General
-
Target
JaffaCakes118_28cfcdbe185abf8176d62b11287495989424bac090b573ecc319162f814fc523
-
Size
70KB
-
Sample
241221-2gmyha1rhw
-
MD5
fc443f1397d0e85b707030fda0ffd368
-
SHA1
fe97b3847240993bfef3cbe3a6917f858068c04e
-
SHA256
28cfcdbe185abf8176d62b11287495989424bac090b573ecc319162f814fc523
-
SHA512
4d3014848f90c10db591b2f54a769fcdd3bdfcb181d6108eb0184eb4ee2b7274cd49c080d27ba2fcacda8a49a646f5c7459617560556959784754464057dd068
-
SSDEEP
1536:tXdpFkbR6wUPjTkOxGWaTqxv++nUkAXvzSPe0+WMp92pq0hHk:3pF+ub4OxGFELUrAa
Static task
static1
Behavioral task
behavioral1
Sample
6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
run_revil.bat
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
run_revil.bat
Resource
win10v2004-20241007-en
Malware Config
Extracted
sodinokibi
$2a$10$gMHdtu094GE7DD46JvCH6.bPoHnpKjInjjdxBtPaRwAEY6gOWGKYG
3721
quemargrasa.net
wraithco.com
dubnew.com
zweerscreatives.nl
eaglemeetstiger.de
highimpactoutdoors.net
vesinhnha.com.vn
rocketccw.com
div-vertriebsforschung.de
rieed.de
ulyssemarketing.com
jbbjw.com
moveonnews.com
em-gmbh.ch
deepsouthclothingcompany.com
2ekeus.nl
vdberg-autoimport.nl
deschl.net
teknoz.net
micahkoleoso.de
adoptioperheet.fi
leda-ukraine.com.ua
peterstrobos.com
faronics.com
ecopro-kanto.com
you-bysia.com.au
newyou.at
humancondition.com
tstaffing.nl
transliminaltribe.wordpress.com
quizzingbee.com
ecoledansemulhouse.fr
theclubms.com
jiloc.com
sofavietxinh.com
garage-lecompte-rouen.fr
amylendscrestview.com
devlaur.com
monark.com
eadsmurraypugh.com
jameskibbie.com
handi-jack-llc.com
koko-nora.dk
profectis.de
oldschoolfun.net
walkingdeadnj.com
embracinghiscall.com
rhinosfootballacademy.com
epwritescom.wordpress.com
coastalbridgeadvisors.com
seagatesthreecharters.com
danskretursystem.dk
hannah-fink.de
corelifenutrition.com
werkkring.nl
walter-lemm.de
bradynursery.com
bbsmobler.se
tanzprojekt.com
synlab.lt
tsklogistik.eu
globedivers.wordpress.com
makeurvoiceheard.com
crowd-patch.co.uk
mariposapropaneaz.com
longislandelderlaw.com
oneplusresource.org
edgewoodestates.org
pogypneu.sk
glennroberts.co.nz
transportesycementoshidalgo.es
kojinsaisei.info
edv-live.de
seminoc.com
cranleighscoutgroup.org
cimanchesterescorts.co.uk
muamuadolls.com
mytechnoway.com
shiftinspiration.com
anteniti.com
evergreen-fishing.com
blumenhof-wegleitner.at
classycurtainsltd.co.uk
filmvideoweb.com
houseofplus.com
restaurantesszimmer.de
kath-kirche-gera.de
knowledgemuseumbd.com
offroadbeasts.com
euro-trend.pl
hardinggroup.com
drugdevice.org
kingfamily.construction
creative-waves.co.uk
sagadc.com
cactusthebrand.com
allentownpapershow.com
puertamatic.es
boompinoy.com
bargningharnosand.se
spargel-kochen.de
facettenreich27.de
kisplanning.com.au
thedresserie.com
layrshift.eu
tastewilliamsburg.com
lightair.com
quickyfunds.com
321play.com.hk
coding-marking.com
myteamgenius.com
oneheartwarriors.at
lubetkinmediacompanies.com
naswrrg.org
turkcaparbariatrics.com
jacquin-maquettes.com
xn--thucmctc-13a1357egba.com
i-arslan.de
simulatebrain.com
kariokids.com
body-guards.it
baronloan.org
milanonotai.it
nvwoodwerks.com
