General
-
Target
ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118
-
Size
179KB
-
Sample
240921-fnslnswepj
-
MD5
ef1ca1995495a6fad440bbc08ff3f119
-
SHA1
7ba2c18108be1d12a29f090cc1f96f41908ecf6d
-
SHA256
6eb992c4c8453e929ebc737780067f78e50a18934358e44db6d95fca3106e8e2
-
SHA512
558a13b2ef020c246bd840816c983fc8f2e67fb1f59dba1dbb12689a8cba7cb217b190ebedb27dad01b209a6a99fb57df1799f894ecd6f35860e5764fc2f936a
-
SSDEEP
3072:QCmB1vuTljjCAj3jrAprhFmyvEjQDKaUznxQaPx2oL+Bpvjrlc:4BlICIwhFjED39jujxc
Behavioral task
behavioral1
Sample
ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
sodinokibi
19
312
breakluckrecords.com
peninggibadan.co.id
acibademmobil.com.tr
ninjaki.com
mieleshopping.it
modamarfil.com
activeterroristwarningcompany.com
slideevents.be
ygallerysalonsoho.com:443
ddmgen.com
forskolinslimeffect.net
deziplan.ru
solutionshosting.co.uk
smartspeak.com
humanviruses.org
avis.mantova.it
nxtstg.org
craftingalegacy.com
2020hindsight.info
hospitalitytrainingsolutions.co.uk
from02pro.com
catalyseurdetransformation.com
ruggestar.ch
thehovecounsellingpractice.co.uk
billyoart.com
testitjavertailut.net
cardsandloyalty.com
hiddensee-buhne11.de
speakaudible.com
dentallabor-luenen.de
5pointpt.com
mrcar.nl
qrs-international.com
block-optic.com
cainlaw-okc.com
heimdalbygg.no
domilivefurniture.com
kausette.com
altitudeboise.com
nourella.com
kemtron.fr
acb-gruppe.ch
greatofficespaces.net
ilovefullcircle.com
crestgood.com
margaretmcshane.com
asiaartgallery.jp
buffdaddyblog.com
rsidesigns.com
kryptos72.com
luvinsburger.fr
sololibrerie.it
stathmoulis.gr
nginx.com
watchsale.biz
arthakapitalforvaltning.dk
elitkeramika-shop.com.ua
justaroundthecornerpetsit.com
sealgrinderpt.com
linkbuilding.life
skidpiping.de
tutvracks.com
heuvelland-oaze.nl
unislaw-narty.pl
wrinstitute.org
vipcarrental.ae
elex.is
comoserescritor.com
ronaldhendriks.nl
skyboundnutrition.co.uk
speiserei-hannover.de
satoblog.org
leopoldineroux.com
arabianmice.com
maryairbnb.wordpress.com
brownswoodblog.com
hensleymarketing.com
bilius.dk
thegetawaycollective.com
yournextshoes.com
stoneridgemontessori.com
gavelmasters.com
internestdigital.com
cops4causes.org
pazarspor.org.tr
docarefoundation.org
sochi-okna23.ru
hotjapaneselesbian.com
indiebizadvocates.org
nykfdyrehospital.dk
theboardroomafrica.com
hnkns.com
aktivfriskcenter.se
awaisghauri.com
patassociation.com
utilisacteur.fr
terraflair.de
fluzfluzrewards.com
naukaip.ru
premier-iowa.com
bodet150ans.com
reputation-medical.online
proffteplo.com
gosouldeep.com
rattanwarehouse.co.uk
karmeliterviertel.com
citiscapes-art.com
operativadigital.com
lisa-poncon.fr
johnstonmingmanning.com
jimprattmediations.com
thiagoperez.com
chatterchatterchatter.com
karelinjames.com
curtsdiscountguns.com
jollity.hu
aslog.fr
qwikcoach.com
biodentify.ai
fazagostar.co
osn.ro
bajova.sk
sarahspics.co.uk
direitapernambuco.com
silverbird.dk
teamsegeln.ch
fta-media.com
pro-gamer.pl
craftstone.co.nz
diakonie-weitramsdorf-sesslach.de
