General
-
Target
f3a0cb122ce523e9f0fb9bc04fcc6756_JaffaCakes118
-
Size
158KB
-
Sample
240924-ph8v5svbnr
-
MD5
f3a0cb122ce523e9f0fb9bc04fcc6756
-
SHA1
f80bc74b31d78a67e430a9f45884334c2f685616
-
SHA256
5928db8b7b1714ead51392ad809242cd5a158defefe5309f3ae0238c20a500ab
-
SHA512
3d187707aa5978cec8cbbd9061714ba1cf7561decf8142f4ace4cadd0d0f73947e7b9a06c11b9c3fa1ff7c02229b3d4f24cd9a6cf6d48af1f2726af950df0f4d
-
SSDEEP
3072:lYplXYpKWmsLbi4eTMlwDCnuyKz/PeQ7Gxl:2zI0WXbnWJTGx
Behavioral task
behavioral1
Sample
f3a0cb122ce523e9f0fb9bc04fcc6756_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
f3a0cb122ce523e9f0fb9bc04fcc6756_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
sodinokibi
21
56
burg-zelem.de
cesep2019.com
min-virksomhed.dk
palema.gr
parksideseniorliving.net
grupoexin10.com
advance-refle.com
baumfinancialservices.com
bcabattoirs.org
yourhappyevents.fr
smartmind.net
matthieupetel.fr
kickittickets.com
brinkdoepke.eu
jandhpest.com
aoyama.ac
fi-institutionalfunds.com
dieetuniversiteit.nl
ludoil.it
hawthornsretirement.co.uk
insane.agency
latableacrepes-meaux.fr
lesyeuxbleus.net
greeneyetattoo.com
michaelfiegel.com
leadforensics.com
bumbipdeco.site
internestdigital.com
gavelmasters.com
jmmartinezilustrador.com
gatlinburgcottage.com
astrographic.com
blueridgeheritage.com
campusce.com
peppergreenfarmcatering.com.au
loysonbryan.com
mind2muscle.nl
paardcentraal.nl
m2graph.fr
atrgroup.it
katherinealy.com
lumturo.academy
luvbec.com
kellengatton.com
pankiss.ru
domaine-des-pothiers.com
mike.matthies.de
kerstliedjeszingen.nl
topautoinsurers.net
shortsalemap.com
bd2fly.com
aquacheck.co.za
condormobile.fr
etgdogz.de
stagefxinc.com
rhino-turf.com
galaniuklaw.com
rhino-storage.co.uk
epicjapanart.com
baita.ac
nrgvalue.com
skoczynski.eu
poems-for-the-soul.ch
vedsegaard.dk
schluesseldienste-hannover.de
handyman-silkeborg.dk
advancedeyecare.com
nxtstg.org
patassociation.com
margaretmcshane.com
lmmont.sk
cssp-mediation.org
skooppi.fi
cincinnatiphotocompany.org
carsten.sparen-it.de
louiedager.com
allinonecampaign.com
ideamode.com
invela.dk
ygallerysalonsoho.com:443
ownidentity.com
yvesdoin-aquarelles.fr
kristianboennelykke.dk
explora.nl
photographycreativity.co.uk
arthakapitalforvaltning.dk
the-cupboard.co.uk
paprikapod.com
billscars.net
dmlcpa.com
afbudsrejserallinclusive.dk
ya-elka.ru
bajova.sk
mrcar.nl
amyandzac.com
humanviruses.org
ruggestar.ch
thesilkroadny.com
topvijesti.net
altocontatto.net
agriturismocastagneto.it
b3b.ch
quitescorting.com
asiaartgallery.jp
piestar.com
mahikuchen.com
tbalp.co.uk
khtrx.com
lookandseen.com
basindentistry.com
ijsselbeton.nl
ziliak.com
gazelle-du-web.com
relevantonline.eu
reputation-medical.online
nykfdyrehospital.dk
spartamovers.com
ilveshistoria.com
brighthillgroup.com
encounter-p.net
rolleepollee.com
akwaba-safaris.com
innovationgames-brabant.nl
askstaffing.com
geoweb.software
customroasts.com
devus.de
distrifresh.com
mjk.digital
aslog.fr
metcalfe.ca
texanscan.org
racefietsenblog.nl
dogsunlimitedguide.com
happycatering.de
