General
-
Target
fc64a21fc60e4647ce3023be30ffbfc8_JaffaCakes118
-
Size
164KB
-
Sample
240928-qpgwns1anb
-
MD5
fc64a21fc60e4647ce3023be30ffbfc8
-
SHA1
5ccc20e535890ffddbd6a97fe28acb5c86e690d9
-
SHA256
bb049db0101997e4ec714413c716b9f5e0bfd342e20d1b01b1406a648a9b8033
-
SHA512
6f5353f372a63b24ebf8e4ef2d490b22e9ad2f32a93a0ef2803ca8a16eea878860edfce5a79afd7975e3fa4cc737c4d74bea0393ecc0ac9507f9615598dedb80
-
SSDEEP
3072:70XoUeZ/DVS8L7flcMTeYWikGLvFfwZ4ib5D:7eoUeZRlcYxWYTFfwZV
Behavioral task
behavioral1
Sample
fc64a21fc60e4647ce3023be30ffbfc8_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
fc64a21fc60e4647ce3023be30ffbfc8_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
sodinokibi
20
46
nbva.co.uk
poems-for-the-soul.ch
avtoboss163.ru:443
omnicademy.com
pajagus.fr
ramirezprono.com
ijsselbeton.nl
3daywebs.com
ufovidmag.com
citiscapes-art.com
expohomes.com
qwikcoach.com
clemenfoto.dk
kryddersnapsen.dk
basindentistry.com
mollymccarthydesign.com
precisetemp.com
bilius.dk
g2mediainc.com
rentingwell.com
stitch-n-bitch.com
forumsittard.nl
limounie.com
banksrl.co.za
bookingwheel.com
enews-qca.com
andreaskildegaard.dk
eastgrinsteadwingchun.com
ciga-france.fr
innovationgames-brabant.nl
electricianul.com
geitoniatonaggelon.gr
jalkapuu.net
eos-horlogerie.com
oportowebdesign.com
11.in.ua
iexpert99.com
cyberpromote.de
golfclublandgoednieuwkerk.nl
hnkns.com
druktemakersheerenveen.nl
bruut.online
stralsund-ansichten.de
prometeyagro.com.ua
janmorgenstern.com
baumfinancialservices.com
pokemonturkiye.com
paradigmlandscape.com
tatyanakopieva.ru
narca.net
piestar.com
nuohous.com
yourhappyevents.fr
catalyseurdetransformation.com
stoneridgemontessori.com
perceptdecor.com
wg-heiligenstadt.de
the-cupboard.co.uk
rhino-turf.com
hotelturbo.de
mondolandscapes.com
satoblog.org
renderbox.ch
katherinealy.com
molinum.pt
khtrx.com
ketomealprep.academy
jollity.hu
jimprattmediations.com
mneti.ru
dentourage.com
kickittickets.com
theatre-embellie.fr
elliemaccreative.wordpress.com
levelseven.be
sveneulberg.de
levencovka.ru
encounter-p.net
oththukaruva.com
galatee-couture.com
kompresory-opravy.com
traitware.com
loysonbryan.com
stagefxinc.com
chomiksy.net
wyreforest.net
carsten.sparen-it.de
marmarabasin.com
techybash.com
trainiumacademy.com
focuskontur.com
harleystreetspineclinic.com
neonodi.be
direitapernambuco.com
haard-totaal.nl
designimage.ae
onlinetvgroup.com
triplettagaite.fr
tothebackofthemoon.com
advance-refle.com
silkeight.com
mahikuchen.com
hensleymarketing.com
bridalcave.com
vitormmcosta.com
brownswoodblog.com
optigas.com
activeterroristwarningcompany.com
zorgboerderijravensbosch.nl
invela.dk
vvego.com
laylavalentine.com
magrinya.net
abulanov.com
ingresosextras.online
polynine.com
mercadodelrio.com
midwestschool.org
agenceassemble.fr
nginx.com
nauticmarine.dk
edrickennedymacfoy.com
happylublog.wordpress.com
metroton.ru
comoserescritor.com
lookandseen.com
dcc-eu.com
nykfdyrehospital.dk