yourcosmicbeing.com
livedeveloper.com
projektparkiet.pl
skyscanner.ro
eksperdanismanlik.com
parksideseniorliving.net
antesacademy.it
gsconcretecoatings.com
buzzneakers.com
mangimirossana.it
skooppi.fi
animation-pro.co.uk
texanscan.org
fi-institutionalfunds.com
plbinsurance.com
stanleyqualitysystems.com
charlesfrancis.photos
tages-geldvergleich.de
grancanariaregional.com
laylavalentine.com
andreaskildegaard.dk
whoopingcrane.com
promus.ca
triplettagaite.fr
boomerslivinglively.com
netadultere.fr
myfbateam.com
memphishealthandwellness.com
johnsonweekly.com
galaniuklaw.com
tetameble.pl
cymru.futbol
poems-for-the-soul.ch
unexplored.gr
metallbau-hartmann.eu
lashandbrowenvy.com
switch-made.com
loparnille.se
dentalcircle.com
jakubrybak.com
jlwilsonbooks.com
c-sprop.com
molade.nl
schlagbohrmaschinetests.com
zdrowieszczecin.pl
powershell.su
dibli.store
atma.nl
onlinetvgroup.com
clinic-beethovenstrasse-ag.ch
publicompserver.de
fanuli.com.au
rs-danmark.dk
apogeeconseils.fr
almamidwifery.com
die-immo-agentur.de
so-sage.fr
peppergreenfarmcatering.com.au
neolaiamedispa.com
ya-elka.ru
kiraribeaute-nani.com
happycatering.de
nepressurecleaning.com
goeppinger-teppichreinigung.de
omegamarbella.com
look.academy
raeoflightmusic.com
zaczytana.com
agenceassemble.fr
claudiakilian.de
wademurray.com
dennisverschuur.com
askstaffing.com
kickittickets.com
liverpoolabudhabi.ae
geitoniatonaggelon.gr
cmeow.com
mediogiro.com.ar
palmenhaus-erfurt.de
dnqa.co.uk
mediabolmong.com
secrets-clubs.co.uk
skolaprome.eu
kroophold-sjaelland.dk
zinnystar.com
ocduiblog.com
mariannelemenestrel.com
kombi-dress.com
greenrider.nl
belinda.af
oththukaruva.com
mgimalta.com
ideamode.com
bookingwheel.com
frimec-international.es
log-barn.co.uk
pansionatblago.ru
husetsanitas.dk
mslp.org
shortsalemap.com
mondolandscapes.com
advanced-removals.co.uk
rossomattonecase.it
rtc24.com
sycamoregreenapts.com
akcadagofis.com
webforsites.com
lesyeuxbleus.net
itheroes.dk
anleggsregisteret.no
k-zubki.ru
furland.ru
denhaagfoodie.nl
janasfokus.com
ayudaespiritualtamara.com
xtensifi.com
precisetemp.com
nutriwell.com.sg
perfectgrin.com
aberdeenartwalk.org
startuplive.org
fixx-repair.com
sprintcoach.com
mind2muscle.nl
leadforensics.com
ebible.co
smartercashsystem.com
suonenjoen.fi
rubyaudiology.com
yuanshenghotel.com
gta-jjb.fr
axisoflove.org:443
malzomattalar.com
akwaba-safaris.com
rentsportsequip.com
shortysspices.com
bagaholics.in
centuryvisionglobal.com
eurethicsport.eu
angeleyezstripclub.com
profiz.com
bohrlochversicherung.info
mike.matthies.de
amyandzac.com
g2mediainc.com
theater-lueneburg.de
georgemuncey.com
gazelle-du-web.com
saberconcrete.com
specialtyhomeservicesllc.com
latableacrepes-meaux.fr
ijsselbeton.nl
palmecophilippines.com
encounter-p.net
dierenambulancealkmaar.nl
vitormmcosta.com
domaine-des-pothiers.com
keuken-prijs.nl
bayshoreelite.com
arearugcleaningnyc.com
go.labibini.ch
kompresory-opravy.com
bonitabeachassociation.com
cssp-mediation.org
hostastay.com
tramadolhealth.com
