General
-
Target
cf79091ecc42a35689672b62e7f968ec_JaffaCakes118
-
Size
161KB
-
Sample
240906-n36qvavclr
-
MD5
cf79091ecc42a35689672b62e7f968ec
-
SHA1
2c5245ebb72616cdf03f4b1a974de2c4ab9f6c60
-
SHA256
1937098609fbbda1b470811a7ffe5fa044058655722d84bd029050d54f2b1496
-
SHA512
031b650d9ee48a531e27871099b40a1901312e4678a79585f33d2e9af7ecd0524c3239c2e3bb7e84ed32bce23e74f755bec9bb70d1e15b2f21a26bb980d343dc
-
SSDEEP
3072:Hp5SexkWi1Lbi4eTMlwDCnu/qW2couRTE:JvGWwbnWJ/X2c1E
Behavioral task
behavioral1
Sample
cf79091ecc42a35689672b62e7f968ec_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
cf79091ecc42a35689672b62e7f968ec_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
sodinokibi
12
313
laylavalentine.com
kristianboennelykke.dk
mahikuchen.com
the5thquestion.com
innovationgames-brabant.nl
pedmanson.com
markseymourphotography.co.uk
alisodentalcare.com
amorbellezaysalud.com
metroton.ru
alnectus.com
deduktia.fi
hoteltantra.com
specialtyhomeservicesllc.com
trainiumacademy.com
signededenroth.dk
dibli.store
christopherhannan.com
bcmets.info
latableacrepes-meaux.fr
molinum.pt
solutionshosting.co.uk
qandmmusiccenter.com
lunoluno.com
atma.nl
metallbau-hartmann.eu
paradigmlandscape.com
forextimes.ru
trevi-vl.ru
computer-place.de
spacebel.be
charlottelhanna.com
secrets-clubs.co.uk
akwaba-safaris.com
factorywizuk.com
mamajenedesigns.com
gaearoyals.com
paprikapod.com
block-optic.com
glas-kuck.de
andermattswisswatches.ch
cotton-avenue.co.il
nutriwell.com.sg
airserviceunlimited.com
natturestaurante.com.br
inewsstar.com
bumbipdeco.site
ultimatelifesource.com
web865.com
electricianul.com
glennverschueren.be
claudiakilian.de
druktemakersheerenveen.nl
humanviruses.org
techybash.com
energosbit-rp.ru
bundan.com
heimdalbygg.no
johnsonweekly.com
comoserescritor.com
hinotruckwreckers.com.au
galaniuklaw.com
egpu.fr
smartercashsystem.com
successcolony.com.ng
eafx.pro
pansionatblago.ru
centuryvisionglobal.com
profiz.com
evsynthacademy.org
acumenconsultingcompany.com
jacquesgarcianoto.com
hvitfeldt.dk
rsidesigns.com
cleanroomequipment.ie
mgimalta.com
kdbrh.com
business-basic.de
line-x.co.uk
rhino-storage.co.uk
fire-space.com
condormobile.fr
fixx-repair.com
fysiotherapierijnmond.nl
luvbec.com
valiant-voice.com
smartworkplaza.com
lassocrm.com
nevadaruralhousingstudies.org
diakonie-weitramsdorf-sesslach.de
hepishopping.com
ntinasfiloxenia.gr
rino-gmbh.com
voice2biz.com
advancedeyecare.com
alcye.com
nauticmarine.dk
amco.net.au
mariamalmahdi.com
precisetemp.com
adabible.org
bavovrienden.nl
ziliak.com
citiscapes-art.com
penumbuhrambutkeiskei.com
makingmillionaires.net
brighthillgroup.com
richardkershawwines.co.za
muni.pe
amelielecompte.wordpress.com
wasnederland.nl
mediabolmong.com
cc-experts.de
coachpreneuracademy.com
so-sage.fr
bescomedical.de
circuit-diagramz.com
turing.academy
bcabattoirs.org
a-zpaperwork.eu
kemtron.fr
cincinnatiphotocompany.org
xn--billigafrgpatroner-stb.se
welovecustomers.fr
tecleados.com
kenmccallum.com
cyberpromote.de
husetsanitas.dk