globalskills.pt
catering.com
matthieupetel.fr
dreamvoiceclub.org
shrinkingplanet.com
tilldeeke.de
lgiwines.com
wrinstitute.org
phoenixcrane.com
nxtstg.org
testitjavertailut.net
subyard.com
strauchs-wanderlust.info
furland.ru
rolleepollee.com
slotspinner.com
internestdigital.com
ronielyn.com
fysiotherapierijnmond.nl
jeanmonti.com
successcolony.com.ng
unexplored.gr
funworx.de
bmw-i-pure-impulse.com
motocrosshideout.com
allinonecampaign.com
digitale-elite.de
naukaip.ru
dantreranch.com
akwaba-safaris.com
grancanariaregional.com
modamarfil.com
breakluckrecords.com
rsidesigns.com
latteswithleslie.com
taulunkartano.fi
bertbutter.nl
bluetenreich-brilon.de
zdrowieszczecin.pl
patriotcleaning.net
whoopingcrane.com
innervisions-id.com
lashandbrowenvy.com
livedeveloper.com
avisioninthedesert.com
oexebusiness.com
nepressurecleaning.com
belinda.af
cssp-mediation.org
liepertgrafikweb.at
sjtpo.org
jameswilliamspainting.com
cops4causes.org
jayfurnitureco.com
o90.dk
hepishopping.com
malzomattalar.com
pilotgreen.com
sshomme.com
riffenmattgarage.ch
skoczynski.eu
schroederschoembs.com
towelroot.co
zumrutkuyutemel.com
handyman-silkeborg.dk
lovetzuchia.com
apogeeconseils.fr
witraz.pl
beandrivingschool.com.au
denhaagfoodie.nl
christopherhannan.com
dogsunlimitedguide.com
theater-lueneburg.de
9nar.com
advancedeyecare.com
premier-iowa.com
atelierkomon.com
agora-collectivites.com
leopoldineroux.com
airvapourbarrier.com
smartmind.net
creohn.de
premiumweb.com.ua:443
peppergreenfarmcatering.com.au
itheroes.dk
signamedia.de
saberconcrete.com
catchup-mag.com
agriturismocastagneto.it
peninggibadan.co.id
production-stills.co.uk
circlecitydj.com
bychowo.pl
parisschool.ru
dayenne-styling.nl
rapid5kloan.org
mariajosediazdemera.com
oraweb.net
azloans.com
supercarhire.co.uk
skidpiping.de
scotlandsroute66.co.uk
thepixelfairy.com
slotenmakerszwijndrecht.nl
suitesartemis.gr
klapanvent.ru
cymru.futbol
mgimalta.com
albcleaner.fr
amco.net.au
pvandambv.nl
radishallgood.com
alene.co
landgoedspica.nl
concontactodirecto.com
cac2040.com
the-beauty-guides.com
legundschiess.de
marcandy.com
switch-made.com
duthler.nl
ilveshistoria.com
mayprogulka.ru
arazi.eus
greenrider.nl
pharmeko-group.com
welovecustomers.fr
fascaonline.com
altocontatto.net
amorbellezaysalud.com
smartercashsystem.com
5thactors.com
smartworkplaza.com
babysitting-hk.helpergo.co
jag.me
cuadc.org
auto-opel.ro
kenmccallum.com
adterium.com
campinglaforetdetesse.com
neolaiamedispa.com
dinecorp.com
devplus.be
uci-france.fr
eventosvirtualesexitosos.com
schluesseldienste-hannover.de
lexced.com
frimec-international.es
sprintcoach.com
buerocenter-butzbach-werbemittel.de
fotoslubna.com
xn--80abehgab4ak0ddz.xn--p1ai
fazagostar.co
bagaholics.in
fta-media.com
circuit-diagramz.com
studionumerik.fr
housesofwa.com
casinodepositors.com
nrgvalue.com
enactusnhlstenden.com
morgansconsult.com
transifer.fr
frameshift.it
rokthetalk.com
keuken-prijs.nl
chatberlin.de
triavlete.com
