General
-
Target
ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118
-
Size
160KB
-
Sample
240920-w55kka1cnb
-
MD5
ee2ffb5c60f9963a1551871a392ed0d0
-
SHA1
97ac4115665ee440bdf4f6f171337cc4bc3e07d3
-
SHA256
b6e27e49d83f82f0feaa1b41d7b8906b9237e08968bb2cd5ae6f4f97b4c9f5c8
-
SHA512
0eed7a60c0322f19bff85489a972f1a15cacf43391d2f497f0a161bdda0c42ac4e86fe4468ee396079db90414e2aa39c8c6758fabca4d856fe935c88c0f10133
-
SSDEEP
3072:Kt38mD9P3ILbi4eTMlwDCnumJ+2JzmJTfmWL:KdNBPAbnWJmcfmWL
Behavioral task
behavioral1
Sample
ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
sodinokibi
20
46
111firstdelray.com
bruut.online
yayasanprimaunggul.org
die-immo-agentur.de
bubbalucious.com
paradigmlandscape.com
limmortelyouth.com
quitescorting.com
hoteltantra.com
legundschiess.de
molade.nl
cascinarosa33.it
customroasts.com
fridakids.com
jefersonalessandro.com
digitale-elite.de
bescomedical.de
dierenambulancealkmaar.nl
imajyuku-sozoku.com
eatyoveges.com
carolynfriedlander.com
itheroes.dk
ilveshistoria.com
theatre-embellie.fr
protoplay.ca
hameghlim.com
ygallerysalonsoho.com:443
omegamarbella.com
nbva.co.uk
pourlabretagne.bzh
cc-experts.de
directique.com
metriplica.academy
motocrossplace.co.uk
naukaip.ru
crestgood.com
forskolinslimeffect.net
hotelturbo.de
jollity.hu
mikegoodfellow.co.uk
secrets-clubs.co.uk
deduktia.fi
pokemonturkiye.com
dreamvoiceclub.org
vitoriaecoturismo.com.br
thisprettyhair.com
catalyseurdetransformation.com
stage-infirmier.fr
agora-collectivites.com
cmascd.com
kerstliedjeszingen.nl
boloria.de
lgiwines.com
altocontatto.net
apmollerpension.com
designimage.ae
midwestschool.org
bratek-immobilien.de
wallflowersandrakes.com
baita.ac
voetbalhoogeveen.nl
linkbuilding.life
jdscenter.com
annida.it
perfectgrin.com
lapponiasafaris.com
rishigangoly.com
radishallgood.com
salonlamar.nl
tetameble.pl
simpleitsolutions.ch
avtoboss163.ru:443
towelroot.co
auto-opel.ro
magnetvisual.com
skinkeeper.li
ultimatelifesource.com
avis.mantova.it
veggienessa.com
apiarista.de
craftingalegacy.com
zumrutkuyutemel.com
innervisions-id.com
mrcar.nl
sveneulberg.de
chorusconsulting.net
palmenhaus-erfurt.de
campusescalade.com
chinowarehousespace.com
factoriareloj.com
mediabolmong.com
chatberlin.de
bd2fly.com
kafkacare.com
premier-iowa.com
fsbforsale.com
greeneyetattoo.com
docarefoundation.org
four-ways.com
hvitfeldt.dk
irizar.com
levencovka.ru
keuken-prijs.nl
billscars.net
tilldeeke.de
buerocenter-butzbach-werbemittel.de
keyboardjournal.com
whoopingcrane.com
rs-danmark.dk
ciga-france.fr
dogsunlimitedguide.com
kelsigordon.com
schluesseldienste-hannover.de
enactusnhlstenden.com
belinda.af
ahgarage.com
t3brothers.com
campusce.com
gbk-tp1.de
glas-kuck.de
vapiano.fr
justaroundthecornerpetsit.com
hawaiisteelbuilding.com
noda.com.ua
scentedlair.com
voice2biz.com
dibli.store
manzel.tn
stralsund-ansichten.de
suonenjoen.fi
lisa-poncon.fr
welovecustomers.fr
fluzfluzrewards.com
jlwilsonbooks.com