boomerslivinglively.com
thisprettyhair.com
jobstomoveamerica.org
mrcar.nl
ivancacu.com
futurenetworking.com
tilldeeke.de
duthler.nl
ikadomus.com
kookooo.com
skooppi.fi
rename.kz
fitnessblenderstory.com
redpebblephotography.com
antesacademy.it
andreaskildegaard.dk
linearete.com
karmeliterviertel.com
reygroup.pt
leadforensics.com
frankgoll.com
global-migrate.com
finnergo.eu
epsondriversforwindows.com
fotoeditores.com
flossmoordental.com
lapponiasafaris.com
cac2040.com
ilveshistoria.com
cymru.futbol
bonitabeachassociation.com
the-beauty-guides.com
metriplica.academy
casinodepositors.com
nepressurecleaning.com
delegationhub.com
askstaffing.com
julielusktherapy.com
basindentistry.com
angeleyezstripclub.com
oncarrot.com
eurethicsport.eu
fascaonline.com
dennisverschuur.com
letterscan.de
magnetvisual.com
the-cupboard.co.uk
soundseeing.net
olry-cloisons.fr
redctei.co
jlgraphisme.fr
anleggsregisteret.no
ced-elec.com
framemyballs.com
blucamp.com
citydogslife.com
gazelle-du-web.com
ya-elka.ru
rapid5kloan.org
imajyuku-sozoku.com
reputation-medical.online
mustangmarketinggroup.com
9nar.com
ravage-webzine.nl
opt4cdi.com
gosouldeep.com
bodet150ans.com
cmascd.com
thegrinningmanmusical.com
brownswoodblog.com
min-virksomhed.dk
brisbaneosteopathic.com.au
drbenveniste.com
martinipstudios.com
mrmac.com
pharmeko-group.com
hnkns.com
latteswithleslie.com
morgansconsult.com
dentourage.com
lidkopingsnytt.nu
plbinsurance.com
greenrider.nl
mundo-pieces-auto.fr
oscommunity.de
cssp-mediation.org
chinowarehousespace.com
ayudaespiritualtamara.com
ceocenters.com
aktivfriskcenter.se
unislaw-narty.pl
m2graph.fr
nvisionsigns.com
artcase.pl
ruggestar.ch
bmw-i-pure-impulse.com
ncn.nl
yourcosmicbeing.com
rubyaudiology.com
reizenmetkinderen.be
campusescalade.com
singletonfinancial.com
jefersonalessandro.com
livedeveloper.com
axisoflove.org:443
metcalfe.ca
hostaletdelsindians.es
acornishstudio.co.uk
beauty-traveller.com
holocine.de
mediogiro.com.ar
springfieldplumbermo.com
irizar.com
mariannelemenestrel.com
aberdeenartwalk.org
acb-gruppe.ch
kafkacare.com
focuskontur.com
avisioninthedesert.com
publicompserver.de
teutoradio.de
eatyoveges.com
auto-opel.ro
acibademmobil.com.tr
slotenmakerszwijndrecht.nl
advanced-removals.co.uk
tothebackofthemoon.com
piestar.com
bringmehope.org
invela.dk
legundschiess.de
mesajjongeren.nl
autoteamlast.de
lovcase.com
stitch-n-bitch.com
rozmata.com
theintellect.edu.pk
levencovka.ru
hypogenforensic.com
schlagbohrmaschinetests.com
dinecorp.com
aslog.fr
margaretmcshane.com
k-v-f.de
hensleymarketing.com
production-stills.co.uk
jobkiwi.com.ng
parksideseniorliving.net
watchsale.biz
craftron.com
birthplacemag.com
goodherbalhealth.com
palmecophilippines.com
sunsolutions.es
o2o-academy.com
paardcentraal.nl
thiagoperez.com
witraz.pl
johnstonmingmanning.com
iactechnologies.net
internestdigital.com
ideamode.com
campusce.com
kerstliedjeszingen.nl
sharonalbrightdds.com
barbaramcfadyenjewelry.com
phoenixcrane.com
111firstdelray.com
aquacheck.co.za
martha-frets-ceramics.nl
