General
-
Target
d4d5c9676a7b13bdf43d1b8feceeb072_JaffaCakes118
-
Size
698KB
-
Sample
240908-ve97paxblk
-
MD5
d4d5c9676a7b13bdf43d1b8feceeb072
-
SHA1
dffb8f4a7a903422461db695a955096c52a77994
-
SHA256
fc224d7b3b799d4d280821570b5abbb8ae876584223e9338f6eaeec1a0e522c1
-
SHA512
9868ec2ebd8d5f0027cbb704a9096bc8d211c1c26cf2aa1f43262c4f7fd5225d3342392c2921c4611b6db98439c42dbe7ac69ac0e3eec64cffbf8507ce83e9a4
-
SSDEEP
12288:Vj5QBGxzmsepfA1WswUZyNLKPwSMUMcNyPdScygB0G83zAO+QQMCb246F:4BlsepfAcswUZyNqGMrgBs3zF5Q7b24U
Static task
static1
Behavioral task
behavioral1
Sample
d4d5c9676a7b13bdf43d1b8feceeb072_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d4d5c9676a7b13bdf43d1b8feceeb072_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
sodinokibi
14
1045
slotspinner.com
queertube.net
metallbau-hartmann.eu
kristianboennelykke.dk
global-migrate.com
keyboardjournal.com
webforsites.com
kafkacare.com
orchardbrickwork.com
strauchs-wanderlust.info
gaearoyals.com
satoblog.org
thenalpa.com
rino-gmbh.com
humanviruses.org
fridakids.com
dinecorp.com
elex.is
gsconcretecoatings.com
tetameble.pl
arthakapitalforvaltning.dk
bluemarinefoundation.com
smarttourism.academy
thiagoperez.com
racefietsenblog.nl
globalskills.pt
nourella.com
publicompserver.de
nalliasmali.net
endlessrealms.net
netadultere.fr
slideevents.be
brannbornfastigheter.se
smartercashsystem.com
justaroundthecornerpetsit.com
blueridgeheritage.com
lovetzuchia.com
amelielecompte.wordpress.com
catering.com
smartworkplaza.com
dentalcircle.com
vedsegaard.dk
girlish.ae
mike.matthies.de
mahikuchen.com
globalcompliancenews.com
bluetenreich-brilon.de
charlesfrancis.photos
thehovecounsellingpractice.co.uk
internestdigital.com
stringnosis.academy
berdonllp.com
patriotcleaning.net
lattalvor.com
onlinetvgroup.com
apmollerpension.com
cormanmarketing.com
2020hindsight.info
prodentalblue.com
aoyama.ac
johnstonmingmanning.com
sambaglow.com
cc-experts.de
thisprettyhair.com
mercadodelrio.com
turing.academy
liveyourheartout.co
apiarista.de
lassocrm.com
docarefoundation.org
pilotgreen.com
peninggibadan.co.id
zdrowieszczecin.pl
ebible.co
directique.com
augen-praxisklinik-rostock.de
5thactors.com
skolaprome.eu
traitware.com
buffdaddyblog.com
yournextshoes.com
mariajosediazdemera.com
tilldeeke.de
silverbird.dk
bajova.sk
zuerich-umzug.ch
ya-elka.ru
lifeinbreaths.com
martinipstudios.com
diakonie-weitramsdorf-sesslach.de
malzomattalar.com
baikalflot.ru
envomask.com
pinkxgayvideoawards.com
ravage-webzine.nl
xn--billigafrgpatroner-stb.se
quitescorting.com
buerocenter-butzbach-werbemittel.de
gbk-tp1.de
salonlamar.nl
cmascd.com
rozmata.com
mediabolmong.com
collegetennis.info
profiz.com
efficiencyconsulting.es
shrinkingplanet.com
glennverschueren.be
singletonfinancial.com
geitoniatonaggelon.gr
yayasanprimaunggul.org
xtensifi.com
cxcompany.com
randyabrown.com
opt4cdi.com
drbenveniste.com
baumfinancialservices.com
bakingismyyoga.com
biketruck.de
louiedager.com
bonitabeachassociation.com
hartofurniture.com
