-hamburg.de
signededenroth.dk
bourchier.org
mind2muscle.nl
nationnewsroom.com
breathebettertolivebetter.com
secrets-clubs.co.uk
rhino-storage.co.uk
rename.kz
mrmac.com
chatterchatterchatter.com
webforsites.com
forumsittard.nl
adedesign.com
fotoslubna.com
metcalfe.ca
scentedlair.com
optigas.com
look.academy
martha-frets-ceramics.nl
juergenblaetz.de
baita.ac
cmascd.com
soncini.ch
deziplan.ru
livelai.com
internestdigital.com
rubyaudiology.com
azerbaycanas.com
lgiwines.com
craftingalegacy.com
lovetzuchia.com
cuadc.org
voice2biz.com
broccolisoep.nl
iron-mine.ru
raeoflightmusic.com
reizenmetkinderen.be
trevi-vl.ru
bellesiniacademy.org
sharonalbrightdds.com
elex.is
sjtpo.org
humanviruses.org
banukumbak.com
neonodi.be
stringnosis.academy
groovedealers.ru
lisa-poncon.fr
alaskaremote.com
oportowebdesign.com
makingmillionaires.net
golfclublandgoednieuwkerk.nl
biblica.com
lidkopingsnytt.nu
bohrlochversicherung.info
xn--80abehgab4ak0ddz.xn--p1ai
pisofare.co
eventosvirtualesexitosos.com
myplaywin3.com
smartworkplaza.com
banksrl.co.za
shrinkingplanet.com
fascaonline.com
bumbipdeco.site
angeleyezstripclub.com
latteswithleslie.com
ledyoucan.com
epsondriversforwindows.com
auberives-sur-vareze.fr
evsynthacademy.org
gurutechnologies.net
insane.agency
chorusconsulting.net
heuvelland-oaze.nl
omnicademy.com
jacquesgarcianoto.com
mariannelemenestrel.com
alattekniksipil.com
abulanov.com
projektparkiet.pl
monstarrsoccer.com
eatyoveges.com
greatofficespaces.net
innervisions-id.com
zwemofficial.nl
gatlinburgcottage.com
affligemsehondenschool.be
mslp.org
chris-anne.com
pazarspor.org.tr
richardkershawwines.co.za
acb-gruppe.ch
invela.dk
stanleyqualitysystems.com
arearugcleaningnyc.com
rolleepollee.com
richardiv.com
thenalpa.com
scholarquotes.com
mangimirossana.it
ruggestar.ch
acibademmobil.com.tr
pinthelook.com
nalliasmali.net
limounie.com
from02pro.com
skidpiping.de
phoenixcrane.com
almamidwifery.com
turing.academy
efficiencyconsulting.es
aceroprime.com
drnelsonpediatrics.com
manzel.tn
tages-geldvergleich.de
levencovka.ru
hostaletdelsindians.es
strauchs-wanderlust.info
90nguyentuan.com
premiumweb.com.ua:443
tzn.nu
alcye.com
rapid5kloan.org
universelle.fr
dmlcpa.com
fskhjalmar.se
wribrazil.com
matteoruzzaofficial.com
haus-landliebe.de
blavait.fr
inewsstar.com
haard-totaal.nl
nxtstg.org
agriturismocastagneto.it
bundan.com
topvijesti.net
bridalcave.com
mondolandscapes.com
sytzedevries.com
trivselsguide.dk
buonabitare.com
mesajjongeren.nl
thisprettyhair.com
glennverschueren.be
devplus.be
agencewho-aixenprovence.fr
michal-s.co.il
justaroundthecornerpetsit.com
omegamarbella.com
airvapourbarrier.com
saint-malo-developpement.fr
zaczytana.com
peppergreenfarmcatering.com.au
pansionatblago.ru
racefietsenblog.nl
pro-gamer.pl
bakingismyyoga.com
imajyuku-sozoku.com
bluelakevision.com
barbaramcfadyenjewelry.com
c-sprop.com