alaskaremote.com
atelierkomon.com
natturestaurante.com.br
advesa.com
gbk-tp1.de
chomiksy.net
adedesign.com
kenmccallum.com
airserviceunlimited.com
premiumweb.com.ua:443
trevi-vl.ru
janellrardon.com
zealcon.ae
haus-landliebe.de
davedavisphotos.com
rhino-storage.co.uk
olry-cloisons.fr
alnectus.com
kosten-vochtbestrijding.be
mahikuchen.com
randyabrown.com
inewsstar.com
corporacionrr.com
diverfiestas.com.es
gratiocafeblog.wordpress.com
rozmata.com
tecleados.com
gardenpartner.pl
subquercy.fr
ludoil.it
imaginekithomes.co.nz
yayasanprimaunggul.org
drvoip.com
aidanpublishing.co.uk
dentourage.com
breathebettertolivebetter.com
adaduga.info
pedmanson.com
dayenne-styling.nl
profibersan.com
rokthetalk.com
alene.co
laaisterplakky.nl
rishigangoly.com
imajyuku-sozoku.com
site.markkit.com.br
vdolg24.online
relevantonline.eu
nieuwsindeklas.be
skinkeeper.li
tchernia-conseil.fr
adabible.org
o2o-academy.com
paradigmlandscape.com
narca.net
foerderverein-vatterschule.de
taulunkartano.fi
forumsittard.nl
midwestschool.org
phoenixcrane.com
stagefxinc.com
circlecitydj.com
factoriareloj.com
iactechnologies.net
hypogenforensic.com
greeneyetattoo.com
larchwoodmarketing.com
focuskontur.com
fsbforsale.com
soundseeing.net
eventosvirtualesexitosos.com
carmel-york.com
perceptdecor.com
lovcase.com
charlottelhanna.com
thesilkroadny.com
animalfood-online.de
computer-place.de
fidelitytitleoregon.com
banksrl.co.za
trainiumacademy.com
nevadaruralhousingstudies.org
futurenetworking.com
stressreliefadvice.com
k-v-f.de
ultimatelifesource.com
wallflowersandrakes.com
lagschools.ng
thepixelfairy.com
jeanmonti.com
leloupblanc.gr
redctei.co
selected-minds.de
the5thquestion.com
richardiv.com
hotelturbo.de
astrographic.com
boyfriendsgoal.site
oraweb.net
marcandy.com
geoweb.software
11.in.ua
brannbornfastigheter.se
verbouwingsdouche.nl
aoyama.ac
ziliak.com
livelai.com
licensed-public-adjuster.com
matteoruzzaofficial.com
craftron.com
lyricalduniya.com
m2graph.fr
johnkoen.com
veggienessa.com
bourchier.org
acornishstudio.co.uk
burg-zelem.de
advancedeyecare.com
cleanroomequipment.ie
bodymindchallenger.com
pisofare.co
strauchs-wanderlust.info
expohomes.com
baumfinancialservices.com
collegetennis.info
innovationgames-brabant.nl
stralsund-ansichten.de
afbudsrejserallinclusive.dk
rechtenplicht.be
amelielecompte.wordpress.com
aquacheck.co.za
anchelor.com
bumbipdeco.site
suitesartemis.gr
bundan.com
grafikstudio-visuell.de
catering.com
onesynergyinternational.com
metroton.ru
ciga-france.fr
muni.pe
sshomme.com
the-beauty-guides.com
paprikapod.com
chorusconsulting.net
buonabitare.com
smartmind.net
rolleepollee.com
citydogslife.com
moira-cristescu.com
alltagsrassismus-entknoten.de
chinowarehousespace.com
photographycreativity.co.uk
glennverschueren.be
xrresources.com
bruut.online
hostaletdelsindians.es
mediahub.co.nz
cincinnatiphotocompany.org
mazift.dk
bychowo.pl
epicjapanart.com
littlesaints.academy
biketruck.de
thegrinningmanmusical.com
nationnewsroom.com