forskolorna.org
pivoineetc.fr
chrissieperry.com
madinblack.com
artotelamsterdam.com
nhadatcanho247.com
wari.com.pe
asiluxury.com
extraordinaryoutdoors.com
wmiadmin.com
zonamovie21.net
torgbodenbollnas.se
webhostingsrbija.rs
norpol-yachting.com
mediaacademy-iraq.org
edelman.jp
123vrachi.ru
iwelt.de
plastidip.com.ar
meusharklinithome.wordpress.com
parking.netgateway.eu
seitzdruck.com
bloggyboulga.net
waynela.com
hexcreatives.co
mardenherefordshire-pc.gov.uk
mousepad-direkt.de
portoesdofarrobo.com
porno-gringo.com
vanswigchemdesign.com
juneauopioidworkgroup.org
appsformacpc.com
journeybacktolife.com
aglend.com.au
thee.network
mymoneyforex.com
patrickfoundation.net
bxdf.info
lukeshepley.wordpress.com
tarotdeseidel.com
mylovelybluesky.com
bestbet.com
8449nohate.org
space.ua
bogdanpeptine.ro
clos-galant.com
abogadosaccidentetraficosevilla.es
hokagestore.com
abuelos.com
manifestinglab.com
cortec-neuro.com
kuntokeskusrok.fi
sporthamper.com
gporf.fr
richard-felix.co.uk
xn--rumung-bua.online
linnankellari.fi
kojima-shihou.com
thenewrejuveme.com
geisterradler.de
sarbatkhalsafoundation.org
pridoxmaterieel.nl
asteriag.com
katketytaanet.fi
ungsvenskarna.se
montrium.com
argenblogs.com.ar
better.town
surespark.org.uk
smalltownideamill.wordpress.com
klusbeter.nl
punchbaby.com
gastsicht.de
smejump.co.th
digivod.de
dr-pipi.de
labobit.it
exenberger.at
roygolden.com
freie-baugutachterpraxis.de
id-vet.com
merzi.info
answerstest.ru
haremnick.com
harpershologram.wordpress.com
osterberg.fi
spsshomeworkhelp.com
naturalrapids.com
sabel-bf.com
ilcdover.com
tuuliautio.fi
skiltogprint.no
summitmarketingstrategies.com
macabaneaupaysflechois.com
mezhdu-delom.ru
iqbalscientific.com
ceid.info.tr
croftprecision.co.uk
web.ion.ag
beautychance.se
xtptrack.com
smessier.com
selfoutlet.com
ymca-cw.org.uk
schlafsack-test.net
gaiam.nl
latestmodsapks.com
analiticapublica.es
aakritpatel.com
desert-trails.com
deprobatehelp.com
americafirstcommittee.org
schmalhorst.de
healthyyworkout.com
compliancesolutionsstrategies.com
westdeptfordbuyrite.com
anybookreader.de
deltacleta.cat
theshungiteexperience.com.au
yamalevents.com
lillegrandpalais.com
phantastyk.com
foretprivee.ca
stemplusacademy.com
advokathuset.dk
bastutunnan.se
zimmerei-deboer.de
blossombeyond50.com
jyzdesign.com
cityorchardhtx.com
educar.org
uranus.nl
andersongilmour.co.uk
atozdistribution.co.uk
hellohope.com
sauschneider.info
waywithwords.net
twohourswithlena.wordpress.com
praxis-foerderdiagnostik.de
newstap.com.ng
alsace-first.com
zflas.com
corendonhotels.com
officehymy.com
ausair.com.au
mank.de
carlosja.com
smartypractice.com
harveybp.com
artige.com
ilso.net
expandet.dk
poultrypartners.nl
schoellhammer.com
esope-formation.fr
mindpackstudios.com
kevinjodea.com
greenko.pl
durganews.com
hairstylesnow.site
theletter.company
buymedical.biz
lichencafe.com
rollingrockcolumbia.com
iphoneszervizbudapest.hu
senson.fi
kenhnoithatgo.com
huissier-creteil.com
nandistribution.nl
norovirus-ratgeber.de
liliesandbeauties.org
boosthybrid.com.au
aselbermachen.com
lusak.at
bockamp.com
nokesvilledentistry.com