3daywebs.com
cookinn.nl
jandhpest.com
advesa.com
sprintcoach.com
daveystownhouse.com
tatyanakopieva.ru
catchup-mag.com
business-basic.de
comoserescritor.com
mindsparkescape.com
boomerslivinglively.com
bagaholics.in
mac-computer-support-hamburg.de
galatee-couture.com
avis.mantova.it
site.markkit.com.br
alisodentalcare.com
apogeeconseils.fr
cascinarosa33.it
leloupblanc.gr
michaelfiegel.com
blucamp.com
haus-landliebe.de
the-beauty-guides.com
sealgrinderpt.com
phoenixcrane.com
sarahspics.co.uk
citydogslife.com
wademurray.com
easydental.ae
agora-collectivites.com
bookingwheel.com
housesofwa.com
aslog.fr
piestar.com
raeoflightmusic.com
hawaiisteelbuilding.com
livelai.com
suitesartemis.gr
hoteltantra.com
onesynergyinternational.com
the3-week-diet.net
saboboxtel.uk
rtc24.com
kerstliedjeszingen.nl
makingmillionaires.net
duthler.nl
bridalcave.com
kamin-somnium.de
parisschool.ru
casinodepositors.com
carolynfriedlander.com
cardsandloyalty.com
yvesdoin-aquarelles.fr
powershell.su
thepixelfairy.com
mollymccarthydesign.com
skooppi.fi
ciga-france.fr
rarefoods.ro
ocduiblog.com
so-sage.fr
g2mediainc.com
eafx.pro
gosouldeep.com
harleystreetspineclinic.com
paardcentraal.nl
fbmagazine.ru
fskhjalmar.se
reizenmetkinderen.be
ninjaki.com
jdscenter.com
kompresory-opravy.com
kiraribeaute-nani.com
relevantonline.eu
ronielyn.com
clinic-beethovenstrasse-ag.ch
dibli.store
lookandseen.com
precisetemp.com
o2o-academy.com
gavelmasters.com
biodentify.ai
auto-opel.ro
pays-saint-flour.fr
opticahubertruiz.com
affligemsehondenschool.be
frankgoll.com
jobstomoveamerica.org
paradigmlandscape.com
bubbalucious.com
imajyuku-sozoku.com
rs-danmark.dk
oro.ae
enews-qca.com
molade.nl
the-cupboard.co.uk
itheroes.dk
yourhappyevents.fr
ideamode.com
marcandy.com
agriturismocastagneto.it
polynine.com
energosbit-rp.ru
bd2fly.com
spirello.nl
hensleymarketing.com
imaginekithomes.co.nz
betterce.com
ziliak.com
akwaba-safaris.com
advance-refle.com
dierenambulancealkmaar.nl
drnelsonpediatrics.com
putzen-reinigen.com
startuplive.org
slotenmakerszwijndrecht.nl
nutriwell.com.sg
internalresults.com
gazelle-du-web.com
bulyginnikitav.000webhostapp.com
brisbaneosteopathic.com.au
tesisatonarim.com
verbouwingsdouche.nl
m2graph.fr
chris-anne.com
dentallabor-luenen.de
ikzoekgod.be
vitoriaecoturismo.com.br
ronaldhendriks.nl
ijsselbeton.nl
unboxtherapy.site
uci-france.fr
hawthornsretirement.co.uk
fitnessblenderstory.com
latteswithleslie.com
limounie.com
subquercy.fr
qwikcoach.com
epsondriversforwindows.com
cleanroomequipment.ie
radishallgood.com
lunoluno.com
ntinasfiloxenia.gr
thegetawaycollective.com
zealcon.ae
beauty-traveller.com
cp-bap.de
olry-cloisons.fr
the5thquestion.com
neonodi.be
keuken-prijs.nl
from02pro.com
suonenjoen.fi
operativadigital.com
soundseeing.net
peppergreenfarmcatering.com.au
factorywizuk.com
endstarvation.com
secrets-clubs.co.uk
abulanov.com
sololibrerie.it
breakluckrecords.com
o90.dk
forextimes.ru
pureelements.nl
jaaphoekzema.nl
espaciopolitica.com
professionetata.com