aoyama.ac
paardcentraal.nl
rhino-storage.co.uk
ultimatelifesource.com
projektparkiet.pl
masecologicos.com
veggienessa.com
fanuli.com.au
dentalcircle.com
advanced-removals.co.uk
aheadloftladders.co.uk
voetbalhoogeveen.nl
smarttourism.academy
specialtyhomeservicesllc.com
janellrardon.com
rtc24.com
netadultere.fr
crestgood.com
efficiencyconsulting.es
edvestors.org
elitkeramika-shop.com.ua
pureelements.nl
vdolg24.online
vedsegaard.dk
pubcon.com
mangimirossana.it
zealcon.ae
redpebblephotography.com
from02pro.com
benchbiz.com
daveystownhouse.com
andrealuchesi.it
keyboardjournal.com
hm-com.com
mariannelemenestrel.com
kafkacare.com
avis.mantova.it
oscommunity.de
curtsdiscountguns.com
egpu.fr
kristianboennelykke.dk
soundseeing.net
xtensifi.com
scietech.academy
fsbforsale.com
wordpress.idium.no
fskhjalmar.se
k-zubki.ru
aquacheck.co.za
spirello.nl
gratiocafeblog.wordpress.com
goodherbalhealth.com
davedavisphotos.com
1deals.com
arabianmice.com
computer-place.de
cp-bap.de
drbenveniste.com
xn--billigafrgpatroner-stb.se
mind2muscle.nl
finnergo.eu
glennverschueren.be
worldproskitour.com
akcadagofis.com
yayasanprimaunggul.org
kvetymichalovce.sk
moira-cristescu.com
dieetuniversiteit.nl
framemyballs.com
qandmmusiccenter.com
azerbaycanas.com
mesajjongeren.nl
loparnille.se
sarahspics.co.uk
monstarrsoccer.com
donau-guides.eu
airserviceunlimited.com
diverfiestas.com.es
karelinjames.com
richardiv.com
deziplan.ru
cincinnatiphotocompany.org
kombi-dress.com
hawaiisteelbuilding.com
reizenmetkinderen.be
bakingismyyoga.com
secrets-clubs.co.uk
askstaffing.com
campusescalade.com
alisodentalcare.com
ocduiblog.com
hutchstyle.co.uk
thesilkroadny.com
111firstdelray.com
wirmuessenreden.com
nutriwell.com.sg
cesep2019.com
antesacademy.it
mazzaropi.com.br
futurenetworking.com
buonabitare.com
angelsmirrorus.com
salonlamar.nl
reputation-medical.online
terraflair.de
die-immo-agentur.de
texanscan.org
charlesfrancis.photos
shortsalemap.com
rishigangoly.com
lumturo.academy
atrgroup.it
letsstopsmoking.co.uk
billyoart.com
billscars.net
stressreliefadvice.com
block-optic.com
mursall.de
goeppinger-teppichreinigung.de
alwaysdc.com
gazelle-du-web.com
holocine.de
kuriero.pro
sharonalbrightdds.com
ced-elec.com
simpleitsolutions.ch
skooppi.fi
physio-lang.de
flossmoordental.com
primemarineengineering.com
epsondriversforwindows.com
frankgoll.com
atma.nl
qrs-international.com
blavait.fr
alaskaremote.com
2020hindsight.info
penumbuhrambutkeiskei.com
gatlinburgcottage.com
schlagbohrmaschinetests.com
protoplay.ca
tieronechic.com
tradenavigator.ch
dnqa.co.uk
bg.szczecin.pl
thestudio.academy
oro.ae
kemtron.fr
jax-interim-and-projectmanagement.com
shortysspices.com
wribrazil.com
test-teleachat.fr
ownidentity.com
utilisacteur.fr
teethinadaydentalimplants.com
pinkxgayvideoawards.com
sber-biznes.com
lovcase.com
iactechnologies.net
envomask.com
pedmanson.com
justaroundthecornerpetsit.com
valiant-voice.com
billigeflybilletter.dk
signededenroth.dk