aidanpublishing.co.uk
masecologicos.com
gurutechnologies.net
cl0nazepamblog.com
weddingceremonieswithtim.com
factorywizuk.com
greatofficespaces.net
lollachiro.com
sppdstats.com
ideamode.com
baikalflot.ru
hostaletdelsindians.es
ilovefullcircle.com
so-sage.fr
mursall.de
unislaw-narty.pl
duthler.nl
magrinya.net
acb-gruppe.ch
chainofhopeeurope.eu
pro-gamer.pl
hawthornsretirement.co.uk
bakingismyyoga.com
stoneridgemontessori.com
diakonie-weitramsdorf-sesslach.de
almamidwifery.com
rentingwell.com
girlish.ae
pxsrl.it
yuanshenghotel.com
liverpoolabudhabi.ae
livelai.com
nicksrock.com
jonnyhooley.com
mondolandscapes.com
theater-lueneburg.de
worldproskitour.com
cuadc.org
thestudio.academy
ludoil.it
dentallabor-luenen.de
mgimalta.com
humanviruses.org
goddardleadership.org
molinum.pt
theboardroomafrica.com
web865.com
onlinemarketingsurgery.co.uk
arthakapitalforvaltning.dk
jimprattmediations.com
agrifarm.dk
silkeight.com
floweringsun.org
sunsolutions.es
katherinealy.com
liepertgrafikweb.at
alene.co
spartamovers.com
kookooo.com
wordpress.idium.no
fire-space.com
stanleyqualitysystems.com
oraweb.net
opt4cdi.com
fbmagazine.ru
sytzedevries.com
gratiocafeblog.wordpress.com
nykfdyrehospital.dk
topautoinsurers.net
monstarrsoccer.com
cssp-mediation.org
medicalsupportco.com
fskhjalmar.se
burg-zelem.de
aslog.fr
smarttourism.academy
nalliasmali.net
jayfurnitureco.com
stressreliefadvice.com
verbouwingsdouche.nl
techybash.com
cxcompany.com
turing.academy
janmorgenstern.com
malevannye.ru
gosouldeep.com
circlecitydj.com
webforsites.com
nepressurecleaning.com
annenymus.com
thiagoperez.com
sololibrerie.it
encounter-p.net
richardkershawwines.co.za
jglconsultancy.com
skyboundnutrition.co.uk
hostastay.com
marmarabasin.com
xn--80addfr4ahr.dp.ua
traitware.com
greenrider.nl
photonag.com
spacebel.be
beandrivingschool.com.au
lovcase.com
9nar.com
mariamalmahdi.com
eurethicsport.eu
ketomealprep.academy
sjtpo.org
triplettabordeaux.fr
racefietsenblog.nl
specialtyhomeservicesllc.com
wg-heiligenstadt.de
charlottelhanna.com
trainiumacademy.com
haus-landliebe.de
internalresults.com
projektparkiet.pl
toranjtuition.org
geoweb.software
ziliak.com
mrmac.com
phukienbepthanhdat.com
pays-saint-flour.fr
nxtstg.org
slotspinner.com
metallbau-hartmann.eu
speiserei-hannover.de
cac2040.com
boyfriendsgoal.site
yournextshoes.com
dinecorp.com
kickittickets.com
nginx.com
foerderverein-vatterschule.de
gavelmasters.com
oththukaruva.com
pilotgreen.com
outstandingminialbums.com
neolaiamedispa.com
angelsmirrorus.com
11.in.ua
teamsegeln.ch
mac-computer-support-hamburg.de
jameswilliamspainting.com
parksideseniorliving.net
lassocrm.com
nutriwell.com.sg
angeleyezstripclub.com
rechtenplicht.be
skoczynski.eu
oportowebdesign.com
davedavisphotos.com
drnelsonpediatrics.com
spectamarketingdigital.com.br
hostingbangladesh.net
carmel-york.com
vedsegaard.dk
finnergo.eu
kamin-somnium.de
comoserescritor.com
peppergreenfarmcatering.com.au