bluelakevision.com
karmeliterviertel.com
shortysspices.com
evsynthacademy.org
citiscapes-art.com
mazift.dk
adedesign.com
ilovefullcircle.com
encounter-p.net
wg-heiligenstadt.de
anchelor.com
zinnystar.com
look.academy
xn--ziinoapte-6ld.ro
newonestop.com
eurethicsport.eu
skidpiping.de
triplettagaite.fr
outstandingminialbums.com
utilisacteur.fr
ingresosextras.online
etgdogz.de
poems-for-the-soul.ch
artcase.pl
fann.ru
morgansconsult.com
licensed-public-adjuster.com
signededenroth.dk
hiddensee-buhne11.de
pisofare.co
magnetvisual.com
amco.net.au
techybash.com
protoplay.ca
pankiss.ru
galaniuklaw.com
saint-malo-developpement.fr
signamedia.de
eos-horlogerie.com
cuadc.org
wribrazil.com
curtsdiscountguns.com
afbudsrejserallinclusive.dk
forumsittard.nl
thegrinningmanmusical.com
kenmccallum.com
tothebackofthemoon.com
kellengatton.com
fascaonline.com
jonnyhooley.com
mondolandscapes.com
hameghlim.com
tutvracks.com
rentingwell.com
ox-home.com
rentsportsequip.com
bodet150ans.com
airvapourbarrier.com
nevadaruralhousingstudies.org
metriplica.academy
diverfiestas.com.es
texanscan.org
palema.gr
agendatwentytwenty.com
bcabattoirs.org
parksideseniorliving.net
bayshoreelite.com
greenrider.nl
flossmoordental.com
initconf.com
agencewho-aixenprovence.fr
eksperdanismanlik.com
jlwilsonbooks.com
der-stempelking.de
corporacionrr.com
zaczytana.com
riffenmattgarage.ch
aktivfriskcenter.se
stressreliefadvice.com
karelinjames.com
kickittickets.com
weddingceremonieswithtim.com
interlinkone.com
eastgrinsteadwingchun.com
lapponiasafaris.com
matthieupetel.fr
bodymindchallenger.com
guohedd.com
santastoy.store
mesajjongeren.nl
annida.it
lumturo.academy
dr-vita.de
trevi-vl.ru
onlinemarketingsurgery.co.uk
aidanpublishing.co.uk
drbrianhweeks.com
electricianul.com
hotjapaneselesbian.com
domilivefurniture.com
leijstrom.com
placermonticello.com
perceptdecor.com
rvside.com
rename.kz
moira-cristescu.com
avtoboss163.ru:443
liepertgrafikweb.at
jmmartinezilustrador.com
tastevirginia.com
volta.plus
rokthetalk.com
paprikapod.com
kroophold-sjaelland.dk
leadforensics.com
bavovrienden.nl
promus.ca
goddardleadership.org
autoteamlast.de
voice2biz.com
jalkapuu.net
hnkns.com
lisa-poncon.fr
topautoinsurers.net
iexpert99.com
auberives-sur-vareze.fr
altitudeboise.com
web865.com
nuohous.com
mrcar.nl
gta-jjb.fr
drvoip.com
perfectgrin.com
pixelhealth.net
nepressurecleaning.com
mbuildinghomes.com
achetrabalhos.com
photonag.com
jobkiwi.com.ng
veggienessa.com
dantreranch.com
cymru.futbol
breathebettertolivebetter.com
90nguyentuan.com
ddmgen.com
innersurrection.com
spacebel.be
mrkluttz.com
michal-s.co.il
johnsonweekly.com
fixx-repair.com
benchbiz.com
ramirezprono.com
oncarrot.com
bertbutter.nl
stage-infirmier.fr
tages-geldvergleich.de
redpebblephotography.com
modamarfil.com
stanleyqualitysystems.com
lyricalduniya.com
greeneyetattoo.com
bumbipdeco.site
bescomedical.de
prometeyagro.com.ua
jobscore.com
zumrutkuyutemel.com
ownidentity.com
johnkoen.com
midwestschool.org