cwsitservices.co.uk
smokeysstoves.com
chavesdoareeiro.com
nancy-informatique.fr
fotoscondron.com
vitavia.lt
pay4essays.net
pointos.com
ralister.co.uk
galleryartfair.com
onlyresultsmarketing.com
xltyu.com
shsthepapercut.com
jeanlouissibomana.com
bigasgrup.com
drnice.de
berlin-bamboo-bikes.org
sobreholanda.com
ventti.com.ar
zzyjtsgls.com
pocket-opera.de
notmissingout.com
kunze-immobilien.de
sw1m.ru
brigitte-erler.com
financescorecard.com
familypark40.com
fannmedias.com
tennisclubetten.nl
artallnightdc.com
pt-arnold.de
parebrise-tla.fr
scenepublique.net
thedad.com
podsosnami.ru
proudground.org
cuppacap.com
amerikansktgodis.se
heliomotion.com
id-et-d.fr
kikedeoliveira.com
bouquet-de-roses.com
agence-chocolat-noir.com
birnam-wood.com
entopic.com
refluxreducer.com
romeguidedvisit.com
admos-gleitlager.de
101gowrie.com
testcoreprohealthuk.com
myhostcloud.com
huesges-gruppe.de
roadwarrior.app
fax-payday-loans.com
heurigen-bauer.at
solinegraphic.com
edrcreditservices.nl
spacecitysisters.org
dublikator.com
lloydconstruction.com
evangelische-pfarrgemeinde-tuniberg.de
suncrestcabinets.ca
pv-design.de
tomoiyuma.com
thomas-hospital.de
lynsayshepherd.co.uk
basisschooldezonnewijzer.nl
verbisonline.com
datacenters-in-europe.com
craigvalentineacademy.com
fiscalsort.com
uimaan.fi
stormwall.se
highlinesouthasc.com
cafemattmeera.com
coffreo.biz
joseconstela.com
ruralarcoiris.com
lascuola.nl
ivivo.es
joyeriaorindia.com
broseller.com
brevitempore.net
vickiegrayimages.com
olejack.ru
homesdollar.com
theduke.de
gmto.fr
hashkasolutindo.com
biortaggivaldelsa.com
erstatningsadvokaterne.dk
tandartspraktijkhartjegroningen.nl
the-virtualizer.com
bodyfulls.com
waermetauscher-berechnen.de
bauertree.com
stingraybeach.com
midmohandyman.com
noskierrenteria.com
schraven.de
lefumetdesdombes.com
smithmediastrategies.com
mooshine.com
winrace.no
slupetzky.at
tampaallen.com
zervicethai.co.th
gonzalezfornes.es
aarvorg.com
faroairporttransfers.net
minipara.com
ai-spt.jp
pierrehale.com
lescomtesdemean.be
ino-professional.ru
urclan.net
marcuswhitten.site
d1franchise.com
musictreehouse.net
miraclediet.fun
darrenkeslerministries.com
stoeferlehalle.de
simpliza.com
socstrp.org
oceanastudios.com
thaysa.com
sportverein-tambach.de
oemands.dk
gadgetedges.com
catholicmusicfest.com
hotelsolbh.com.br
socialonemedia.com
kadesignandbuild.co.uk
huehnerauge-entfernen.de
zimmerei-fl.de
rushhourappliances.com
verifort-capital.de
kmbshipping.co.uk
controldekk.com
teczowadolina.bytom.pl
ontrailsandboulevards.com
enovos.de
jobcenterkenya.com
cerebralforce.net
raschlosser.de
platformier.com
sahalstore.com
krlosdavid.com
alten-mebel63.ru
bingonearme.org
blood-sports.net
psnacademy.in
mooreslawngarden.com
systemate.dk
sotsioloogia.ee
blewback.com
ianaswanson.com
crowcanyon.com
mrxermon.de
sojamindbody.com
bigler-hrconsulting.ch
collaborativeclassroom.org
aunexis.ch
yassir.pro
work2live.de
samnewbyjax.com
gasolspecialisten.se
testzandbakmetmening.online
makeflowers.ru
pier40forall.org
stemenstilte.nl
rafaut.com
autofolierung-lu.de
autodujos.lt
wychowanieprzedszkolne.pl