purepreprod4.com
pilotgreen.com
sshomme.com
richardmaybury.co.uk
phukienbepthanhdat.com
rivermusic.nl
xn--ziinoapte-6ld.ro
scholarquotes.com
beandrivingschool.com.au
molinum.pt
jefersonalessandro.com
acornishstudio.co.uk
glende-pflanzenparadies.de
liverpoolabudhabi.ae
chomiksy.net
cmeow.com
bagaholics.in
airvapourbarrier.com
chorusconsulting.net
loparnille.se
subyard.com
ntinasfiloxenia.gr
inewsstar.com
zorgboerderijravensbosch.nl
riffenmattgarage.ch
enews-qca.com
thegrinningmanmusical.com
alaskaremote.com
mundo-pieces-auto.fr
kompresory-opravy.com
airserviceunlimited.com
thepixelfairy.com
envomask.com
sveneulberg.de
diakonie-weitramsdorf-sesslach.de
littlesaints.academy
apogeeconseils.fr
haard-totaal.nl
campusescalade.com
lagschools.ng
pisofare.co
keuken-prijs.nl
oportowebdesign.com
ilovefullcircle.com
pvandambv.nl
omnicademy.com
jaaphoekzema.nl
eurethicsport.eu
silverbird.dk
markseymourphotography.co.uk
oraweb.net
geitoniatonaggelon.gr
larchwoodmarketing.com
hom-frisor.dk
placermonticello.com
narca.net
singletonfinancial.com
wordpress.idium.no
laylavalentine.com
duthler.nl
liepertgrafikweb.at
onlinemarketingsurgery.co.uk
fotoslubna.com
eyedoctordallas.com
andrealuchesi.it
greatofficespaces.net
webforsites.com
richardiv.com
catering.com
hartofurniture.com
cmascd.com
alexwenzel.de
alnectus.com
alltagsrassismus-entknoten.de
ciga-france.fr
baptistdistinctives.org
n-newmedia.de
juergenblaetz.de
nutriwell.com.sg
bookingwheel.com
sprintcoach.com
amorbellezaysalud.com
kryddersnapsen.dk
strauchs-wanderlust.info
the5thquestion.com
lovetzuchia.com
annida.it
fascaonline.com
stabilisateur.fr
dnqa.co.uk
die-immo-agentur.de
golfclublandgoednieuwkerk.nl
bescomedical.de
sachainchiuk.com
switch-made.com
easydental.ae
sunsolutions.es
malzomattalar.com
victorvictoria.com
unboxtherapy.site
dreamvoiceclub.org
ikadomus.com
axisoflove.org:443
gosouldeep.com
magnetvisual.com
stressreliefadvice.com
maryairbnb.wordpress.com
drnelsonpediatrics.com
aciscomputers.com
licensed-public-adjuster.com
glas-kuck.de
itheroes.dk
speakaudible.com
alwaysdc.com
nuohous.com
ikzoekgod.be
iactechnologies.net
soncini.ch
tellthebell.website
fanuli.com.au
towelroot.co
cormanmarketing.com
hiddensee-buhne11.de
aktivfriskcenter.se
elliemaccreative.wordpress.com
adabible.org
naukaip.ru
cxcompany.com
voetbalhoogeveen.nl
mrmac.com
agenceassemble.fr
malevannye.ru
masecologicos.com
zumrutkuyutemel.com
tesisatonarim.com
akcadagofis.com
kryptos72.com
tweedekansenloket.nl
schlagbohrmaschinetests.com
denverwynkoopdentist.com
bonitabeachassociation.com
sbit.ag
cops4causes.org
pansionatblago.ru
eksperdanismanlik.com
apiarista.de
subquercy.fr
test-teleachat.fr
successcolony.com.ng
dentourage.com
orchardbrickwork.com
elitkeramika-shop.com.ua
leopoldineroux.com
nginx.com
alcye.com
happylublog.wordpress.com
skinkeeper.li
jag.me
druktemakersheerenveen.nl
buerocenter-butzbach-werbemittel.de
martinipstudios.com
valiant-voice.com
newonestop.com
pxsrl.it
aceroprime.com
sambaglow.com
martha-frets-ceramics.nl