memphishealthandwellness.com
supercarhire.co.uk
carmel-york.com
9nar.com
c-sprop.com
epicjapanart.com
rizplakatjaya.com
kelsigordon.com
altocontatto.net
glas-kuck.de
baptistdistinctives.org
skyscanner.ro
goodherbalhealth.com
centuryvisionglobal.com
mieleshopping.it
napisat-pismo-gubernatoru.ru:443
campusce.com
smartspeak.com
b3b.ch
teethinadaydentalimplants.com
ufovidmag.com
pinthelook.com
fanuli.com.au
xn--80abehgab4ak0ddz.xn--p1ai
atma.nl
mjk.digital
alcye.com
chinowarehousespace.com
theintellect.edu.pk
sycamoregreenapts.com
spectamarketingdigital.com.br
banukumbak.com
bundan.com
limmortelyouth.com
die-immo-agentur.de
wallflowersandrakes.com
angelsmirrorus.com
istantidigitali.com
heimdalbygg.no
ahgarage.com
rolleepollee.com
maxcube24.com.ua
koncept-m.ru
phukienbepthanhdat.com
crestgood.com
kartuindonesia.com
voetbalhoogeveen.nl
ivancacu.com
dieetuniversiteit.nl
qrs-international.com
christianscholz.de
watchsale.biz
bohrlochversicherung.info
atelierkomon.com
aberdeenartwalk.org
lgiwines.com
qandmmusiccenter.com
edrickennedymacfoy.com
hm-com.com
ilveshistoria.com
vipcarrental.ae
pharmeko-group.com
buzzneakers.com
noda.com.ua
albcleaner.fr
wineandgo.hu
cap29010.it
almamidwifery.com
mamajenedesigns.com
bcmets.info
artvark.nl
blavait.fr
chatterchatterchatter.com
reygroup.pt
victorvictoria.com
oexebusiness.com
sunsolutions.es
dentourage.com
unislaw-narty.pl
masecologicos.com
foerderverein-vatterschule.de
andreaskildegaard.dk
billyoart.com
deduktia.fi
claudiakilian.de
ledyoucan.com
theatre-embellie.fr
rishigangoly.com
hypogenforensic.com
dcc-eu.com
futurenetworking.com
k-v-f.de
luvbec.com
axisoflove.org:443
k-zubki.ru
omegamarbella.com
n-newmedia.de
boloria.de
toranjtuition.org
grafikstudio-visuell.de
mensemetgesigte.co.za
sochi-okna23.ru
optigas.com
fluzfluzrewards.com
wrinstitute.org
pxsrl.it
grancanariaregional.com
lollachiro.com
specialtyhomeservicesllc.com
yuanshenghotel.com
kookooo.com
schlagbohrmaschinetests.com
inewsstar.com
aquacheck.co.za
speakaudible.com
ncn.nl
sjtpo.org
universelle.fr
andermattswisswatches.ch
hepishopping.com
chatberlin.de
go.labibini.ch
glende-pflanzenparadies.de
purepreprod4.com
kuriero.pro
irizar.com
mundo-pieces-auto.fr
tieronechic.com
charlottelhanna.com
nieuwsindeklas.be
entdoctor-durban.com
acibademmobil.com.tr
asiaartgallery.jp
avisioninthedesert.com
magrinya.net
pvandambv.nl
kosten-vochtbestrijding.be
mariannelemenestrel.com
vvego.com
ayudaespiritualtamara.com
mayprogulka.ru
triplettabordeaux.fr
log-barn.co.uk
gratiocafeblog.wordpress.com
cac2040.com
zwemofficial.nl
unexplored.gr
ced-elec.com
legundschiess.de
lagschools.ng
domaine-des-pothiers.com
andrealuchesi.it
whoopingcrane.com
awaisghauri.com
werkzeugtrolley.net
sber-biznes.com
arabianmice.com
aceroprime.com
hutchstyle.co.uk
dmlcpa.com
adterium.com
stralsund-ansichten.de
boyfriendsgoal.site
ygallerysalonsoho.com:443
dogsunlimitedguide.com
cops4causes.org
wasnederland.nl
chainofhopeeurope.eu
beandrivingschool.com.au
speiserei-hannover.de