ra-staudte.de
dutchcoder.nl
dushka.ua
danubecloud.com
wurmpower.at
interactcenter.org
centrospgolega.com
alhashem.net
troegs.com
ostheimer.at
todocaracoles.com
hotelzentral.at
ziegler-praezisionsteile.de
cirugiauretra.es
blogdecachorros.com
planchaavapor.net
dezatec.es
helikoptervluchtnewyork.nl
tophumanservicescourses.com
polychromelabs.com
verytycs.com
simpkinsedwards.co.uk
delchacay.com.ar
revezlimage.com
bundabergeyeclinic.com.au
rozemondcoaching.nl
n1-headache.com
copystar.co.uk
reddysbakery.com
adultgamezone.com
buroludo.nl
bigbaguettes.eu
frontierweldingllc.com
oncarrot.com
bristolaeroclub.co.uk
iyengaryogacharlotte.com
global-kids.info
carolinepenn.com
polymedia.dk
tenacitytenfold.com
aodaichandung.com
wasmachtmeinfonds.at
mrsplans.net
serce.info.pl
anthonystreetrimming.com
johnsonfamilyfarmblog.wordpress.com
slwgs.org
autodemontagenijmegen.nl
leather-factory.co.jp
despedidascostablanca.es
zenderthelender.com
abogados-en-alicante.es
hvccfloorcare.com
manijaipur.com
noesis.tech
atalent.fi
bafuncs.org
paulisdogshop.de
marchand-sloboda.com
groupe-cets.com
bowengroup.com.au
ihr-news.jp
upmrkt.co
daklesa.de
wacochamber.com
grelot-home.com
theapifactory.com
vihannesporssi.fi
vannesteconstruct.be
mdk-mediadesign.de
loprus.pl
tandartspraktijkheesch.nl
ccpbroadband.com
35-40konkatsu.net
stoeberstuuv.de
conexa4papers.trade
trapiantofue.it
woodleyacademy.org
seproc.hn
mmgdouai.fr
stacyloeb.com
ausbeverage.com.au
promesapuertorico.com
allure-cosmetics.at
onlybacklink.com
cnoia.org
sanaia.com
southeasternacademyofprosthodontics.org
architecturalfiberglass.org
balticdermatology.lt
bodyforwife.com
gantungankunciakrilikbandung.com
urist-bogatyr.ru
body-armour.online
truenyc.co
campus2day.de
dlc.berlin
greenfieldoptimaldentalcare.com
teresianmedia.org
farhaani.com
baptisttabernacle.com
creamery201.com
mbfagency.com
alysonhoward.com
victoriousfestival.co.uk
hmsdanmark.dk
tecnojobsnet.com
maryloutaylor.com
employeesurveys.com
qualitus.com
happyeasterimages.org
gw2guilds.org
easytrans.com.au
tux-espacios.com
dnepr-beskid.com.ua
levdittliv.se
finde-deine-marke.de
securityfmm.com
jerling.de
toponlinecasinosuk.co.uk
klimt2012.info
naturstein-hotte.de
mountaintoptinyhomes.com
vibethink.net
mountsoul.de
neuschelectrical.co.za
marathonerpaolo.com
connectedace.com
chaotrang.com
jsfg.com
rebeccarisher.com
falcou.fr
pmc-services.de
maureenbreezedancetheater.org
michaelsmeriglioracing.com
tinkoff-mobayl.ru
vitalyscenter.es
1kbk.com.ua
sportsmassoren.com
havecamerawilltravel2017.wordpress.com
courteney-cox.net
alfa-stroy72.com
insp.bi
mooglee.com
atmos-show.com
beaconhealthsystem.org
craigmccabe.fun
ladelirante.fr
pomodori-pizzeria.de
eglectonk.online
shiresresidential.com
lapmangfpt.info.vn
boldcitydowntown.com
vorotauu.ru
biapi-coaching.fr
almosthomedogrescue.dog
ecpmedia.vn
pubweb.carnet.hr
manutouchmassage.com
conasmanagement.de
run4study.com
cyntox.com
theadventureedge.com
antiaginghealthbenefits.com
marketingsulweb.com
y-archive.com
geoffreymeuli.com
d2marketing.co.uk
geekwork.pl
modelmaking.nl
microcirc.net