malzomattalar.com
eastgrinsteadwingchun.com
fazagostar.co
sochi-okna23.ru
hartofurniture.com
artcase.pl
housesofwa.com
jag.me
fitnessblenderstory.com
angelika-schwarz.com
futurenetworking.com
grupoexin10.com
piestar.com
imaginekithomes.co.nz
mahikuchen.com
netadultere.fr
sweetz.fr
lifeinbreaths.com
wrinstitute.org
lyricalduniya.com
thenalpa.com
signededenroth.dk
clemenfoto.dk
trevi-vl.ru
yvesdoin-aquarelles.fr
arazi.eus
global-migrate.com
pisofare.co
craftstone.co.nz
logosindustries.com
k-v-f.de
adterium.com
cleanroomequipment.ie
coachpreneuracademy.com
zwemofficial.nl
renehartman.nl
patassociation.com
cormanmarketing.com
gaearoyals.com
nauticmarine.dk
entdoctor-durban.com
tecleados.com
xn--80abehgab4ak0ddz.xn--p1ai
airvapourbarrier.com
precisetemp.com
innovationgames-brabant.nl
dentourage.com
triavlete.com
blueridgeheritage.com
aoyama.ac
haard-totaal.nl
oscommunity.de
loparnille.se
expohomes.com
myplaywin3.com
smartmind.net
adaduga.info
mindfuelers.com
rizplakatjaya.com
initconf.com
creohn.de
palmecophilippines.com
ox-home.com
domaine-des-pothiers.com
mediogiro.com.ar
sharonalbrightdds.com
bayshoreelite.com
christianscholz.de
fidelitytitleoregon.com
mercadodelrio.com
bendel-partner.de
bodet150ans.com
amyandzac.com
alisodentalcare.com
anleggsregisteret.no
janellrardon.com
rename.kz
basindentistry.com
karelinjames.com
craftron.com
kemtron.fr
alpesiberie.com
photographycreativity.co.uk
furland.ru
unboxtherapy.site
lmmont.sk
strauchs-wanderlust.info
skooppi.fi
banksrl.co.za
narca.net
aktivfriskcenter.se
vipcarrental.ae
antesacademy.it
nuohous.com
rattanwarehouse.co.uk
loysonbryan.com
prodentalblue.com
kellengatton.com
casinodepositors.com
schulz-moelln.de
the-cupboard.co.uk
oro.ae
pvandambv.nl
maryairbnb.wordpress.com
thepixelfairy.com
agriturismocastagneto.it
kenmccallum.com
subyard.com
galaniuklaw.com
rivermusic.nl
koncept-m.ru
trivselsguide.dk
reygroup.pt
alabamaroofingllc.com
therapybusinessacademy.com
happylublog.wordpress.com
leopoldineroux.com
glende-pflanzenparadies.de
wirmuessenreden.com
billyoart.com
saberconcrete.com
shortysspices.com
cincinnatiphotocompany.org
delegationhub.com
rolleepollee.com
ceocenters.com
devus.de
mayprogulka.ru
bcabattoirs.org
kuriero.pro
imagine-entertainment.com
collegetennis.info
alharsunindo.com
vvego.com
fla.se
pedmanson.com
lesyeuxbleus.net
cymru.futbol
hepishopping.com
switch-made.com
log-barn.co.uk
mazift.dk
skolaprome.eu
uci-france.fr
leadforensics.com
elitkeramika-shop.com.ua
universelle.fr
lunoluno.com
soundseeing.net
bourchier.org
charlesfrancis.photos
block-optic.com
schlagbohrmaschinetests.com
mariannelemenestrel.com
business-basic.de
jandhpest.com
cp-bap.de
tutvracks.com
2020hindsight.info
go.labibini.ch
moira-cristescu.com
andreaskildegaard.dk
banukumbak.com
hensleymarketing.com
apogeeconseils.fr
ijsselbeton.nl
axisoflove.org:443
bookingwheel.com
istantidigitali.com
profibersan.com