bajova.sk
andreaskildegaard.dk
phukienbepthanhdat.com
pajagus.fr
quitescorting.com
epicjapanart.com
ced-elec.com
tetameble.pl
redctei.co
mariajosediazdemera.com
moira-cristescu.com
amco.net.au
verbouwingsdouche.nl
der-stempelking.de
unboxtherapy.site
bookingwheel.com
jonnyhooley.com
encounter-p.net
zealcon.ae
four-ways.com
pharmeko-group.com
sealgrinderpt.com
malzomattalar.com
5pointpt.com
levelseven.be
yourcosmicbeing.com
alharsunindo.com
3daywebs.com
stoneridgemontessori.com
keyboardjournal.com
egpu.fr
xrresources.com
geitoniatonaggelon.gr
devus.de
atma.nl
pubcon.com
imagine-entertainment.com
cap29010.it
fbmagazine.ru
indiebizadvocates.org
renehartman.nl
noda.com.ua
rizplakatjaya.com
cotton-avenue.co.il
perceptdecor.com
transifer.fr
afbudsrejserallinclusive.dk
ox-home.com
shortysspices.com
modamarfil.com
renderbox.ch
dentalcircle.com
simpleitsolutions.ch
sveneulberg.de
rivermusic.nl
subquercy.fr
vitormmcosta.com
sppdstats.com
kookooo.com
professionetata.com
awaisghauri.com
die-immo-agentur.de
nauticmarine.dk
spartamovers.com
jobstomoveamerica.org
christopherhannan.com
ebible.co
glende-pflanzenparadies.de
primemarineengineering.com
rattanwarehouse.co.uk
selected-minds.de
globalskills.pt
k-zubki.ru
centuryvisionglobal.com
olry-cloisons.fr
maryairbnb.wordpress.com
cookinn.nl
studionumerik.fr
altitudeboise.com
housesofwa.com
boloria.de
pinkxgayvideoawards.com
5thactors.com
aslog.fr
stagefxinc.com
alexwenzel.de
craftstone.co.nz
brannbornfastigheter.se
oscommunity.de
fla.se
rozmata.com
cascinarosa33.it
tweedekansenloket.nl
littlesaints.academy
ideamode.com
loparnille.se
grancanariaregional.com
deduktia.fi
ramirezprono.com
mercadodelrio.com
colored-shelves.com
sachainchiuk.com
bodet150ans.com
theboardroomafrica.com
the5thquestion.com
sweetz.fr
tothebackofthemoon.com
kerstliedjeszingen.nl
blueridgeheritage.com
legundschiess.de
anchelor.com
hom-frisor.dk
business-basic.de
mindsparkescape.com
alwaysdc.com
luvbec.com
logosindustries.com
midwestschool.org
eksperdanismanlik.com
xn--billigafrgpatroner-stb.se
kellengatton.com
veggienessa.com
patassociation.com
uci-france.fr
prometeyagro.com.ua
mgimalta.com
rsidesigns.com
slotenmakerszwijndrecht.nl
tutvracks.com
bd2fly.com
avisioninthedesert.com
lifeinbreaths.com
animalfood-online.de
relevantonline.eu
nutriwell.com.sg
mindfuelers.com
klapanvent.ru
akcadagofis.com
atrgroup.it
laylavalentine.com
baikalflot.ru
nexstagefinancial.com
cc-experts.de
lexced.com
greenrider.nl
jag.me
mediogiro.com.ar
motocrossplace.co.uk
kryptos72.com
hiddensee-buhne11.de
purepreprod4.com
napisat-pismo-gubernatoru.ru:443
itheroes.dk
hepishopping.com
pedmanson.com
advesa.com
jayfurnitureco.com
etgdogz.de
heimdalbygg.no
eastgrinsteadwingchun.com
whoopingcrane.com
triplettagaite.fr
promus.ca
cainlaw-okc.com
mbuildinghomes.com
parentsandkids.com
fluzfluzrewards.com