90nguyentuan.com
towelroot.co
hom-frisor.dk
janellrardon.com
jeanmonti.com
creohn.de
smarttourism.academy
thesilkroadny.com
saberconcrete.com
stage-infirmier.fr
sytzedevries.com
innersurrection.com
beandrivingschool.com.au
mindsparkescape.com
carolynfriedlander.com
glende-pflanzenparadies.de
csaballoons.com
betterce.com
jimprattmediations.com
klapanvent.ru
jlwilsonbooks.com
ygallerysalonsoho.com:443
oexebusiness.com
mslp.org
osn.ro
jalkapuu.net
radishallgood.com
hiddensee-buhne11.de
hotelturbo.de
phukienbepthanhdat.com
boloria.de
donau-guides.eu
stabilisateur.fr
artvark.nl
weddingceremonieswithtim.com
banukumbak.com
pankiss.ru
mjk.digital
skyscanner.ro
michal-s.co.il
putzen-reinigen.com
breathebettertolivebetter.com
die-immo-agentur.de
sbit.ag
goddardleadership.org
babysitting-hk.helpergo.co
skolaprome.eu
tutvracks.com
wirmuessenreden.com
augen-praxisklinik-rostock.de
renderbox.ch
tweedekansenloket.nl
zwemofficial.nl
denhaagfoodie.nl
dnqa.co.uk
catering.com
subquercy.fr
jglconsultancy.com
georgemuncey.com
napisat-pismo-gubernatoru.ru:443
marmarabasin.com
nationnewsroom.com
omnicademy.com
leatherjees.com
lgiwines.com
worldproskitour.com
ludoil.it
ronielyn.com
iron-mine.ru
muller.nl
skoczynski.eu
encounter-p.net
fotoslubna.com
professionetata.com
animalfood-online.de
endstarvation.com
xrresources.com
nalliasmali.net
expohomes.com
slotspinner.com
frimec-international.es
goeppinger-teppichreinigung.de
grafikstudio-visuell.de
datatri.be
awaitspain.com
perceptdecor.com
finsahome.co.uk
physio-lang.de
ijsselbeton.nl
polynine.com
janasfokus.com
diverfiestas.com.es
bodymindchallenger.com
devplus.be
kamin-somnium.de
nicksrock.com
mursall.de
log-barn.co.uk
jakubrybak.com
brunoimmobilier.com
cp-bap.de
supercarhire.co.uk
bjornvanvulpen.nl
digitale-elite.de
eshop.design
mieleshopping.it
scietech.academy
suonenjoen.fi
vedsegaard.dk
cmeow.com
happycatering.de
auberives-sur-vareze.fr
jollity.hu
yuanshenghotel.com
slideevents.be
deziplan.ru
thegetawaycollective.com
descargandoprogramas.com
tieronechic.com
switch-made.com
sprintcoach.com
mariajosediazdemera.com
zuerich-umzug.ch
jax-interim-and-projectmanagement.com
nourella.com
look.academy
brannbornfastigheter.se
bluetenreich-brilon.de
tzn.nu
pixelhealth.net
geitoniatonaggelon.gr
alltagsrassismus-entknoten.de
optigas.com
manzel.tn
entdoctor-durban.com
strauchs-wanderlust.info
yayasanprimaunggul.org
denverwynkoopdentist.com
topvijesti.net
charlesfrancis.photos
baikalflot.ru
leopoldineroux.com
jandhpest.com
hartofurniture.com
ingresosextras.online
internalresults.com
awaisghauri.com
sealgrinderpt.com
lookandseen.com
elex.is
bohrlochversicherung.info
wg-heiligenstadt.de
bridalcave.com
juergenblaetz.de
pisofare.co
arabianmice.com
tbalp.co.uk
raeoflightmusic.com
rokthetalk.com
terraflair.de
fta-media.com
achetrabalhos.com
spectamarketingdigital.com.br
uncensoredhentaigif.com
sellthewrightway.com
mind2muscle.nl
gatlinburgcottage.com
globalcompliancenews.com
pro-gamer.pl
prometeyagro.com.ua
bayshoreelite.com