tothebackofthemoon.com
fidelitytitleoregon.com
trevi-vl.ru
scotlandsroute66.co.uk
kemtron.fr
hostaletdelsindians.es
xn--80abehgab4ak0ddz.xn--p1ai
fluzfluzrewards.com
altitudeboise.com
enactusnhlstenden.com
wrinstitute.org
hinotruckwreckers.com.au
pokemonturkiye.com
arabianmice.com
acibademmobil.com.tr
four-ways.com
adaduga.info
frameshift.it
santastoy.store
leatherjees.com
verbouwingsdouche.nl
hepishopping.com
hm-com.com
skolaprome.eu
leansupremegarcinia.net
keyboardjournal.com
turing.academy
vipcarrental.ae
antesacademy.it
smartworkplaza.com
hoteltantra.com
direitapernambuco.com
selected-minds.de
hotjapaneselesbian.com
evsynthacademy.org
carmel-york.com
boyfriendsgoal.site
thiagoperez.com
vapiano.fr
bodymindchallenger.com
efficiencyconsulting.es
bychowo.pl
livedeveloper.com
publicompserver.de
brannbornfastigheter.se
jameswilliamspainting.com
cp-bap.de
blavait.fr
jdscenter.com
miscbo.it
lashandbrowenvy.com
palmecophilippines.com
block-optic.com
90nguyentuan.com
agencewho-aixenprovence.fr
pixelhealth.net
schulz-moelln.de
wallflowersandrakes.com
log-barn.co.uk
penumbuhrambutkeiskei.com
fixx-repair.com
oscommunity.de
diverfiestas.com.es
kafkacare.com
boloria.de
eafx.pro
espaciopolitica.com
foerderverein-vatterschule.de
lexced.com
cac2040.com
moira-cristescu.com
artvark.nl
denhaagfoodie.nl
broccolisoep.nl
luvinsburger.fr
banksrl.co.za
wg-heiligenstadt.de
clemenfoto.dk
neonodi.be
rubyaudiology.com
bundan.com
brisbaneosteopathic.com.au
proffteplo.com
modamarfil.com
from02pro.com
tastevirginia.com
chainofhopeeurope.eu
oncarrot.com
bmw-i-pure-impulse.com
dibli.store
tramadolhealth.com
nepal-pictures.com
oththukaruva.com
fsbforsale.com
livelai.com
molade.nl
bulyginnikitav.000webhostapp.com
iron-mine.ru
bridalcave.com
precisetemp.com
dayenne-styling.nl
parseport.com
affligemsehondenschool.be
gta-jjb.fr
donau-guides.eu
maxcube24.com.ua
bohrlochversicherung.info
wyreforest.net
fysiotherapierijnmond.nl
koncept-m.ru
smartspeak.com
tradenavigator.ch
augen-praxisklinik-rostock.de
peninggibadan.co.id
fotoeditores.com
fla.se
clinic-beethovenstrasse-ag.ch
rozmata.com
gratiocafeblog.wordpress.com
fridakids.com
amco.net.au
lovcase.com
biketruck.de
scietech.academy
trivselsguide.dk
zealcon.ae
ravage-webzine.nl
epsondriversforwindows.com
kombi-dress.com
manzel.tn
xn--80addfr4ahr.dp.ua
linearete.com
t3brothers.com
tzn.nu
buzzneakers.com
solutionshosting.co.uk
kroophold-sjaelland.dk
ncjc.ca
redpebblephotography.com
dcc-eu.com
collegetennis.info
stoneridgemontessori.com
ingresosextras.online
sjtpo.org
docarefoundation.org
coachpreneuracademy.com
zaczytana.com
agora-collectivites.com
advesa.com
hutchstyle.co.uk
galatee-couture.com
g2mediainc.com
letterscan.de
factorywizuk.com
techybash.com
sharonalbrightdds.com
initconf.com
plbinsurance.com
ykobbqchicken.ca
cardsandloyalty.com
creohn.de
deduktia.fi
ced-elec.com
perceptdecor.com
deziplan.ru
bluetenreich-brilon.de
floweringsun.org
grafikstudio-visuell.de
qandmmusiccenter.com
walterman.es
go.labibini.ch
metroton.ru