tilldeeke.de
turing.academy
berdonllp.com
alattekniksipil.com
cormanmarketing.com
kuriero.pro
signededenroth.dk
avisioninthedesert.com
rizplakatjaya.com
rentingwell.com
loysonbryan.com
mensemetgesigte.co.za
photonag.com
agora-collectivites.com
jglconsultancy.com
hvitfeldt.dk
alabamaroofingllc.com
tbalp.co.uk
werkzeugtrolley.net
schulz-moelln.de
wasnederland.nl
signamedia.de
ox-home.com
duthler.nl
opticahubertruiz.com
catchup-mag.com
saboboxtel.uk
tanatek.com
o90.dk
tastevirginia.com
the-cupboard.co.uk
magrinya.net
endlessrealms.net
sambaglow.com
mjk.digital
christianscholz.de
andermattswisswatches.ch
agendatwentytwenty.com
scotlandsroute66.co.uk
graygreenbiomedservices.com
masecologicos.com
affligemsehondenschool.be
manzel.tn
efficiencyconsulting.es
aceroprime.com
5thactors.com
santastoy.store
albcleaner.fr
sunsolutions.es
electricianul.com
aciscomputers.com
universelle.fr
cookinn.nl
fysiotherapierijnmond.nl
tothebackofthemoon.com
gatlinburgcottage.com
medicalsupportco.com
energosbit-rp.ru
internalresults.com
uncensoredhentaigif.com
sellthewrightway.com
angelsmirrorus.com
spacebel.be
richardkershawwines.co.za
mesajjongeren.nl
jandhpest.com
delegationhub.com
ahgarage.com
boloria.de
dreamvoiceclub.org
customroasts.com
eatyoveges.com
glas-kuck.de
concontactodirecto.com
stringnosis.academy
outstandingminialbums.com
palema.gr
avtoboss163.ru:443
saint-malo-developpement.fr
banukumbak.com
hameghlim.com
harleystreetspineclinic.com
billigeflybilletter.dk
cp-bap.de
frankgoll.com
vvego.com
slotenmakerszwijndrecht.nl
schroederschoembs.com
bendel-partner.de
letterscan.de
bd2fly.com
90nguyentuan.com
noda.com.ua
oro.ae
tieronechic.com
witraz.pl
barbaramcfadyenjewelry.com
alcye.com
pharmeko-group.com
pixelhealth.net
interlinkone.com
jobstomoveamerica.org
amorbellezaysalud.com
baikalflot.ru
guohedd.com
limmortelyouth.com
9nar.com
transifer.fr
endstarvation.com
hawaiisteelbuilding.com
innervisions-id.com
ntinasfiloxenia.gr
zwemofficial.nl
zuerich-umzug.ch
nicksrock.com
maxcube24.com.ua
vitoriaecoturismo.com.br
evsynthacademy.org
renderbox.ch
volta.plus
innersurrection.com
bluemarinefoundation.com
alisodentalcare.com
protoplay.ca
mikegoodfellow.co.uk
prometeyagro.com.ua
spartamovers.com
forextimes.ru
richardmaybury.co.uk
kryddersnapsen.dk
mayprogulka.ru
michaelfiegel.com
hom-frisor.dk
molinum.pt
babysitting-hk.helpergo.co
scholarquotes.com
newonestop.com
nexstagefinancial.com
toranjtuition.org
clemenfoto.dk
tatyanakopieva.ru
3daywebs.com
tesisatonarim.com
mariamalmahdi.com
ownidentity.com
haard-totaal.nl
global-migrate.com
makingmillionaires.net
katherinealy.com
pajagus.fr
supercarhire.co.uk
limounie.com
mariajosediazdemera.com
brighthillgroup.com
ronielyn.com
sveneulberg.de
bcabattoirs.org
reizenmetkinderen.be
drbrianhweeks.com
michal-s.co.il
designimage.ae
rhino-turf.com
directique.com
smartworkplaza.com
finsahome.co.uk
matthieupetel.fr
eos-horlogerie.com
lapponiasafaris.com
angelika-schwarz.com
galatee-couture.com