mazzaropi.com.br
pubcon.com
acb-gruppe.ch
ultimatelifesource.com
fsbforsale.com
smartmind.net
mangimirossana.it
loparnille.se
janmorgenstern.com
penumbuhrambutkeiskei.com
bratek-immobilien.de
linearete.com
naukaip.ru
airserviceunlimited.com
anleggsregisteret.no
alene.co
alexwenzel.de
nauticmarine.dk
hekecrm.com
terraflair.de
levelseven.be
production-stills.co.uk
fotoslubna.com
kryptos72.com
focuskontur.com
premiumweb.com.ua:443
laylavalentine.com
digitale-elite.de
premier-iowa.com
livedeveloper.com
ruggestar.ch
successcolony.com.ng
greatofficespaces.net
vapiano.fr
molinum.pt
rapid5kloan.org
palmenhaus-erfurt.de
springfieldplumbermo.com
ludoil.it
mursall.de
basindentistry.com
gatlinburgcottage.com
nepal-pictures.com
tchernia-conseil.fr
burg-zelem.de
shortsalemap.com
nginx.com
photographycreativity.co.uk
larchwoodmarketing.com
bruut.online
transifer.fr
datatri.be
fidelitytitleoregon.com
fire-space.com
valiant-voice.com
craftingalegacy.com
narca.net
cincinnatiphotocompany.org
computer-place.de
ceocenters.com
maryairbnb.wordpress.com
5pointpt.com
yourcosmicbeing.com
jglconsultancy.com
lexced.com
akcadagofis.com
wordpress.idium.no
test-teleachat.fr
wirmuessenreden.com
animalfood-online.de
topvijesti.net
xrresources.com
tellthebell.website
rossomattonecase.it
fysiotherapierijnmond.nl
furland.ru
thestudio.academy
cyberpromote.de
vdolg24.online
physio-lang.de
brinkdoepke.eu
jeanmonti.com
stitch-n-bitch.com
mikegoodfellow.co.uk
plbinsurance.com
cainlaw-okc.com
innervisions-id.com
babysitting-hk.helpergo.co
line-x.co.uk
jax-interim-and-projectmanagement.com
trivselsguide.dk
hospitalitytrainingsolutions.co.uk
muller.nl
bg.szczecin.pl
lesyeuxbleus.net
bjornvanvulpen.nl
solidhosting.nl
devplus.be
hinotruckwreckers.com.au
brighthillgroup.com
nvisionsigns.com
markseymourphotography.co.uk
medicalsupportco.com
mgimalta.com
scholarquotes.com
scentedlair.com
factoriareloj.com
hostaletdelsindians.es
jlgraphisme.fr
insane.agency
circlecitydj.com
holocine.de
skinkeeper.li
dinedrinkdetroit.com
martha-frets-ceramics.nl
lidkopingsnytt.nu
finnergo.eu
customroasts.com
stagefxinc.com
elitkeramika-shop.com.ua
adaduga.info
gardenpartner.pl
krishnabrawijaya.com
acornishstudio.co.uk
aciscomputers.com
groovedealers.ru
lovcase.com
profibersan.com
leatherjees.com
angelika-schwarz.com
triavlete.com
jayfurnitureco.com
jag.me
janasfokus.com
adabible.org
geoweb.software
fotoeditores.com
four-ways.com
palmecophilippines.com
parentsandkids.com
tzn.nu
letterscan.de
p-ride.live
hotelturbo.de
monstarrsoccer.com
alpesiberie.com
parseport.com
theater-lueneburg.de
renehartman.nl
renderbox.ch
cesep2019.com
soncini.ch
floweringsun.org
colored-shelves.com
sveneulberg.de
sachainchiuk.com
belinda.af
logosindustries.com
oraweb.net
selected-minds.de
solutionshosting.co.uk
schroederschoembs.com
wyreforest.net
ykobbqchicken.ca
craftstone.co.nz
bmw-i-pure-impulse.com
jakubrybak.com
chomiksy.net
finsahome.co.uk
patassociation.com
catalyseurdetransformation.com
frameshift.it