logosindustries.com
qrs-international.com
charlesfrancis.photos
electricianul.com
thestudio.academy
supercarhire.co.uk
fskhjalmar.se
amelielecompte.wordpress.com
slideevents.be
lisa-poncon.fr
smartercashsystem.com
zdrowieszczecin.pl
bringmehope.org
triavlete.com
sber-biznes.com
hensleymarketing.com
goddardleadership.org
eshop.design
cookinn.nl
worldproskitour.com
operativadigital.com
outstandingminialbums.com
fbmagazine.ru
auto-opel.ro
mangimirossana.it
projektparkiet.pl
benchbiz.com
liveyourheartout.co
annenymus.com
frankgoll.com
premier-iowa.com
chris-anne.com
laaisterplakky.nl
leloupblanc.gr
lidkopingsnytt.nu
o90.dk
mindfuelers.com
mamajenedesigns.com
awaitspain.com
advanced-removals.co.uk
k-zubki.ru
silkeight.com
spacebel.be
phoenixcrane.com
wirmuessenreden.com
5pointpt.com
nicksrock.com
innersurrection.com
thegetawaycollective.com
claudiakilian.de
justaroundthecornerpetsit.com
elex.is
angeleyezstripclub.com
protoplay.ca
davedavisphotos.com
tecleados.com
datatri.be
furland.ru
reizenmetkinderen.be
chatterchatterchatter.com
111firstdelray.com
pureelements.nl
trainiumacademy.com
ivancacu.com
carolynfriedlander.com
tieronechic.com
universelle.fr
natturestaurante.com.br
glennverschueren.be
imaginekithomes.co.nz
goodboyscustom.com
rishigangoly.com
global-migrate.com
mensemetgesigte.co.za
goeppinger-teppichreinigung.de
kiraribeaute-nani.com
angelsmirrorus.com
gardenpartner.pl
scentedlair.com
stringnosis.academy
albcleaner.fr
marmarabasin.com
redctei.co
dentalcircle.com
3daywebs.com
powershell.su
lsngroupe.com
nexstagefinancial.com
husetsanitas.dk
slotenmakerszwijndrecht.nl
atma.nl
simpleitsolutions.ch
primemarineengineering.com
gurutechnologies.net
hospitalitytrainingsolutions.co.uk
jakubrybak.com
limounie.com
flossmoordental.com
pajagus.fr
zwemofficial.nl
bjornvanvulpen.nl
ahgarage.com
radishallgood.com
biodentify.ai
slotspinner.com
edvestors.org
heimdalbygg.no
adedesign.com
bavovrienden.nl
jobkiwi.com.ng
rechtenplicht.be
opticahubertruiz.com
landgoedspica.nl
renderbox.ch
acb-gruppe.ch
cap29010.it
finnergo.eu
matteoruzzaofficial.com
nalliasmali.net
speiserei-hannover.de
triplettagaite.fr
shrinkingplanet.com
yournextshoes.com
iexpert99.com
business-basic.de
futurenetworking.com
nepressurecleaning.com
avis.mantova.it
birthplacemag.com
hostingbangladesh.net
whoopingcrane.com
pro-gamer.pl
lunoluno.com
citydogslife.com
arearugcleaningnyc.com
yuanshenghotel.com
9nar.com
baikalflot.ru
aidanpublishing.co.uk
kamin-somnium.de
nbva.co.uk
mneti.ru
putzen-reinigen.com
billyoart.com
legundschiess.de
vvego.com
julielusktherapy.com
pays-saint-flour.fr
drbenveniste.com
dantreranch.com
taulunkartano.fi
tetameble.pl
memphishealthandwellness.com
neolaiamedispa.com
rsidesigns.com
sppdstats.com
karelinjames.com
mrkluttz.com
mediogiro.com.ar
rattanwarehouse.co.uk
bourchier.org
mariannelemenestrel.com
circuit-diagramz.com
medicalsupportco.com
atelierkomon.com
stralsund-ansichten.de
entdoctor-durban.com
the-beauty-guides.com
muller.nl
bg.szczecin.pl
otpusk.zp.ua