lattalvor.com
explora.nl
2020hindsight.info
linkbuilding.life
annida.it
adedesign.com
scotlandsroute66.co.uk
spartamovers.com
pajagus.fr
rtc24.com
initconf.com
livelai.com
leloupblanc.gr
bourchier.org
innervisions-id.com
wineandgo.hu
direitapernambuco.com
outstandingminialbums.com
qwikcoach.com
patriotcleaning.net
dentalcircle.com
purepreprod4.com
kosten-vochtbestrijding.be
topautoinsurers.net
teethinadaydentalimplants.com
mazift.dk
kuriero.pro
bagaholics.in
rossomattonecase.it
oraweb.net
four-ways.com
universelle.fr
sycamoregreenapts.com
rolleepollee.com
indiebizadvocates.org
taulunkartano.fi
smartspeak.com
distrifresh.com
hospitalitytrainingsolutions.co.uk
drnelsonpediatrics.com
chainofhopeeurope.eu
burg-zelem.de
fridakids.com
dinedrinkdetroit.com
bg.szczecin.pl
volta.plus
rizplakatjaya.com
devus.de
studionumerik.fr
gavelmasters.com
advesa.com
randyabrown.com
thestudio.academy
satoblog.org
wallflowersandrakes.com
carsten.sparen-it.de
nuohous.com
dieetuniversiteit.nl
enactusnhlstenden.com
fidelitytitleoregon.com
hekecrm.com
shrinkingplanet.com
zealcon.ae
activeterroristwarningcompany.com
theater-lueneburg.de
lsngroupe.com
matteoruzzaofficial.com
perfectgrin.com
masecologicos.com
jaaphoekzema.nl
ocduiblog.com
haard-totaal.nl
dierenambulancealkmaar.nl
vapiano.fr
pubcon.com
agenceassemble.fr
shortysspices.com
sppdstats.com
t3brothers.com
directique.com
ninjaki.com
ketomealprep.academy
rarefoods.ro
lagschools.ng
davedavisphotos.com
limounie.com
annenymus.com
gta-jjb.fr
bilius.dk
bendel-partner.de
envomask.com
test-teleachat.fr
hostingbangladesh.net
laaisterplakky.nl
altitudeboise.com
galatee-couture.com
baita.ac
transifer.fr
fi-institutionalfunds.com
palmenhaus-erfurt.de
onesynergyinternational.com
texanscan.org
oportowebdesign.com
vitormmcosta.com
cesep2019.com
kiraribeaute-nani.com
broccolisoep.nl
harleystreetspineclinic.com
santastoy.store
corporacionrr.com
pureelements.nl
eos-horlogerie.com
bratek-immobilien.de
ufovidmag.com
testitjavertailut.net
aciscomputers.com
nbva.co.uk
happylublog.wordpress.com
vipcarrental.ae
riffenmattgarage.ch
chatberlin.de
abulanov.com
arearugcleaningnyc.com
kickittickets.com
premier-iowa.com
azerbaycanas.com
gratiocafeblog.wordpress.com
avtoboss163.ru:443
peninggibadan.co.id
triplettabordeaux.fr
fskhjalmar.se
pilotgreen.com
mac-computer-support-hamburg.de
cascinarosa33.it
bd2fly.com
chatterchatterchatter.com
zinnystar.com
shortsalemap.com
thehovecounsellingpractice.co.uk
wribrazil.com
buonabitare.com
5pointpt.com
werkzeugtrolley.net
ikzoekgod.be
belofloripa.be
saint-malo-developpement.fr
handyman-silkeborg.dk
modamarfil.com
motocrossplace.co.uk
pinthelook.com
blavait.fr
nieuwsindeklas.be
enews-qca.com
janmorgenstern.com
nexstagefinancial.com
levelseven.be
skyboundnutrition.co.uk
webforsites.com
christianscholz.de
altocontatto.net
proffteplo.com
traitware.com
keyboardjournal.com
nxtstg.org
bruut.online
tages-geldvergleich.de
chomiksy.net
matthieupetel.fr
lyricalduniya.com
limmortelyouth.com
loysonbryan.com