g2mediainc.com
factorywizuk.com
unexplored.gr
mundo-pieces-auto.fr
bertbutter.nl
trainiumacademy.com
circlecitydj.com
opticahubertruiz.com
loysonbryan.com
eurethicsport.eu
global-migrate.com
akwaba-safaris.com
smartmind.net
jakubrybak.com
jefersonalessandro.com
nicksrock.com
denverwynkoopdentist.com
nourella.com
queertube.net
bcmets.info
powershell.su
jimprattmediations.com
arazi.eus
penumbuhrambutkeiskei.com
achetrabalhos.com
nvisionsigns.com
grupoexin10.com
solutionshosting.co.uk
teamsegeln.ch
newonestop.com
schlagbohrmaschinetests.com
reygroup.pt
geoweb.software
edrickennedymacfoy.com
zumrutkuyutemel.com
subyard.com
test-teleachat.fr
victorvictoria.com
agendatwentytwenty.com
motocrosshideout.com
mazift.dk
theater-lueneburg.de
foerderverein-vatterschule.de
dogsunlimitedguide.com
margaretmcshane.com
ronielyn.com
sshomme.com
azloans.com
grafikstudio-visuell.de
customroasts.com
ntinasfiloxenia.gr
bonitabeachassociation.com
sunsolutions.es
slotspinner.com
vdolg24.online
polynine.com
yayasanprimaunggul.org
fitnessblenderstory.com
advance-refle.com
ya-elka.ru
donau-guides.eu
irizar.com
mayprogulka.ru
welovecustomers.fr
xn--ziinoapte-6ld.ro
fazagostar.co
animation-pro.co.uk
masecologicos.com
gaearoyals.com
cac2040.com
laaisterplakky.nl
stitch-n-bitch.com
denhaagfoodie.nl
katherinealy.com
adabible.org
awaitspain.com
markseymourphotography.co.uk
stage-infirmier.fr
worldproskitour.com
hameghlim.com
wademurray.com
hutchstyle.co.uk
hostastay.com
werkzeugtrolley.net
campinglaforetdetesse.com
lookandseen.com
ncn.nl
georgemuncey.com
claudiakilian.de
chomiksy.net
paradigmlandscape.com
eshop.design
mediahub.co.nz
towelroot.co
neolaiamedispa.com
benchbiz.com
enews-qca.com
andrealuchesi.it
janellrardon.com
sarahspics.co.uk
finnergo.eu
mikegoodfellow.co.uk
citydogslife.com
advanced-removals.co.uk
stressreliefadvice.com
ingresosextras.online
nginx.com
miscbo.it
vapiano.fr
schluesseldienste-hannover.de
narca.net
metroton.ru
kemtron.fr
stabilisateur.fr
nykfdyrehospital.dk
asiaartgallery.jp
pourlabretagne.bzh
nevadaruralhousingstudies.org
ncjc.ca
globalcompliancenews.com
louiedager.com
alisodentalcare.com
limmortelyouth.com
zinnystar.com
hnkns.com
letsstopsmoking.co.uk
rossomattonecase.it
liverpoolabudhabi.ae
metallbau-hartmann.eu
randyabrown.com
gbk-tp1.de
creohn.de
keuken-prijs.nl
skinkeeper.li
salonlamar.nl
datatri.be
richardmaybury.co.uk
innovationgames-brabant.nl
paprikapod.com
bavovrienden.nl
smartspeak.com
lollachiro.com
brisbaneosteopathic.com.au
directique.com
springfieldplumbermo.com
boomerslivinglively.com
zorgboerderijravensbosch.nl
iactechnologies.net
jalkapuu.net
molade.nl
leloupblanc.gr
fta-media.com
krishnabrawijaya.com
bagaholics.in
biodentify.ai
rhino-turf.com
expohomes.com
hinotruckwreckers.com.au
brighthillgroup.com
fsbforsale.com
fotoeditores.com
marmarabasin.com
cyberpromote.de