gta-jjb.fr
skyboundnutrition.co.uk
cmascd.com
xrresources.com
cormanmarketing.com
kiraribeaute-nani.com
teamsegeln.ch
pro-gamer.pl
campusce.com
yvesdoin-aquarelles.fr
goodboyscustom.com
noda.com.ua
ntinasfiloxenia.gr
eyedoctordallas.com
jobscore.com
mensemetgesigte.co.za
sachainchiuk.com
aslog.fr
globalcompliancenews.com
dibli.store
b3b.ch
ikadomus.com
mbuildinghomes.com
ahgarage.com
acumenconsultingcompany.com
johnstonmingmanning.com
mikegoodfellow.co.uk
plbinsurance.com
zaczytana.com
sppdstats.com
etgdogz.de
muller.nl
birthplacemag.com
coachpreneuracademy.com
go.labibini.ch
datatri.be
brighthillgroup.com
walterman.es
afbudsrejserallinclusive.dk
onesynergyinternational.com
metcalfe.ca
slideevents.be
thiagoperez.com
agrifarm.dk
lesyeuxbleus.net
bellesiniacademy.org
jlwilsonbooks.com
cascinarosa33.it
theboardroomafrica.com
singletonfinancial.com
bescomedical.de
gardenpartner.pl
awag-blog.de
bodet150ans.com
rossomattonecase.it
mrkluttz.com
koncept-m.ru
skinkeeper.li
broccolisoep.nl
oncarrot.com
jglconsultancy.com
min-virksomhed.dk
aciscomputers.com
lollachiro.com
otpusk.zp.ua
stringnosis.academy
silverbird.dk
manzel.tn
lapponiasafaris.com
pourlabretagne.bzh
volta.plus
hawthornsretirement.co.uk
malevannye.ru
alcye.com
thegrinningmanmusical.com
scentedlair.com
rarefoods.ro
juergenblaetz.de
jlgraphisme.fr
parksideseniorliving.net
eshop.design
rubyaudiology.com
dmlcpa.com
forextimes.ru
fotoeditores.com
parentsandkids.com
aberdeenartwalk.org
craftingalegacy.com
thehovecounsellingpractice.co.uk
victorvictoria.com
kdbrh.com
acb-gruppe.ch
charlottelhanna.com
eatyoveges.com
chatterchatterchatter.com
natturestaurante.com.br
chorusconsulting.net
brisbaneosteopathic.com.au
jonnyhooley.com
nourella.com
ideamode.com
blucamp.com
werkzeugtrolley.net
sbit.ag
vitoriaecoturismo.com.br
mediahub.co.nz
stanleyqualitysystems.com
denverwynkoopdentist.com
look.academy
orchardbrickwork.com
theintellect.edu.pk
easydental.ae
arearugcleaningnyc.com
docarefoundation.org
mariamalmahdi.com
bd2fly.com
gavelmasters.com
interlinkone.com
graygreenbiomedservices.com
mediabolmong.com
bundan.com
internalresults.com
cmeow.com
osn.ro
endlessrealms.net
burg-zelem.de
biblica.com
guohedd.com
wineandgo.hu
artcase.pl
90nguyentuan.com
leadforensics.com
selected-minds.de
letterscan.de
greatofficespaces.net
zuerich-umzug.ch
carmel-york.com
hoteltantra.com
trevi-vl.ru
hospitalitytrainingsolutions.co.uk
palmenhaus-erfurt.de
axisoflove.org:443
tutvracks.com
boyfriendsgoal.site
drvoip.com
vipcarrental.ae
richardmaybury.co.uk
p-ride.live
latableacrepes-meaux.fr
toranjtuition.org
goddardleadership.org
ykobbqchicken.ca
apiarista.de
sunsolutions.es
kartuindonesia.com
bohrlochversicherung.info
hostastay.com
buzzneakers.com
hostaletdelsindians.es
bcmets.info
speakaudible.com
imaginekithomes.co.nz
voice2biz.com
kamin-somnium.de
betterce.com
baita.ac
cxcompany.com
girlish.ae
martinipstudios.com
jobkiwi.com.ng
ronaldhendriks.nl