frameshift.it
walterman.es
koncept-m.ru
airvapourbarrier.com
protoplay.ca
furland.ru
xtensifi.com
pvandambv.nl
eastgrinsteadwingchun.com
medicalsupportco.com
maxcube24.com.ua
akcadagofis.com
motocrosshideout.com
tellthebell.website
blueridgeheritage.com
theatre-embellie.fr
imaginekithomes.co.nz
sochi-okna23.ru
ncjc.ca
etgdogz.de
liverpoolabudhabi.ae
oro.ae
opticahubertruiz.com
littlesaints.academy
rattanwarehouse.co.uk
grupoexin10.com
schluesseldienste-hannover.de
bluelakevision.com
kryddersnapsen.dk
katherinealy.com
easydental.ae
stoneridgemontessori.com
baptistdistinctives.org
khtrx.com
apmollerpension.com
angelsmirrorus.com
alexwenzel.de
bulyginnikitav.000webhostapp.com
bluemarinefoundation.com
agendatwentytwenty.com
concontactodirecto.com
jonnyhooley.com
mindfuelers.com
johnkoen.com
powershell.su
from02pro.com
cookinn.nl
ykobbqchicken.ca
projektparkiet.pl
yourhappyevents.fr
lollachiro.com
forumsittard.nl
sambaglow.com
colored-shelves.com
mbuildinghomes.com
malzomattalar.com
narca.net
neonodi.be
cormanmarketing.com
agora-collectivites.com
triavlete.com
sololibrerie.it
miscbo.it
biblica.com
profibersan.com
therapybusinessacademy.com
licensed-public-adjuster.com
bajova.sk
craftingalegacy.com
naukaip.ru
fazagostar.co
kompresory-opravy.com
otpusk.zp.ua
primemarineengineering.com
marcandy.com
unexplored.gr
unboxtherapy.site
parseport.com
bellesiniacademy.org
monstarrsoccer.com
biketruck.de
agriturismocastagneto.it
girlish.ae
goodboyscustom.com
site.markkit.com.br
affligemsehondenschool.be
alene.co
istantidigitali.com
alattekniksipil.com
xn--80abehgab4ak0ddz.xn--p1ai
skidpiping.de
haus-landliebe.de
teamsegeln.ch
agencewho-aixenprovence.fr
prodentalblue.com
veggienessa.com
drbrianhweeks.com
tesisatonarim.com
p-ride.live
molade.nl
mediahub.co.nz
mondolandscapes.com
ddmgen.com
belinda.af
moira-cristescu.com
skinkeeper.li
mangimirossana.it
saboboxtel.uk
adaduga.info
selected-minds.de
domaine-des-pothiers.com
globalskills.pt
zdrowieszczecin.pl
forskolinslimeffect.net
thepixelfairy.com
curtsdiscountguns.com
bakingismyyoga.com
pxsrl.it
pokemonturkiye.com
kryptos72.com
interlinkone.com
espaciopolitica.com
astrographic.com
startuplive.org
k-zubki.ru
factoriareloj.com
bychowo.pl
jobscore.com
grancanariaregional.com
efficiencyconsulting.es
catalyseurdetransformation.com
agrifarm.dk
onlinetvgroup.com
anchelor.com
kombi-dress.com
fsbforsale.com
onlinemarketingsurgery.co.uk
floweringsun.org
queertube.net
the3-week-diet.net
customroasts.com
tatyanakopieva.ru
albcleaner.fr
cuadc.org
rechtenplicht.be
chorusconsulting.net
tetameble.pl
allinonecampaign.com
subyard.com
liveyourheartout.co
uci-france.fr
alwaysdc.com
funworx.de
amyandzac.com
fluzfluzrewards.com
tchernia-conseil.fr
tramadolhealth.com
jmmartinezilustrador.com
nginx.com
richardiv.com
wyreforest.net
keuken-prijs.nl
lashandbrowenvy.com
benchbiz.com
vvego.com
letsstopsmoking.co.uk
buzzneakers.com
greeneyetattoo.com
midwestschool.org
nykfdyrehospital.dk
xn--80addfr4ahr.dp.ua
lesyeuxbleus.net
biodentify.ai