bellesiniacademy.org
bertbutter.nl
terraflair.de
jalkapuu.net
gazelle-du-web.com
yourhappyevents.fr
breathebettertolivebetter.com
autoteamlast.de
purepreprod4.com
birthplacemag.com
dmlcpa.com
morgansconsult.com
valiant-voice.com
lagschools.ng
nourella.com
klapanvent.ru
m2graph.fr
rhino-storage.co.uk
kosten-vochtbestrijding.be
denverwynkoopdentist.com
rsidesigns.com
santastoy.store
scotlandsroute66.co.uk
bajova.sk
andrealuchesi.it
latableacrepes-meaux.fr
zuerich-umzug.ch
adedesign.com
husetsanitas.dk
silverbird.dk
skyscanner.ro
singletonfinancial.com
makingmillionaires.net
testitjavertailut.net
askstaffing.com
kroophold-sjaelland.dk
graygreenbiomedservices.com
drvoip.com
insane.agency
diverfiestas.com.es
enews-qca.com
eafx.pro
dentalcircle.com
stathmoulis.gr
michaelfiegel.com
espaciopolitica.com
leansupremegarcinia.net
ledyoucan.com
triplettagaite.fr
satoblog.org
broccolisoep.nl
springfieldplumbermo.com
sachainchiuk.com
catering.com
parisschool.ru
muni.pe
biblica.com
promus.ca
sycamoregreenapts.com
supercarhire.co.uk
ruggestar.ch
vdolg24.online
napisat-pismo-gubernatoru.ru:443
kiraribeaute-nani.com
wademurray.com
citiscapes-art.com
bridalcave.com
elex.is
riffenmattgarage.ch
louiedager.com
ced-elec.com
benchbiz.com
kryddersnapsen.dk
inewsstar.com
zealcon.ae
b3b.ch
sshomme.com
nevadaruralhousingstudies.org
metcalfe.ca
uncensoredhentaigif.com
epsondriversforwindows.com
finsahome.co.uk
bmw-i-pure-impulse.com
queertube.net
luvinsburger.fr
redpebblephotography.com
slideevents.be
tastevirginia.com
afbudsrejserallinclusive.dk
edvestors.org
kristianboennelykke.dk
dennisverschuur.com
the5thquestion.com
martinipstudios.com
reputation-medical.online
chris-anne.com
internestdigital.com
xn--billigafrgpatroner-stb.se
kryptos72.com
littlesaints.academy
larchwoodmarketing.com
paardcentraal.nl
baptistdistinctives.org
jakubrybak.com
fysiotherapierijnmond.nl
grafikstudio-visuell.de
smartspeak.com
mazzaropi.com.br
alltagsrassismus-entknoten.de
the-beauty-guides.com
distrifresh.com
pankiss.ru
ebible.co
mneti.ru
awaisghauri.com
lexced.com
5thactors.com
topvijesti.net
atelierkomon.com
zorgboerderijravensbosch.nl
catchup-mag.com
breakluckrecords.com
tages-geldvergleich.de
saboboxtel.uk
rubyaudiology.com
kompresory-opravy.com
efficiencyconsulting.es
shrinkingplanet.com
gardenpartner.pl
colored-shelves.com
perceptdecor.com
thegrinningmanmusical.com
ntinasfiloxenia.gr
dayenne-styling.nl
blucamp.com
easydental.ae
eyedoctordallas.com
otpusk.zp.ua
etgdogz.de
agendatwentytwenty.com
centuryvisionglobal.com
juergenblaetz.de
wasnederland.nl
pubcon.com
artvark.nl
tanatek.com
sealgrinderpt.com
yourcosmicbeing.com
omnicademy.com
jaaphoekzema.nl
peninggibadan.co.id
funworx.de
stabilisateur.fr
markseymourphotography.co.uk
descargandoprogramas.com
interlinkone.com
advesa.com
brighthillgroup.com
berdonllp.com
cops4causes.org
cmeow.com
tweedekansenloket.nl
luvbec.com
amorbellezaysalud.com