ravage-webzine.nl
richardkershawwines.co.za
awaitspain.com
t3brothers.com
yuanshenghotel.com
smartspeak.com
husetsanitas.dk
annida.it
kosten-vochtbestrijding.be
alpesiberie.com
mustangmarketinggroup.com
molade.nl
astrographic.com
wasnederland.nl
bluemarinefoundation.com
ruggestar.ch
mieleshopping.it
kelsigordon.com
pixelhealth.net
fann.ru
putzen-reinigen.com
sytzedevries.com
deduktia.fi
bourchier.org
saboboxtel.uk
ziliak.com
xn--80addfr4ahr.dp.ua
stabilisateur.fr
bubbalucious.com
zinnystar.com
eafx.pro
four-ways.com
descargandoprogramas.com
professionetata.com
racefietsenblog.nl
espaciopolitica.com
elex.is
linkbuilding.life
wademurray.com
bodymindchallenger.com
sellthewrightway.com
kryptos72.com
o2o-academy.com
skolaprome.eu
sealgrinderpt.com
universelle.fr
bonitabeachassociation.com
condormobile.fr
global-migrate.com
kerstliedjeszingen.nl
watchsale.biz
mindfuelers.com
soncini.ch
hypogenforensic.com
c-sprop.com
gbk-tp1.de
mike.matthies.de
carolynfriedlander.com
imajyuku-sozoku.com
licensed-public-adjuster.com
craftstone.co.nz
web865.com
liverpoolabudhabi.ae
rvside.com
lmmont.sk
rentsportsequip.com
achetrabalhos.com
epicjapanart.com
mslp.org
nevadaruralhousingstudies.org
awaisghauri.com
n-newmedia.de
chainofhopeeurope.eu
thegetawaycollective.com
adabible.org
santastoy.store
opt4cdi.com
iron-mine.ru
sololibrerie.it
turing.academy
baptistdistinctives.org
prodentalblue.com
saint-malo-developpement.fr
hekecrm.com
heuvelland-oaze.nl
xn--ziinoapte-6ld.ro
phukienbepthanhdat.com
diakonie-weitramsdorf-sesslach.de
hinotruckwreckers.com.au
biketruck.de
gosouldeep.com
mrmac.com
anleggsregisteret.no
perfectgrin.com
log-barn.co.uk
johnkoen.com
nationnewsroom.com
omegamarbella.com
ceocenters.com
lidkopingsnytt.nu
bcabattoirs.org
logosindustries.com
cleanroomequipment.ie
jacquesgarcianoto.com
customroasts.com
asiaartgallery.jp
corporacionrr.com
weddingceremonieswithtim.com
mindsparkescape.com
gaearoyals.com
bendel-partner.de
pankiss.ru
pazarspor.org.tr
lassocrm.com
profibersan.com
a-zpaperwork.eu
pays-saint-flour.fr
solidhosting.nl
fidelitytitleoregon.com
dentallabor-luenen.de
parseport.com
tzn.nu
nicksrock.com
so-sage.fr
littlesaints.academy
quitescorting.com
memphishealthandwellness.com
lunoluno.com
apmollerpension.com
affligemsehondenschool.be
grupoexin10.com
michaelfiegel.com
acornishstudio.co.uk
palema.gr
almamidwifery.com
stathmoulis.gr
gsconcretecoatings.com
sambaglow.com
rename.kz
karmeliterviertel.com
geoweb.software
amelielecompte.wordpress.com
the5thquestion.com
mundo-pieces-auto.fr
yourcosmicbeing.com
baikalflot.ru
berdonllp.com
factoriareloj.com
miscbo.it
agencewho-aixenprovence.fr
endstarvation.com
barbaramcfadyenjewelry.com
rizplakatjaya.com
olry-cloisons.fr
foerderverein-vatterschule.de
purepreprod4.com
clinic-beethovenstrasse-ag.ch
uncensoredhentaigif.com
startuplive.org
janasfokus.com
magnetvisual.com
hotjapaneselesbian.com
groovedealers.ru
lyricalduniya.com