myhealth.net.au
caribbeansunpoker.com
renergysolution.com
justinvieira.com
plantag.de
gamesboard.info
lionware.de
dsl-ip.de
arteservicefabbro.com
mastertechengineering.com
parkstreetauto.net
icpcnj.org
completeweddingkansas.com
airconditioning-waalwijk.nl
hkr-reise.de
zieglerbrothers.de
kamienny-dywan24.pl
devok.info
starsarecircular.org
jasonbaileystudio.com
caribdoctor.org
latribuessentielle.com
softsproductkey.com
lorenacarnero.com
xn--singlebrsen-vergleich-nec.com
forestlakeuca.org.au
commonground-stories.com
precisionbevel.com
homng.net
pcprofessor.com
smogathon.com
tradiematepro.com.au
chefdays.de
nmiec.com
tanzschule-kieber.de
ussmontanacommittee.us
sevenadvertising.com
fizzl.ru
itelagen.com
mir-na-iznanku.com
centuryrs.com
htchorst.nl
galserwis.pl
bimnapratica.com
fensterbau-ziegler.de
tongdaifpthaiphong.net
colorofhorses.com
jolly-events.com
allfortheloveofyou.com
bargningavesta.se
12starhd.online
citymax-cr.com
oslomf.no
commercialboatbuilding.com
petnest.ir
siluet-decor.ru
firstpaymentservices.com
sportiomsportfondsen.nl
ikads.org
solerluethi-allart.ch
extensionmaison.info
executiveairllc.com
mediaplayertest.net
plotlinecreative.com
friendsandbrgrs.com
smale-opticiens.nl
triggi.de
milltimber.aberdeen.sch.uk
drinkseed.com
drfoyle.com
simplyblessedbykeepingitreal.com
sla-paris.com
dinslips.se
promalaga.es
nosuchthingasgovernment.com
kaliber.co.jp
symphonyenvironmental.com
tanciu.com
jobmap.at
shhealthlaw.com
elimchan.com
beyondmarcomdotcom.wordpress.com
balticdentists.com
comarenterprises.com
purposeadvisorsolutions.com
fotoideaymedia.es
brawnmediany.com
dareckleyministries.com
girlillamarketing.com
pasvenska.se
tulsawaterheaterinstallation.com
aniblinova.wordpress.com
goodgirlrecovery.com
camsadviser.com
mediaclan.info
bptdmaluku.com
ceres.org.au
art2gointerieurprojecten.nl
thailandholic.com
resortmtn.com
destinationclients.fr
heidelbergartstudio.gallery
visiativ-industry.fr
krcove-zily.eu
rostoncastings.co.uk
servicegsm.net
ncs-graphic-studio.com
fransespiegels.nl
sipstroysochi.ru
pinkexcel.com
readberserk.com
kirkepartner.dk
projetlyonturin.fr
shadebarandgrillorlando.com
freie-gewerkschaften.de
hiddencitysecrets.com.au
figura.team
gasbarre.com
qlog.de
carriagehousesalonvt.com
deoudedorpskernnoordwijk.nl
koken-voor-baby.nl
partnertaxi.sk
asgestion.com
imaginado.de
vetapharma.fr
eco-southafrica.com
actecfoundation.org
herbstfeststaefa.ch
naturavetal.hr
pawsuppetlovers.com
ohidesign.com
jvanvlietdichter.nl
bridgeloanslenders.com
wien-mitte.co.at
pferdebiester.de
rosavalamedahr.com
fatfreezingmachines.com
malychanieruchomoscipremium.com
songunceliptv.com
vibehouse.rw
tips.technology
kidbucketlist.com.au
vox-surveys.com
x-ray.ca
cite4me.org
chandlerpd.com
rehabilitationcentersinhouston.net
steampluscarpetandfloors.com
prochain-voyage.net
backstreetpub.com
saxtec.com
dirittosanitario.biz
ctrler.cn
modamilyon.com
lapinvihreat.fi
live-con-arte.de
crosspointefellowship.church
antenanavi.com
ki-lowroermond.nl
boisehosting.net
ivfminiua.com
xn--logopdie-leverkusen-kwb.de
darnallwellbeing.org.uk