spirello.nl
sveneulberg.de
zaczytana.com
premiumweb.com.ua:443
rivermusic.nl
gurutechnologies.net
mrkluttz.com
eventosvirtualesexitosos.com
rentsportsequip.com
atrgroup.it
mercadodelrio.com
ilovefullcircle.com
memphishealthandwellness.com
andrealuchesi.it
racefietsenblog.nl
peppergreenfarmcatering.com.au
hotjapaneselesbian.com
schulz-moelln.de
ciga-france.fr
mayprogulka.ru
stathmoulis.gr
alaskaremote.com
der-stempelking.de
azloans.com
rishigangoly.com
kausette.com
itheroes.dk
gbk-tp1.de
n-newmedia.de
apiarista.de
catchup-mag.com
hostastay.com
chris-anne.com
graygreenbiomedservices.com
logosindustries.com
cops4causes.org
stanleyqualitysystems.com
apogeeconseils.fr
eksperdanismanlik.com
cardsandloyalty.com
daveystownhouse.com
mollymccarthydesign.com
kartuindonesia.com
photographycreativity.co.uk
maryairbnb.wordpress.com
elitkeramika-shop.com.ua
verbouwingsdouche.nl
poems-for-the-soul.ch
loparnille.se
advance-refle.com
kellengatton.com
gsconcretecoatings.com
suitesartemis.gr
rentingwell.com
collegetennis.info
jameswilliamspainting.com
nrgvalue.com
leansupremegarcinia.net
parentsandkids.com
almamidwifery.com
rs-danmark.dk
g2mediainc.com
sjtpo.org
leijstrom.com
buffdaddyblog.com
tastevirginia.com
sber-biznes.com
boyfriendsgoal.site
asiaartgallery.jp
geoweb.software
cl0nazepamblog.com
billyoart.com
aceroprime.com
qrs-international.com
lifeinbreaths.com
palema.gr
myfbateam.com
larchwoodmarketing.com
neolaiamedispa.com
wademurray.com
dentallabor-luenen.de
mikegoodfellow.co.uk
tradenavigator.ch
clinic-beethovenstrasse-ag.ch
b3b.ch
krishnabrawijaya.com
ramirezprono.com
mike.matthies.de
victorvictoria.com
liepertgrafikweb.at
theboardroomafrica.com
edrickennedymacfoy.com
ox-home.com
pourlabretagne.bzh
kvetymichalovce.sk
dmlcpa.com
animation-pro.co.uk
triplettagaite.fr
photonag.com
placermonticello.com
signamedia.de
sarahspics.co.uk
eyedoctordallas.com
buerocenter-butzbach-werbemittel.de
magrinya.net
heuvelland-oaze.nl
sshomme.com
yvesdoin-aquarelles.fr
ebible.co
crestgood.com
carmel-york.com
orchardbrickwork.com
tanatek.com
schroederschoembs.com
lovetzuchia.com
mensemetgesigte.co.za
pinkxgayvideoawards.com
docarefoundation.org
xn--ziinoapte-6ld.ro
richardmaybury.co.uk
stagefxinc.com
dr-vita.de
solidhosting.nl
ledyoucan.com
afbudsrejserallinclusive.dk
billigeflybilletter.dk
dogsunlimitedguide.com
pazarspor.org.tr
epicjapanart.com
kelsigordon.com
thenalpa.com
ownidentity.com
vitoriaecoturismo.com.br
relevantonline.eu
hameghlim.com
aoyama.ac
scentedlair.com
avis.mantova.it
pays-saint-flour.fr
hawthornsretirement.co.uk
jag.me
stringnosis.academy
o90.dk
promus.ca
hutchstyle.co.uk
cxcompany.com
c-sprop.com
circlecitydj.com
jdscenter.com
karelinjames.com
rvside.com
breakluckrecords.com
nepal-pictures.com
trivselsguide.dk
arthakapitalforvaltning.dk
dreamvoiceclub.org
whoopingcrane.com
bubbalucious.com
lmmont.sk
yournextshoes.com
soncini.ch
speiserei-hannover.de
endlessrealms.net
scholarquotes.com
ronaldhendriks.nl
drvoip.com
guohedd.com
awag-blog.de