livelai.com
hartofurniture.com
ivancacu.com
galaniuklaw.com
animation-pro.co.uk
kausette.com
lagschools.ng
arthakapitalforvaltning.dk
zwemofficial.nl
5pointpt.com
bumbipdeco.site
acibademmobil.com.tr
tweedekansenloket.nl
m2graph.fr
initconf.com
amyandzac.com
devus.de
banukumbak.com
tanatek.com
bayshoreelite.com
thisprettyhair.com
bavovrienden.nl
dr-vita.de
alexwenzel.de
ledyoucan.com
teutoradio.de
rattanwarehouse.co.uk
alharsunindo.com
lsngroupe.com
opticahubertruiz.com
csaballoons.com
larchwoodmarketing.com
belofloripa.be
business-basic.de
unboxtherapy.site
springfieldplumbermo.com
onlinemarketingsurgery.co.uk
mazift.dk
angeleyezstripclub.com
pisofare.co
tesisatonarim.com
cardsandloyalty.com
sycamoregreenapts.com
the3-week-diet.net
dennisverschuur.com
ddmgen.com
tellthebell.website
kroophold-sjaelland.dk
jdscenter.com
finsahome.co.uk
drbrianhweeks.com
k-v-f.de
rivermusic.nl
luvinsburger.fr
fluzfluzrewards.com
animalfood-online.de
leijstrom.com
topvijesti.net
cookinn.nl
photonag.com
muni.pe
scholarquotes.com
solutionshosting.co.uk
pansionatblago.ru
jmmartinezilustrador.com
liveyourheartout.co
ikzoekgod.be
webforsites.com
autoteamlast.de
fla.se
auberives-sur-vareze.fr
subquercy.fr
makingmillionaires.net
haus-landliebe.de
evsynthacademy.org
agendatwentytwenty.com
trivselsguide.dk
brinkdoepke.eu
christianscholz.de
energosbit-rp.ru
proffteplo.com
lisa-poncon.fr
medicalsupportco.com
louiedager.com
innersurrection.com
rechtenplicht.be
alltagsrassismus-entknoten.de
centuryvisionglobal.com
placermonticello.com
myplaywin3.com
redctei.co
vapiano.fr
nalliasmali.net
publicompserver.de
craftron.com
ya-elka.ru
brannbornfastigheter.se
bajova.sk
anchelor.com
domaine-des-pothiers.com
irizar.com
cl0nazepamblog.com
suonenjoen.fi
chris-anne.com
alattekniksipil.com
ayudaespiritualtamara.com
istantidigitali.com
ygallerysalonsoho.com:443
speiserei-hannover.de
heimdalbygg.no
annenymus.com
nvisionsigns.com
glende-pflanzenparadies.de
therapybusinessacademy.com
floweringsun.org
rozmata.com
collegetennis.info
colored-shelves.com
tbalp.co.uk
relevantonline.eu
ilovefullcircle.com
adedesign.com
imagine-entertainment.com
spectamarketingdigital.com.br
rino-gmbh.com
rs-danmark.dk
cotton-avenue.co.il
photographycreativity.co.uk
buffdaddyblog.com
citydogslife.com
angelika-schwarz.com
fbmagazine.ru
krishnabrawijaya.com
ludoil.it
mamajenedesigns.com
napisat-pismo-gubernatoru.ru:443
fi-institutionalfunds.com
operativadigital.com
luvbec.com
myfbateam.com
leansupremegarcinia.net
mjk.digital
martha-frets-ceramics.nl
boloria.de
triplettabordeaux.fr
delegationhub.com
cap29010.it
maxcube24.com.ua
jobstomoveamerica.org
stage-infirmier.fr
entdoctor-durban.com
dinedrinkdetroit.com
metriplica.academy
aidanpublishing.co.uk
paprikapod.com
yournextshoes.com
bratek-immobilien.de
bringmehope.org
johnsonweekly.com
dierenambulancealkmaar.nl
kellengatton.com
spartamovers.com
hiddensee-buhne11.de
ncjc.ca
leatherjees.com