leijstrom.com
centuryvisionglobal.com
xtensifi.com
werkzeugtrolley.net
startuplive.org
watchsale.biz
professionetata.com
yourcosmicbeing.com
theater-lueneburg.de
bubbalucious.com
alharsunindo.com
a-zpaperwork.eu
agendatwentytwenty.com
saint-malo-developpement.fr
forumsittard.nl
johnkoen.com
imagine-entertainment.com
cainlaw-okc.com
activeterroristwarningcompany.com
craftingalegacy.com
metallbau-hartmann.eu
olry-cloisons.fr
toranjtuition.org
holocine.de
girlish.ae
2020hindsight.info
omegamarbella.com
endlessrealms.net
lapponiasafaris.com
theatre-embellie.fr
mazift.dk
ultimatelifesource.com
ox-home.com
noda.com.ua
azerbaycanas.com
welovecustomers.fr
pharmeko-group.com
onlinetvgroup.com
catalyseurdetransformation.com
ufovidmag.com
groovedealers.ru
kausette.com
agrifarm.dk
dinedrinkdetroit.com
photonag.com
fta-media.com
dierenambulancealkmaar.nl
pourlabretagne.bzh
expohomes.com
signededenroth.dk
globalcompliancenews.com
nourella.com
cc-experts.de
jollity.hu
xrresources.com
terraflair.de
wasnederland.nl
greenrider.nl
stage-infirmier.fr
biblica.com
lattalvor.com
christopherhannan.com
ebible.co
solidhosting.nl
thenalpa.com
hameghlim.com
linkbuilding.life
hvitfeldt.dk
midwestschool.org
aheadloftladders.co.uk
tanatek.com
rtc24.com
mercadodelrio.com
brownswoodblog.com
breakluckrecords.com
kdbrh.com
traitware.com
bayshoreelite.com
parisschool.ru
lifeinbreaths.com
zinnystar.com
johnsonweekly.com
nieuwsindeklas.be
mindsparkescape.com
billigeflybilletter.dk
skyscanner.ro
site.markkit.com.br
bendel-partner.de
dr-vita.de
mariajosediazdemera.com
graygreenbiomedservices.com
makingmillionaires.net
housesofwa.com
wademurray.com
christianscholz.de
mieleshopping.it
mondolandscapes.com
studionumerik.fr
mgimalta.com
fazagostar.co
catchup-mag.com
tilldeeke.de
kenmccallum.com
gbk-tp1.de
bluelakevision.com
anleggsregisteret.no
globalskills.pt
alisodentalcare.com
descargandoprogramas.com
innervisions-id.com
theboardroomafrica.com
ceocenters.com
alene.co
janellrardon.com
mac-computer-support-hamburg.de
voice2biz.com
rino-gmbh.com
abulanov.com
bcmets.info
triplettabordeaux.fr
aberdeenartwalk.org
mesajjongeren.nl
nationnewsroom.com
suitesartemis.gr
jayfurnitureco.com
jlwilsonbooks.com
sochi-okna23.ru
sealgrinderpt.com
lyricalduniya.com
delegationhub.com
corporacionrr.com
apmollerpension.com
sycamoregreenapts.com
jglconsultancy.com
therapybusinessacademy.com
oro.ae
hotelturbo.de
spectamarketingdigital.com.br
chatberlin.de
mslp.org
jalkapuu.net
rokthetalk.com
kartuindonesia.com
dentallabor-luenen.de
jacquesgarcianoto.com
suonenjoen.fi
indiebizadvocates.org
mursall.de
specialtyhomeservicesllc.com
richardkershawwines.co.za
forextimes.ru
animalfood-online.de
pubcon.com
edrickennedymacfoy.com
c-sprop.com
qwikcoach.com
levelseven.be
fitnessblenderstory.com
profiz.com
wribrazil.com
myplaywin3.com
hnkns.com
uncensoredhentaigif.com
teutoradio.de
awag-blog.de
banukumbak.com
polynine.com
curtsdiscountguns.com
p-ride.live
designimage.ae
angelika-schwarz.com
prometeyagro.com.ua