istantidigitali.com
neonodi.be
xn--80abehgab4ak0ddz.xn--p1ai
wyreforest.net
phukienbepthanhdat.com
insane.agency
topautoinsurers.net
mindsparkescape.com
hostingbangladesh.net
line-x.co.uk
thestudio.academy
spectamarketingdigital.com.br
fbmagazine.ru
lidkopingsnytt.nu
eastgrinsteadwingchun.com
salonlamar.nl
spirello.nl
lovetzuchia.com
nvisionsigns.com
grupoexin10.com
pureelements.nl
buerocenter-butzbach-werbemittel.de
condormobile.fr
voice2biz.com
mac-computer-support-hamburg.de
bratek-immobilien.de
martinipstudios.com
walterman.es
daveystownhouse.com
mundo-pieces-auto.fr
lexced.com
smarttourism.academy
arazi.eus
keyboardjournal.com
khtrx.com
jobkiwi.com.ng
pvandambv.nl
birthplacemag.com
awaitspain.com
sytzedevries.com
yourhappyevents.fr
jefersonalessandro.com
alpesiberie.com
dmlcpa.com
cyberpromote.de
girlish.ae
fotoeditores.com
aheadloftladders.co.uk
levencovka.ru
omnicademy.com
rvside.com
teethinadaydentalimplants.com
frameshift.it
kvetymichalovce.sk
rapid5kloan.org
vapiano.fr
fla.se
globalcompliancenews.com
invela.dk
stitch-n-bitch.com
cap29010.it
pays-saint-flour.fr
singletonfinancial.com
jag.me
fskhjalmar.se
valiant-voice.com
t3brothers.com
pankiss.ru
b3b.ch
riffenmattgarage.ch
datatri.be
easydental.ae
adterium.com
xn--80addfr4ahr.dp.ua
sharonalbrightdds.com
myplaywin3.com
jacquesgarcianoto.com
reygroup.pt
julielusktherapy.com
agrifarm.dk
digitale-elite.de
funworx.de
denverwynkoopdentist.com
lassocrm.com
techybash.com
jaaphoekzema.nl
bcmets.info
miscbo.it
christopherhannan.com
wg-heiligenstadt.de
hinotruckwreckers.com.au
mercadodelrio.com
bmw-i-pure-impulse.com
skoczynski.eu
apiarista.de
solidhosting.nl
rename.kz
kamin-somnium.de
parentsandkids.com
goddardleadership.org
leijstrom.com
enactusnhlstenden.com
ncjc.ca
agriturismocastagneto.it
beauty-traveller.com
xn--ziinoapte-6ld.ro
oscommunity.de
bellesiniacademy.org
glende-pflanzenparadies.de
edvestors.org
descargandoprogramas.com
mazzaropi.com.br
handyman-silkeborg.dk
nauticmarine.dk
martha-frets-ceramics.nl
fitnessblenderstory.com
wordpress.idium.no
dr-vita.de
kellengatton.com
scietech.academy
drnelsonpediatrics.com
initconf.com
weddingceremonieswithtim.com
cac2040.com
theatre-embellie.fr
n-newmedia.de
framemyballs.com
hepishopping.com
kdbrh.com
carsten.sparen-it.de
juergenblaetz.de
jdscenter.com
bescomedical.de
bringmehope.org
baptistdistinctives.org
motocrossplace.co.uk
mursall.de
andrealuchesi.it
creohn.de
espaciopolitica.com
prodentalblue.com
rarefoods.ro
mbuildinghomes.com
legundschiess.de
uci-france.fr
der-stempelking.de
topvijesti.net
artvark.nl
housesofwa.com
nuohous.com
optigas.com
lifeinbreaths.com
p-ride.live
sppdstats.com
explora.nl
sber-biznes.com
belofloripa.be
ced-elec.com
levelseven.be
sjtpo.org
ketomealprep.academy
mollymccarthydesign.com
111firstdelray.com
stage-infirmier.fr
ramirezprono.com
welovecustomers.fr
finnergo.eu
pinkxgayvideoawards.com
mrkluttz.com
luvbec.com
lookandseen.com
janmorgenstern.com
awag-blog.de
the3-week-diet.net