grafikstudio-visuell.de
jaaphoekzema.nl
fixx-repair.com
linearete.com
patassociation.com
metallbau-hartmann.eu
directique.com
ncn.nl
motocrossplace.co.uk
spacebel.be
alnectus.com
michal-s.co.il
biodentify.ai
aktivfriskcenter.se
hameghlim.com
cc-experts.de
randyabrown.com
thenalpa.com
eksperdanismanlik.com
andermattswisswatches.ch
hostingbangladesh.net
skyscanner.ro
jakubrybak.com
drnelsonpediatrics.com
chinowarehousespace.com
georgemuncey.com
hvitfeldt.dk
ebible.co
mediogiro.com.ar
bjornvanvulpen.nl
markseymourphotography.co.uk
tramadolhealth.com
raeoflightmusic.com
eurethicsport.eu
newonestop.com
tetameble.pl
adaduga.info
factorywizuk.com
limmortelyouth.com
fridakids.com
kookooo.com
domilivefurniture.com
wallflowersandrakes.com
insane.agency
augen-praxisklinik-rostock.de
altitudeboise.com
unislaw-narty.pl
cainlaw-okc.com
schulz-moelln.de
nepal-pictures.com
maryairbnb.wordpress.com
line-x.co.uk
lattalvor.com
tchernia-conseil.fr
distrifresh.com
mac-computer-support-hamburg.de
der-stempelking.de
humanviruses.org
mrcar.nl
beauty-traveller.com
pxsrl.it
artvark.nl
bulyginnikitav.000webhostapp.com
breathebettertolivebetter.com
fitnessblenderstory.com
leloupblanc.gr
queertube.net
powershell.su
fire-space.com
jandhpest.com
explora.nl
gurutechnologies.net
matteoruzzaofficial.com
bluelakevision.com
promus.ca
inewsstar.com
pinthelook.com
palmecophilippines.com
glas-kuck.de
julielusktherapy.com
lifeinbreaths.com
advesa.com
nieuwsindeklas.be
alabamaroofingllc.com
sweetz.fr
reygroup.pt
topautoinsurers.net
jefersonalessandro.com
blueridgeheritage.com
tastevirginia.com
boomerslivinglively.com
aceroprime.com
outstandingminialbums.com
site.markkit.com.br
brunoimmobilier.com
nexstagefinancial.com
hom-frisor.dk
indiebizadvocates.org
laaisterplakky.nl
forskolinslimeffect.net
tages-geldvergleich.de
claudiakilian.de
renehartman.nl
ox-home.com
margaretmcshane.com
happycatering.de
ninjaki.com
profiz.com
verbouwingsdouche.nl
sochi-okna23.ru
greeneyetattoo.com
tecleados.com
-
net
true
-
pid
20
-
prc
sqlservr
mysql
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
46
-
svc
veeam
svc$
backup
vss
sql
sophos
memtas
mepocs
Extracted
C:\Users\760576-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/AA91A479B13063A5
http://decryptor.top/AA91A479B13063A5
Extracted
C:\Users\l387h727g-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3FBEE749ECBECB68
http://decryptor.top/3FBEE749ECBECB68
Targets
-
-
Target
fc64a21fc60e4647ce3023be30ffbfc8_JaffaCakes118
-
Size
164KB
-
MD5
fc64a21fc60e4647ce3023be30ffbfc8
-
SHA1
5ccc20e535890ffddbd6a97fe28acb5c86e690d9
-
SHA256
bb049db0101997e4ec714413c716b9f5e0bfd342e20d1b01b1406a648a9b8033
-
SHA512
6f5353f372a63b24ebf8e4ef2d490b22e9ad2f32a93a0ef2803ca8a16eea878860edfce5a79afd7975e3fa4cc737c4d74bea0393ecc0ac9507f9615598dedb80
-
SSDEEP
3072:70XoUeZ/DVS8L7flcMTeYWikGLvFfwZ4ib5D:7eoUeZRlcYxWYTFfwZV
Score10/10-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1