unexplored.gr
zuerich-umzug.ch
stathmoulis.gr
charlottelhanna.com
avtoboss163.ru:443
5thactors.com
janmorgenstern.com
goodherbalhealth.com
testitjavertailut.net
rossomattonecase.it
anchelor.com
haus-landliebe.de
circlecitydj.com
mayprogulka.ru
osn.ro
drbrianhweeks.com
volta.plus
digitale-elite.de
ncn.nl
craftstone.co.nz
guohedd.com
schroederschoembs.com
hostastay.com
buonabitare.com
blucamp.com
teamsegeln.ch
lassocrm.com
auberives-sur-vareze.fr
napisat-pismo-gubernatoru.ru:443
janasfokus.com
michal-s.co.il
opt4cdi.com
sololibrerie.it
lollachiro.com
achetrabalhos.com
pinthelook.com
imajyuku-sozoku.com
cymru.futbol
boomerslivinglively.com
colored-shelves.com
irizar.com
artcase.pl
pinkxgayvideoawards.com
weddingceremonieswithtim.com
signamedia.de
cleanroomequipment.ie
myfbateam.com
nvisionsigns.com
dennisverschuur.com
fann.ru
witraz.pl
line-x.co.uk
istantidigitali.com
prodentalblue.com
concontactodirecto.com
sytzedevries.com
arazi.eus
eatyoveges.com
onesynergyinternational.com
adterium.com
computer-place.de
raeoflightmusic.com
barbaramcfadyenjewelry.com
rentsportsequip.com
cuadc.org
eastgrinsteadwingchun.com
hawaiisteelbuilding.com
devplus.be
animation-pro.co.uk
rs-danmark.dk
bellesiniacademy.org
k-v-f.de
promus.ca
bluemarinefoundation.com
saberconcrete.com
crestgood.com
sellthewrightway.com
eos-horlogerie.com
satoblog.org
fire-space.com
sarahspics.co.uk
1deals.com
babysitting-hk.helpergo.co
ledyoucan.com
o2o-academy.com
utilisacteur.fr
internalresults.com
magrinya.net
gsconcretecoatings.com
citiscapes-art.com
mediabolmong.com
belinda.af
bodet150ans.com
physio-lang.de
wineandgo.hu
jax-interim-and-projectmanagement.com
funworx.de
levencovka.ru
autoteamlast.de
morgansconsult.com
jobstomoveamerica.org
der-stempelking.de
casinodepositors.com
vitormmcosta.com
rarefoods.ro
craftron.com
nevadaruralhousingstudies.org
kuriero.pro
grancanariaregional.com
secrets-clubs.co.uk
motocrossplace.co.uk
rename.kz
optigas.com
dinecorp.com
transifer.fr
domilivefurniture.com
tatyanakopieva.ru
ronaldhendriks.nl
stitch-n-bitch.com
rvside.com
the3-week-diet.net
cascinarosa33.it
yayasanprimaunggul.org
jobscore.com
stanleyqualitysystems.com
finsahome.co.uk
letsstopsmoking.co.uk
gaearoyals.com
endstarvation.com
brunoimmobilier.com
jlgraphisme.fr
premiumweb.com.ua:443
awaisghauri.com
mariamalmahdi.com
salonlamar.nl
sweetz.fr
patriotcleaning.net
csaballoons.com
so-sage.fr
ddmgen.com
springfieldplumbermo.com
tchernia-conseil.fr
skyboundnutrition.co.uk
nauticmarine.dk
reygroup.pt
tutvracks.com
chinowarehousespace.com
skidpiping.de
avisioninthedesert.com
vdolg24.online
alattekniksipil.com
jonnyhooley.com
belofloripa.be
teethinadaydentalimplants.com
marcandy.com
ketomealprep.academy
monstarrsoccer.com
kosten-vochtbestrijding.be
forskolinslimeffect.net
production-stills.co.uk
unislaw-narty.pl
randyabrown.com
thehovecounsellingpractice.co.uk
comoserescritor.com
factoriareloj.com
kookooo.com
jeanmonti.com
focuskontur.com
cyberpromote.de
mazzaropi.com.br
renehartman.nl