schroederschoembs.com
citydogslife.com
christopherhannan.com
donau-guides.eu
grancanariaregional.com
buonabitare.com
forextimes.ru
modamarfil.com
prometeyagro.com.ua
der-stempelking.de
jobscore.com
walterman.es
acumenconsultingcompany.com
animalfood-online.de
globalskills.pt
profiz.com
jlgraphisme.fr
alnectus.com
letterscan.de
linearete.com
olry-cloisons.fr
zdrowieszczecin.pl
opticahubertruiz.com
motocrosshideout.com
johnkoen.com
kdbrh.com
mjk.digital
leatherjees.com
cardsandloyalty.com
scholarquotes.com
liveyourheartout.co
frameshift.it
victorvictoria.com
clinic-beethovenstrasse-ag.ch
atma.nl
polynine.com
thesilkroadny.com
invela.dk
kartuindonesia.com
leloupblanc.gr
buffdaddyblog.com
concontactodirecto.com
kvetymichalovce.sk
hnkns.com
ncn.nl
studionumerik.fr
boomerslivinglively.com
dantreranch.com
transifer.fr
brisbaneosteopathic.com.au
nationnewsroom.com
tbalp.co.uk
hom-frisor.dk
5pointpt.com
daveystownhouse.com
aquacheck.co.za
barbaramcfadyenjewelry.com
awaitspain.com
leijstrom.com
witraz.pl
palema.gr
envomask.com
agenceassemble.fr
3daywebs.com
sber-biznes.com
edrickennedymacfoy.com
mollymccarthydesign.com
a-zpaperwork.eu
fanuli.com.au
focuskontur.com
fi-institutionalfunds.com
latteswithleslie.com
campinglaforetdetesse.com
bychowo.pl
speakaudible.com
biodentify.ai
pharmeko-group.com
fotoeditores.com
bumbipdeco.site
brinkdoepke.eu
brunoimmobilier.com
amelielecompte.wordpress.com
jax-interim-and-projectmanagement.com
tellthebell.website
datatri.be
90nguyentuan.com
redctei.co
atrgroup.it
thehovecounsellingpractice.co.uk
osn.ro
spirello.nl
circuit-diagramz.com
solidhosting.nl
auberives-sur-vareze.fr
parentsandkids.com
ingresosextras.online
alcye.com
successcolony.com.ng
professionetata.com
drbenveniste.com
ddmgen.com
putzen-reinigen.com
smartworkplaza.com
innersurrection.com
jobkiwi.com.ng
martha-frets-ceramics.nl
holocine.de
acibademmobil.com.tr
startuplive.org
egpu.fr
solutionshosting.co.uk
min-virksomhed.dk
mesajjongeren.nl
marcandy.com
michal-s.co.il
relevantonline.eu
scietech.academy
hypogenforensic.com
nrgvalue.com
direitapernambuco.com
bjornvanvulpen.nl
lidkopingsnytt.nu
lashandbrowenvy.com
orchardbrickwork.com
cookinn.nl
azloans.com
texanscan.org
hotjapaneselesbian.com
cap29010.it
chatterchatterchatter.com
teutoradio.de
baumfinancialservices.com
mindsparkescape.com
onlinetvgroup.com
sarahspics.co.uk
memphishealthandwellness.com
iron-mine.ru
happycatering.de
maxcube24.com.ua
aheadloftladders.co.uk
hospitalitytrainingsolutions.co.uk
licensed-public-adjuster.com
blavait.fr
mslp.org
randyabrown.com
lookandseen.com
skidpiping.de
renderbox.ch
ivancacu.com
alwaysdc.com
avisioninthedesert.com
aceroprime.com
azerbaycanas.com
physio-lang.de
mariajosediazdemera.com
heuvelland-oaze.nl
test-teleachat.fr
betterce.com
fotoslubna.com
computer-place.de
tesisatonarim.com
ikzoekgod.be
activeterroristwarningcompany.com
advance-refle.com
soncini.ch