lexced.com
alharsunindo.com
aidanpublishing.co.uk
justaroundthecornerpetsit.com
dayenne-styling.nl
wrinstitute.org
golfclublandgoednieuwkerk.nl
netadultere.fr
fann.ru
toranjtuition.org
wordpress.idium.no
rhino-turf.com
groovedealers.ru
insane.agency
mneti.ru
greatofficespaces.net
arazi.eus
mazzaropi.com.br
voetbalhoogeveen.nl
lisa-poncon.fr
bertbutter.nl
brinkdoepke.eu
banksrl.co.za
lumturo.academy
fla.se
sweetz.fr
omegamarbella.com
baumfinancialservices.com
designimage.ae
zumrutkuyutemel.com
malevannye.ru
5thactors.com
1deals.com
alpesiberie.com
fanuli.com.au
dcc-eu.com
imagine-entertainment.com
cap29010.it
clemenfoto.dk
bookingwheel.com
parisschool.ru
vdolg24.online
hm-com.com
atelierkomon.com
cainlaw-okc.com
alabamaroofingllc.com
dantreranch.com
noda.com.ua
housesofwa.com
operativadigital.com
oththukaruva.com
3daywebs.com
zorgboerderijravensbosch.nl
craftstone.co.nz
angelika-schwarz.com
adterium.com
myplaywin3.com
elliemaccreative.wordpress.com
berdonllp.com
luvinsburger.fr
jayfurnitureco.com
fbmagazine.ru
sachainchiuk.com
salonlamar.nl
billscars.net
11.in.ua
utilisacteur.fr
newonestop.com
louiedager.com
campinglaforetdetesse.com
smartmind.net
michaelfiegel.com
stressreliefadvice.com
patassociation.com
silverbird.dk
landgoedspica.nl
edvestors.org
quitescorting.com
stralsund-ansichten.de
silkeight.com
go.labibini.ch
renehartman.nl
gardenpartner.pl
simpleitsolutions.ch
domilivefurniture.com
ahgarage.com
iexpert99.com
foerderverein-vatterschule.de
speakaudible.com
aheadloftladders.co.uk
hawaiisteelbuilding.com
kroophold-sjaelland.dk
-
net
false
-
pid
12
-
prc
ocssd.exe
mydesktopqos.exe
msaccess.exe
winword.exe
thebat64.exe
encsvc.exe
steam.exe
tbirdconfig.exe
dbeng50.exe
w3wp.exe
infopath.exe
javaw.exe
firefoxconfig.exe
synctime.exe
sqbcoreservice.exe
ocautoupds.exe
ocomm.exe
mspub.exe
ax32.exe
ssms.exe
powerpnt.exe
thebat.exe
mysqld_opt.exe
store.exe
excel.exe
thunderbird.exe
wordpad.exe
sqlagent.exe
agntsvc.exe
sqlservr.exe
sqlbrowser.exe
dbsnmp.exe
qbw32.exe
oracle.exe
mydesktopservice.exe
sqlwriter.exe
onenote.exe
mysqld_nt.exe
outlook.exe
isqlplussvc.exe
ax32Serv.exe
xfssvccon.exe
mysqld.exe
msftesql.exe
visio.exe
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
313
Extracted
C:\Recovery\qyoy2q-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/FDB7471741C3CA92
http://decryptor.top/FDB7471741C3CA92
Extracted
C:\Recovery\7jrah72-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BBB00F0FC237B361
http://decryptor.top/BBB00F0FC237B361
Targets
-
-
Target
cf79091ecc42a35689672b62e7f968ec_JaffaCakes118
-
Size
161KB
-
MD5
cf79091ecc42a35689672b62e7f968ec
-
SHA1
2c5245ebb72616cdf03f4b1a974de2c4ab9f6c60
-
SHA256
1937098609fbbda1b470811a7ffe5fa044058655722d84bd029050d54f2b1496
-
SHA512
031b650d9ee48a531e27871099b40a1901312e4678a79585f33d2e9af7ecd0524c3239c2e3bb7e84ed32bce23e74f755bec9bb70d1e15b2f21a26bb980d343dc
-
SSDEEP
3072:Hp5SexkWi1Lbi4eTMlwDCnu/qW2couRTE:JvGWwbnWJ/X2c1E
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-