arearugcleaningnyc.com
xn--80addfr4ahr.dp.ua
klapanvent.ru
bringmehope.org
bellesiniacademy.org
frimec-international.es
pourlabretagne.bzh
sellthewrightway.com
miscbo.it
fazagostar.co
lmmont.sk
oportowebdesign.com
skyboundnutrition.co.uk
pajagus.fr
laaisterplakky.nl
linkbuilding.life
jollity.hu
arazi.eus
tbalp.co.uk
mediogiro.com.ar
amyandzac.com
margaretmcshane.com
juergenblaetz.de
ncjc.ca
angeleyezstripclub.com
natturestaurante.com.br
advancedeyecare.com
mediahub.co.nz
motocrossplace.co.uk
concontactodirecto.com
theboardroomafrica.com
redctei.co
allinonecampaign.com
stoneridgemontessori.com
clemenfoto.dk
banksrl.co.za
activeterroristwarningcompany.com
pokemonturkiye.com
annenymus.com
imagine-entertainment.com
studionumerik.fr
chorusconsulting.net
teamsegeln.ch
uncensoredhentaigif.com
dnqa.co.uk
schluesseldienste-hannover.de
thesilkroadny.com
oththukaruva.com
rechtenplicht.be
ikadomus.com
campinglaforetdetesse.com
janellrardon.com
descargandoprogramas.com
nykfdyrehospital.dk
druktemakersheerenveen.nl
grupoexin10.com
worldproskitour.com
1deals.com
pansionatblago.ru
bendel-partner.de
atrgroup.it
kausette.com
innovationgames-brabant.nl
forskolinslimeffect.net
azloans.com
11.in.ua
fi-institutionalfunds.com
kryddersnapsen.dk
eatyoveges.com
alltagsrassismus-entknoten.de
trainiumacademy.com
kvetymichalovce.sk
sharonalbrightdds.com
eshop.design
t3brothers.com
eventosvirtualesexitosos.com
julielusktherapy.com
osn.ro
donau-guides.eu
nxtstg.org
jacquesgarcianoto.com
alnectus.com
amorbellezaysalud.com
mind2muscle.nl
goodboyscustom.com
cotton-avenue.co.il
block-optic.com
metroton.ru
georgemuncey.com
cssp-mediation.org
brunoimmobilier.com
tanatek.com
explora.nl
davedavisphotos.com
nationnewsroom.com
gurutechnologies.net
handyman-silkeborg.dk
happycatering.de
designimage.ae
barbaramcfadyenjewelry.com
alwaysdc.com
khtrx.com
haard-totaal.nl
alharsunindo.com
spartamovers.com
husetsanitas.dk
scotlandsroute66.co.uk
golfclublandgoednieuwkerk.nl
scietech.academy
mslp.org
coachpreneuracademy.com
sppdstats.com
rhino-storage.co.uk
advanced-removals.co.uk
hostingbangladesh.net
latableacrepes-meaux.fr
alattekniksipil.com
mariamalmahdi.com
birthplacemag.com
teutoradio.de
mneti.ru
nbva.co.uk
towelroot.co
billscars.net
richardmaybury.co.uk
letsstopsmoking.co.uk
proffteplo.com
dennisverschuur.com
enactusnhlstenden.com
mustangmarketinggroup.com
egpu.fr
pedmanson.com
witraz.pl
csaballoons.com
astrographic.com
muni.pe
sytzedevries.com
saberconcrete.com
dreamvoiceclub.org
funworx.de
billigeflybilletter.dk
mindfuelers.com
lsngroupe.com
agenceassemble.fr
marmarabasin.com
fta-media.com
jefersonalessandro.com
bilius.dk
sshomme.com
tradenavigator.ch
nrgvalue.com
delegationhub.com
liverpoolabudhabi.ae
dayenne-styling.nl
graygreenbiomedservices.com
circuit-diagramz.com
min-virksomhed.dk
deziplan.ru
fla.se
tweedekansenloket.nl
ketomealprep.academy
switch-made.com
sweetz.fr
manzel.tn
framemyballs.com
katherinealy.com
richardkershawwines.co.za