mind2muscle.nl
ncjc.ca
stitch-n-bitch.com
advancedeyecare.com
o2o-academy.com
publicompserver.de
albcleaner.fr
nexstagefinancial.com
wribrazil.com
deziplan.ru
c-sprop.com
iexpert99.com
eventosvirtualesexitosos.com
livedeveloper.com
agencewho-aixenprovence.fr
julielusktherapy.com
domilivefurniture.com
hekecrm.com
mike.matthies.de
cyberpromote.de
asiaartgallery.jp
sbit.ag
muller.nl
bluemarinefoundation.com
g2mediainc.com
augen-praxisklinik-rostock.de
sambaglow.com
line-x.co.uk
lattalvor.com
fta-media.com
xn--ziinoapte-6ld.ro
galatee-couture.com
theintellect.edu.pk
janasfokus.com
eksperdanismanlik.com
sellthewrightway.com
drbrianhweeks.com
astrographic.com
werkzeugtrolley.net
thegetawaycollective.com
from02pro.com
bundan.com
pixelhealth.net
dnqa.co.uk
levelseven.be
k-zubki.ru
mrkluttz.com
1deals.com
slotenmakerszwijndrecht.nl
rozmata.com
iactechnologies.net
tradenavigator.ch
look.academy
volta.plus
ramirezprono.com
rvside.com
belofloripa.be
oncarrot.com
jacquesgarcianoto.com
cotton-avenue.co.il
allinonecampaign.com
devplus.be
dinedrinkdetroit.com
vitormmcosta.com
billigeflybilletter.dk
mamajenedesigns.com
akwaba-safaris.com
acornishstudio.co.uk
rokthetalk.com
saint-malo-developpement.fr
rtc24.com
denhaagfoodie.nl
mediahub.co.nz
johnsonweekly.com
the3-week-diet.net
smartercashsystem.com
utilisacteur.fr
rapid5kloan.org
alaskaremote.com
georgemuncey.com
watchsale.biz
curtsdiscountguns.com
pazarspor.org.tr
bg.szczecin.pl
flossmoordental.com
landgoedspica.nl
krishnabrawijaya.com
mangimirossana.it
hinotruckwreckers.com.au
o90.dk
mustangmarketinggroup.com
geitoniatonaggelon.gr
airserviceunlimited.com
aciscomputers.com
epicjapanart.com
hm-com.com
gsconcretecoatings.com
jobstomoveamerica.org
frimec-international.es
tieronechic.com
tzn.nu
groovedealers.ru
matteoruzzaofficial.com
condormobile.fr
endstarvation.com
heimdalbygg.no
arearugcleaningnyc.com
frankgoll.com
pinkxgayvideoawards.com
production-stills.co.uk
rarefoods.ro
subquercy.fr
lumturo.academy
primemarineengineering.com
optigas.com
framemyballs.com
kombi-dress.com
lovetzuchia.com
tchernia-conseil.fr
teethinadaydentalimplants.com
affligemsehondenschool.be
csaballoons.com
tothebackofthemoon.com
achetrabalhos.com
dr-vita.de
bilius.dk
indiebizadvocates.org
xtensifi.com
arabianmice.com
carsten.sparen-it.de
jeanmonti.com
stagefxinc.com
rentsportsequip.com
p-ride.live
qandmmusiccenter.com
qrs-international.com
rhino-turf.com
guohedd.com
pajagus.fr
claudiakilian.de
mensemetgesigte.co.za
raeoflightmusic.com
eos-horlogerie.com
bagaholics.in
bohrlochversicherung.info
cainlaw-okc.com
letsstopsmoking.co.uk
explora.nl
elliemaccreative.wordpress.com
lsngroupe.com
neonodi.be
miscbo.it
shortsalemap.com
druktemakersheerenveen.nl
wyreforest.net
taulunkartano.fi
nieuwsindeklas.be
rino-gmbh.com
fascaonline.com
nepal-pictures.com
hiddensee-buhne11.de
newonestop.com
alattekniksipil.com
plbinsurance.com
johnstonmingmanning.com