sprintcoach.com
therapybusinessacademy.com
davedavisphotos.com
myfbateam.com
vedsegaard.dk
altocontatto.net
opt4cdi.com
pokemonturkiye.com
lsngroupe.com
eafx.pro
11.in.ua
rs-danmark.dk
charlottelhanna.com
docarefoundation.org
campusce.com
kompresory-opravy.com
dinecorp.com
avis.mantova.it
muller.nl
frankgoll.com
baumfinancialservices.com
bluemarinefoundation.com
mneti.ru
buerocenter-butzbach-werbemittel.de
rokthetalk.com
dentallabor-luenen.de
pvandambv.nl
ddmgen.com
qrs-international.com
zuerich-umzug.ch
angelika-schwarz.com
concontactodirecto.com
switch-made.com
circuit-diagramz.com
mieleshopping.it
wirmuessenreden.com
burg-zelem.de
web865.com
bcabattoirs.org
vvego.com
christianscholz.de
betterce.com
alene.co
bychowo.pl
hawthornsretirement.co.uk
lovcase.com
lapponiasafaris.com
magnetvisual.com
tastevirginia.com
muni.pe
lmmont.sk
aktivfriskcenter.se
adaduga.info
fann.ru
chinowarehousespace.com
blucamp.com
cesep2019.com
mike.matthies.de
skoczynski.eu
sellthewrightway.com
energosbit-rp.ru
mamajenedesigns.com
rishigangoly.com
mollymccarthydesign.com
julielusktherapy.com
brunoimmobilier.com
campusescalade.com
cymru.futbol
gavelmasters.com
babysitting-hk.helpergo.co
ludoil.it
palmenhaus-erfurt.de
brinkdoepke.eu
livedeveloper.com
fysiotherapierijnmond.nl
tradenavigator.ch
agenceassemble.fr
frameshift.it
forskolinslimeffect.net
karmeliterviertel.com
profiz.com
larchwoodmarketing.com
ketomealprep.academy
csaballoons.com
awag-blog.de
specialtyhomeservicesllc.com
pureelements.nl
hvitfeldt.dk
johnkoen.com
clemenfoto.dk
jaaphoekzema.nl
tesisatonarim.com
-
net
true
-
pid
19
-
prc
mydesktopqos
thebat
outlook
steam
mysqld_nt
powerpnt
dbsnmp
visio
onenote
mysqld_opt
wordpad
ocautoupds
mspub
mydesktopservice
tbirdconfig
infopath
isqlplussvc
mysqld
firefoxconfig
oracle
excel
sqlbrowser
sqbcoreservice
thunderbird
thebat64
ocssd
winword
dbeng50
sqlwriter
synctime
ocomm
agntsvc
xfssvccon
msaccess
sqlservr
msftesql
encsvc
sqlagent
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
312
-
svc
vss
sophos
backup
svc$
memtas
sql
mepocs
veeam
Extracted
C:\Users\x2bg3-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/012163FB9AB67C21
http://decryptor.top/012163FB9AB67C21
Extracted
C:\Users\4s01om-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/624BDC51DD2E3936
http://decryptor.top/624BDC51DD2E3936
Targets
-
-
Target
c81b771a8e8762a89b54f69a0d7755af_JaffaCakes118
-
Size
179KB
-
MD5
c81b771a8e8762a89b54f69a0d7755af
-
SHA1
e884e59df82d2a796c2de1e1c6cbd1e491e16e30
-
SHA256
20684d3edd9d61bbe0a84559c8e197a02a123e697bc8d05bd9305cf1d3984c15
-
SHA512
f2975e6f20bda5c054ea7d4bd385bf9fd52306407a6ae0d01730a340b7bc53582a98e4af4871b01eb5a94c6edfc611014fa17b7e01d7e9150351b5827c99cf2d
-
SSDEEP
3072:LNKQ4JTBg0Q8F63VETed7/kBazzFbULC3pnXSbvYE+l:LNn4FQS63VE6F/M4qe8b4
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1