buonabitare.com
subyard.com
denhaagfoodie.nl
awag-blog.de
oscommunity.de
otpusk.zp.ua
bychowo.pl
111firstdelray.com
happylublog.wordpress.com
devus.de
baita.ac
iron-mine.ru
omnicademy.com
alaskaremote.com
sbit.ag
azerbaycanas.com
primemarineengineering.com
distrifresh.com
animation-pro.co.uk
biblica.com
goeppinger-teppichreinigung.de
tecleados.com
jimprattmediations.com
landgoedspica.nl
hom-frisor.dk
carsten.sparen-it.de
belofloripa.be
expohomes.com
hostastay.com
antesacademy.it
stabilisateur.fr
richardiv.com
denverwynkoopdentist.com
lashandbrowenvy.com
campusescalade.com
metcalfe.ca
motocrosshideout.com
stathmoulis.gr
vitormmcosta.com
askstaffing.com
walterman.es
nicksrock.com
agrifarm.dk
mrmac.com
cmeow.com
craftron.com
luvinsburger.fr
hvitfeldt.dk
skoczynski.eu
silkeight.com
iactechnologies.net
rhino-turf.com
condormobile.fr
direitapernambuco.com
matteoruzzaofficial.com
kombi-dress.com
rattanwarehouse.co.uk
alabamaroofingllc.com
rsidesigns.com
kemtron.fr
myplaywin3.com
heuvelland-oaze.nl
loysonbryan.com
eyedoctordallas.com
awaitspain.com
acumenconsultingcompany.com
aheadloftladders.co.uk
leansupremegarcinia.net
malevannye.ru
tramadolhealth.com
indiebizadvocates.org
therapybusinessacademy.com
elliemaccreative.wordpress.com
broccolisoep.nl
neolaiamedispa.com
invela.dk
edvestors.org
myfbateam.com
bourchier.org
littlesaints.academy
projektparkiet.pl
levencovka.ru
zorgboerderijravensbosch.nl
rivermusic.nl
schulz-moelln.de
taulunkartano.fi
creohn.de
rubyaudiology.com
nexstagefinancial.com
kdbrh.com
cl0nazepamblog.com
leopoldineroux.com
pazarspor.org.tr
christopherhannan.com
a-zpaperwork.eu
brownswoodblog.com
testitjavertailut.net
simpleitsolutions.ch
welovecustomers.fr
jameswilliamspainting.com
pro-gamer.pl
reputation-medical.online
-
net
true
-
pid
14
-
prc
outlook
agntsvc
sqbcoreservice
winword
thunderbird
mydesktopqos
isqlplussvc
synctime
tbirdconfig
mydesktopservice
ocomm
dbeng50
visio
steam
firefox
xfssvccon
msaccess
dbsnmp
onenote
sql
mspub
ocautoupds
powerpnt
encsvc
oracle
ocssd
infopath
thebat
wordpa
excel
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
1045
-
svc
sophos
svc$
mepocs
veeam
backup
memtas
sql
vss
Extracted
C:\Users\c7hg0t2xxs-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5AB09E77CE12EBE4
http://decryptor.top/5AB09E77CE12EBE4
Extracted
C:\Users\71vpqptb4-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A5671EB3F1DD60FC
http://decryptor.top/A5671EB3F1DD60FC
Targets
-
-
Target
d4d5c9676a7b13bdf43d1b8feceeb072_JaffaCakes118
-
Size
698KB
-
MD5
d4d5c9676a7b13bdf43d1b8feceeb072
-
SHA1
dffb8f4a7a903422461db695a955096c52a77994
-
SHA256
fc224d7b3b799d4d280821570b5abbb8ae876584223e9338f6eaeec1a0e522c1
-
SHA512
9868ec2ebd8d5f0027cbb704a9096bc8d211c1c26cf2aa1f43262c4f7fd5225d3342392c2921c4611b6db98439c42dbe7ac69ac0e3eec64cffbf8507ce83e9a4
-
SSDEEP
12288:Vj5QBGxzmsepfA1WswUZyNLKPwSMUMcNyPdScygB0G83zAO+QQMCb246F:4BlsepfAcswUZyNqGMrgBs3zF5Q7b24U
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1