frimec-international.es
rizplakatjaya.com
johnstonmingmanning.com
bakingismyyoga.com
interlinkone.com
cl0nazepamblog.com
beauty-traveller.com
veggienessa.com
tages-geldvergleich.de
bilius.dk
ayudaespiritualtamara.com
profibersan.com
andreaskildegaard.dk
hypogenforensic.com
kvetymichalovce.sk
campinglaforetdetesse.com
alabamaroofingllc.com
daveystownhouse.com
saboboxtel.uk
breathebettertolivebetter.com
krishnabrawijaya.com
limmortelyouth.com
eventosvirtualesexitosos.com
mikegoodfellow.co.uk
pedmanson.com
drvoip.com
perfectgrin.com
rentingwell.com
muni.pe
spirello.nl
karmeliterviertel.com
rapid5kloan.org
vitoriaecoturismo.com.br
uci-france.fr
theintellect.edu.pk
georgemuncey.com
klapanvent.ru
buffdaddyblog.com
paradigmlandscape.com
harleystreetspineclinic.com
netadultere.fr
betterce.com
directique.com
ninjaki.com
mollymccarthydesign.com
metriplica.academy
shortysspices.com
energosbit-rp.ru
parentsandkids.com
mbuildinghomes.com
bratek-immobilien.de
web865.com
andermattswisswatches.ch
mediahub.co.nz
soundseeing.net
heuvelland-oaze.nl
bertbutter.nl
ronielyn.com
lgiwines.com
azloans.com
mustangmarketinggroup.com
jimprattmediations.com
xn--billigafrgpatroner-stb.se
acumenconsultingcompany.com
kelsigordon.com
ramirezprono.com
bruut.online
alpesiberie.com
motocrosshideout.com
egpu.fr
almamidwifery.com
ocduiblog.com
queertube.net
11.in.ua
cotton-avenue.co.il
thisprettyhair.com
pazarspor.org.tr
latteswithleslie.com
palmenhaus-erfurt.de
framemyballs.com
oexebusiness.com
berdonllp.com
hekecrm.com
look.academy
smarttourism.academy
-
net
true
-
pid
21
-
prc
synctime.exe
msdtssrvr.exe
visio.exe
dbeng50.exe
firefoxconfig.exe
mysqld_opt.exe
xfssvccon.exe
agntsvc.exe
infopath.exe
msmdsrv.exe
mspub.exe
outlook.exe
mydesktopservice.exe
ocssd.exe
sqlbrowser.exe
dbsnmp.exe
sqbcoreservice.exe
mydesktopqos.exe
powerpnt.exe
excel.exe
thebat.exe
oracle.exe
mysqld.exe
sqlwriter.exe
sqlservr.exe
thunderbird.exe
onenote.exe
steam.exe
mysqld_nt.exe
msftesql.exe
encsvc.exe
sqlagent.exe
tbirdconfig.exe
msaccess.exe
ocautoupds.exe
wordpad.exe
isqlplussvc.exe
thebat64.exe
winword.exe
ocomm.exe
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
56
Extracted
C:\Users\Default\7c02p88nd-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8123BCA458F1FA55
http://decryptor.top/8123BCA458F1FA55
Extracted
C:\Users\Default\1jd431n8iy-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/84EBD62A1D154304
http://decryptor.top/84EBD62A1D154304
Targets
-
-
Target
f3a0cb122ce523e9f0fb9bc04fcc6756_JaffaCakes118
-
Size
158KB
-
MD5
f3a0cb122ce523e9f0fb9bc04fcc6756
-
SHA1
f80bc74b31d78a67e430a9f45884334c2f685616
-
SHA256
5928db8b7b1714ead51392ad809242cd5a158defefe5309f3ae0238c20a500ab
-
SHA512
3d187707aa5978cec8cbbd9061714ba1cf7561decf8142f4ace4cadd0d0f73947e7b9a06c11b9c3fa1ff7c02229b3d4f24cd9a6cf6d48af1f2726af950df0f4d
-
SSDEEP
3072:lYplXYpKWmsLbi4eTMlwDCnuyKz/PeQ7Gxl:2zI0WXbnWJTGx
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (199) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1