forumsittard.nl
natturestaurante.com.br
bodymindchallenger.com
aberdeenartwalk.org
ronaldhendriks.nl
electricianul.com
gatlinburgcottage.com
jmmartinezilustrador.com
bonitabeachassociation.com
signamedia.de
ninjaki.com
eshop.design
gta-jjb.fr
proffteplo.com
dieetuniversiteit.nl
abulanov.com
richardmaybury.co.uk
ocduiblog.com
wineandgo.hu
cesep2019.com
brownswoodblog.com
andermattswisswatches.ch
stringnosis.academy
ykobbqchicken.ca
chomiksy.net
endlessrealms.net
operativadigital.com
tramadolhealth.com
goeppinger-teppichreinigung.de
biketruck.de
premiumweb.com.ua:443
richardiv.com
akcadagofis.com
laaisterplakky.nl
site.markkit.com.br
golfclublandgoednieuwkerk.nl
limounie.com
powershell.su
handyman-silkeborg.dk
matthieupetel.fr
laylavalentine.com
metroton.ru
ravage-webzine.nl
energosbit-rp.ru
hutchstyle.co.uk
penumbuhrambutkeiskei.com
babysitting-hk.helpergo.co
ikadomus.com
xrresources.com
karmeliterviertel.com
harleystreetspineclinic.com
bavovrienden.nl
phoenixcrane.com
bcmets.info
advanced-removals.co.uk
goodherbalhealth.com
goodboyscustom.com
awag-blog.de
fann.ru
n-newmedia.de
patriotcleaning.net
adabible.org
mundo-pieces-auto.fr
beauty-traveller.com
reizenmetkinderen.be
onesynergyinternational.com
pinthelook.com
suitesartemis.gr
bluelakevision.com
unexplored.gr
anchelor.com
fixx-repair.com
zaczytana.com
nvisionsigns.com
alexwenzel.de
tatyanakopieva.ru
ronielyn.com
sprintcoach.com
pansionatblago.ru
khtrx.com
oexebusiness.com
mieleshopping.it
paprikapod.com
myfbateam.com
globalcompliancenews.com
glennverschueren.be
ayudaespiritualtamara.com
dcc-eu.com
poems-for-the-soul.ch
zinnystar.com
ya-elka.ru
altitudeboise.com
margaretmcshane.com
selected-minds.de
rossomattonecase.it
pureelements.nl
bulyginnikitav.000webhostapp.com
bringmehope.org
amco.net.au
animation-pro.co.uk
mbuildinghomes.com
brannbornfastigheter.se
corporacionrr.com
evsynthacademy.org
qwikcoach.com
ownidentity.com
placermonticello.com
kausette.com
parseport.com
bluetenreich-brilon.de
ufovidmag.com
buzzneakers.com
-
net
true
-
pid
20
-
prc
mysql.exe
sqlservr.exe
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
46
Extracted
C:\Users\h0f28a66k-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/1596C868AA21A8DA
http://decryptor.top/1596C868AA21A8DA
Extracted
C:\Users\0v6at9m04i-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/62F4D4AE0706ECB1
http://decryptor.top/62F4D4AE0706ECB1
Targets
-
-
Target
ee2ffb5c60f9963a1551871a392ed0d0_JaffaCakes118
-
Size
160KB
-
MD5
ee2ffb5c60f9963a1551871a392ed0d0
-
SHA1
97ac4115665ee440bdf4f6f171337cc4bc3e07d3
-
SHA256
b6e27e49d83f82f0feaa1b41d7b8906b9237e08968bb2cd5ae6f4f97b4c9f5c8
-
SHA512
0eed7a60c0322f19bff85489a972f1a15cacf43391d2f497f0a161bdda0c42ac4e86fe4468ee396079db90414e2aa39c8c6758fabca4d856fe935c88c0f10133
-
SSDEEP
3072:Kt38mD9P3ILbi4eTMlwDCnumJ+2JzmJTfmWL:KdNBPAbnWJmcfmWL
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1