groovedealers.ru
parseport.com
professionetata.com
production-stills.co.uk
floweringsun.org
agencewho-aixenprovence.fr
queertube.net
a-zpaperwork.eu
therapybusinessacademy.com
imagine-entertainment.com
letsstopsmoking.co.uk
leansupremegarcinia.net
test-teleachat.fr
gaearoyals.com
stabilisateur.fr
trivselsguide.dk
hawthornsretirement.co.uk
hoteltantra.com
wribrazil.com
brinkdoepke.eu
bavovrienden.nl
fann.ru
springfieldplumbermo.com
wineandgo.hu
billscars.net
hekecrm.com
bridalcave.com
hutchstyle.co.uk
four-ways.com
ikadomus.com
ufovidmag.com
alharsunindo.com
fire-space.com
primemarineengineering.com
metcalfe.ca
betterce.com
goodboyscustom.com
vedsegaard.dk
tellthebell.website
nalliasmali.net
kartuindonesia.com
putzen-reinigen.com
ikzoekgod.be
min-virksomhed.dk
lsngroupe.com
rino-gmbh.com
annida.it
paardcentraal.nl
eshop.design
atrgroup.it
devus.de
oncarrot.com
jameswilliamspainting.com
altocontatto.net
advance-refle.com
brunoimmobilier.com
thisprettyhair.com
golfclublandgoednieuwkerk.nl
autoteamlast.de
malevannye.ru
cmascd.com
lattalvor.com
jayfurnitureco.com
bertbutter.nl
ravage-webzine.nl
ilveshistoria.com
factorywizuk.com
placermonticello.com
piestar.com
muller.nl
envomask.com
leatherjees.com
racefietsenblog.nl
dinecorp.com
triplettabordeaux.fr
devplus.be
jalkapuu.net
ledyoucan.com
blueridgeheritage.com
orchardbrickwork.com
marmarabasin.com
cc-experts.de
oexebusiness.com
ykobbqchicken.ca
ivancacu.com
broccolisoep.nl
drbenveniste.com
slotspinner.com
apmollerpension.com
lollachiro.com
blavait.fr
bg.szczecin.pl
chris-anne.com
alexwenzel.de
circuit-diagramz.com
pubcon.com
bluetenreich-brilon.de
azerbaycanas.com
nbva.co.uk
polynine.com
victorvictoria.com
wirmuessenreden.com
bulyginnikitav.000webhostapp.com
kelsigordon.com
flossmoordental.com
cesep2019.com
koncept-m.ru
dogsunlimitedguide.com
thenalpa.com
magnetvisual.com
gurutechnologies.net
enews-qca.com
cascinarosa33.it
sbit.ag
iron-mine.ru
benchbiz.com
ceocenters.com
shrinkingplanet.com
brisbaneosteopathic.com.au
pilotgreen.com
druktemakersheerenveen.nl
unboxtherapy.site
egpu.fr
radishallgood.com
napisat-pismo-gubernatoru.ru:443
penumbuhrambutkeiskei.com
iexpert99.com
acumenconsultingcompany.com
pourlabretagne.bzh
basindentistry.com
entdoctor-durban.com
auto-opel.ro
dcc-eu.com
bluelakevision.com
distrifresh.com
etgdogz.de
kafkacare.com
theintellect.edu.pk
onlinemarketingsurgery.co.uk
studionumerik.fr
redpebblephotography.com
irizar.com
fridakids.com
kookooo.com
logosindustries.com
chainofhopeeurope.eu
cuadc.org
happylublog.wordpress.com
yvesdoin-aquarelles.fr
triavlete.com
mneti.ru
bubbalucious.com
successcolony.com.ng
campinglaforetdetesse.com
silkeight.com
soncini.ch
amco.net.au
voetbalhoogeveen.nl
tradenavigator.ch
lgiwines.com
nrgvalue.com
qandmmusiccenter.com
physio-lang.de
auberives-sur-vareze.fr
scentedlair.com
achetrabalhos.com
towelroot.co
lunoluno.com
allinonecampaign.com
motocrosshideout.com
zumrutkuyutemel.com
mustangmarketinggroup.com
hartofurniture.com
sweetz.fr
markseymourphotography.co.uk
tweedekansenloket.nl
eyedoctordallas.com
holocine.de
kristianboennelykke.dk
pokemonturkiye.com
liepertgrafikweb.at
augen-praxisklinik-rostock.de
teutoradio.de
worldproskitour.com
pinthelook.com
deduktia.fi
annenymus.com
tzn.nu
parisschool.ru
traitware.com
mrmac.com
oportowebdesign.com
sachainchiuk.com
carolynfriedlander.com
fascaonline.com
purepreprod4.com
jlgraphisme.fr
chatberlin.de
simpleitsolutions.ch
jax-interim-and-projectmanagement.com
abulanov.com
klapanvent.ru
biblica.com
opt4cdi.com
mamajenedesigns.com
baita.ac
bakingismyyoga.com
nepal-pictures.com
coachpreneuracademy.com
krishnabrawijaya.com
web865.com
business-basic.de
monstarrsoccer.com
cxcompany.com
liveyourheartout.co
quitescorting.com
goodherbalhealth.com
campusescalade.com
schluesseldienste-hannover.de
eafx.pro
globalskills.pt
latteswithleslie.com
colored-shelves.com
blucamp.com
lmmont.sk
subyard.com
kerstliedjeszingen.nl
alwaysdc.com
casinodepositors.com
lumturo.academy
louiedager.com
cotton-avenue.co.il
artcase.pl
airvapourbarrier.com
azloans.com
renehartman.nl
hm-com.com
beandrivingschool.com.au
pxsrl.it
cl0nazepamblog.com
dantreranch.com
fotoslubna.com
zorgboerderijravensbosch.nl
jonnyhooley.com
xn--billigafrgpatroner-stb.se
donau-guides.eu
epsondriversforwindows.com
mindfuelers.com
edrickennedymacfoy.com
bjornvanvulpen.nl
campusce.com
jobscore.com
ingresosextras.online
linearete.com
patriotcleaning.net
landgoedspica.nl
jmmartinezilustrador.com
metriplica.academy
morgansconsult.com
rivermusic.nl
csaballoons.com
dieetuniversiteit.nl
otpusk.zp.ua
ncn.nl
elliemaccreative.wordpress.com
dinedrinkdetroit.com
1deals.com
-
net
true
-
pid
19
-
prc
sqlservr
mysqld_opt
agntsvc
excel
synctime
tbirdconfig
mydesktopservice
isqlplussvc
msaccess
visio
thebat64
dbsnmp
mysqld_nt
infopath
winword
sqbcoreservice
ocssd
sqlbrowser
wordpad
mydesktopqos
oracle
msftesql
thunderbird
encsvc
steam
ocomm
thebat
ocautoupds
sqlwriter
xfssvccon
onenote
powerpnt
outlook
mysqld
sqlagent
firefoxconfig
mspub
dbeng50
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
312
-
svc
svc$
memtas
sophos
veeam
vss
mepocs
backup
sql
Extracted
C:\Users\3nhsb6a3-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/58717A77FB0F58A8
http://decryptor.top/58717A77FB0F58A8
Extracted
C:\Users\37e100706-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/58436FCF84BAB8D8
http://decryptor.top/58436FCF84BAB8D8
Targets
-
-
Target
ef1ca1995495a6fad440bbc08ff3f119_JaffaCakes118
-
Size
179KB
-
MD5
ef1ca1995495a6fad440bbc08ff3f119
-
SHA1
7ba2c18108be1d12a29f090cc1f96f41908ecf6d
-
SHA256
6eb992c4c8453e929ebc737780067f78e50a18934358e44db6d95fca3106e8e2
-
SHA512
558a13b2ef020c246bd840816c983fc8f2e67fb1f59dba1dbb12689a8cba7cb217b190ebedb27dad01b209a6a99fb57df1799f894ecd6f35860e5764fc2f936a
-
SSDEEP
3072:QCmB1vuTljjCAj3jrAprhFmyvEjQDKaUznxQaPx2oL+Bpvjrlc:4BlICIwhFjED39jujxc
Score10/10-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1