bricotienda.com
irishmachineryauctions.com
bhwlawfirm.com
abogadoengijon.es
denifl-consulting.at
botanicinnovations.com
unim.su
judithjansen.com
bouncingbonanza.com
campusoutreach.org
spylista.com
leoben.at
austinlchurch.com
directwindowco.com
tetinfo.in
corona-handles.com
solhaug.tk
danielblum.info
withahmed.com
apprendrelaudit.com
365questions.org
pickanose.com
lebellevue.fr
strandcampingdoonbeg.com
katiekerr.co.uk
nachhilfe-unterricht.com
finediningweek.pl
vancouver-print.ca
rerekatu.com
skanah.com
shonacox.com
wellplast.se
ravensnesthomegoods.com
pasivect.co.uk
lange.host
presseclub-magdeburg.de
architekturbuero-wagner.net
bookspeopleplaces.com
yousay.site
paradicepacks.com
mikeramirezcpa.com
iviaggisonciliegie.it
abl1.net
kamahouse.net
mapawood.com
mirkoreisser.de
higadograsoweb.com
ilive.lt
1team.es
stoneys.ch
agence-referencement-naturel-geneve.net
fibrofolliculoma.info
hatech.io
real-estate-experts.com
lapinlviasennus.fi
hhcourier.com
lmtprovisions.com
nataschawessels.com
myzk.site
xn--fnsterputssollentuna-39b.se
effortlesspromo.com
radaradvies.nl
bsaship.com
4net.guru
nacktfalter.de
hihaho.com
abitur-undwieweiter.de
sexandfessenjoon.wordpress.com
memaag.com
cuspdental.com
celeclub.org
streamerzradio1.site
jadwalbolanet.info
herbayupro.com
blog.solutionsarchitect.guru
pmcimpact.com
blgr.be
baumkuchenexpo.jp
fairfriends18.de
bayoga.co.uk
love30-chanko.com
ncuccr.org
blacksirius.de
cheminpsy.fr
tinyagency.com
charlottepoudroux-photographie.fr
themadbotter.com
jusibe.com
trystana.com
christ-michael.net
luxurytv.jp
elpa.se
fitnessingbyjessica.com
trulynolen.co.uk
mercantedifiori.com
jorgobe.at
berliner-versicherungsvergleich.de
associacioesportivapolitg.cat
igrealestate.com
autopfand24.de
c-a.co.in
evologic-technologies.com
wolf-glas-und-kunst.de
bordercollie-nim.nl
psa-sec.de
hushavefritid.dk
nuzech.com
iyahayki.nl
karacaoglu.nl
i-trust.dk
thefixhut.com
aurum-juweliere.de
calabasasdigest.com
tonelektro.nl
insigniapmg.com
kafu.ch
nestor-swiss.ch
echtveilig.nl
mbxvii.com
nsec.se
groupe-frayssinet.fr
dekkinngay.com
kaotikkustomz.com
nijaplay.com
unetica.fr
dutchbrewingcoffee.com
plv.media
ftf.or.at
dw-css.de
jakekozmor.com
bunburyfreightservices.com.au
dubscollective.com
rota-installations.co.uk
sweering.fr
luckypatcher-apkz.com
crediacces.com
cleliaekiko.online
personalenhancementcenter.com
no-plans.com
calxplus.eu
strategicstatements.com
ateliergamila.com
xn--fn-kka.no
physiofischer.de
maxadams.london
ora-it.de
lbcframingelectrical.com
leeuwardenstudentcity.nl
zewatchers.com
apolomarcas.com
imadarchid.com
schutting-info.nl
dr-seleznev.com
liikelataamo.fi
fitnessbazaar.com
innote.fi
stupbratt.no
live-your-life.jp
associationanalytics.com
makeitcount.at
kostenlose-webcams.com
remcakram.com
julis-lsa.de
aco-media.nl
milestoneshows.com
baustb.de
smhydro.com.pl
caffeinternet.it
kaminscy.com
saarland-thermen-resort.com
sterlingessay.com
bildungsunderlebnis.haus
csgospeltips.se
mrsfieldskc.com
digi-talents.com
idemblogs.com
ouryoungminds.wordpress.com
aprepol.com
perbudget.com
nurturingwisdom.com
gratispresent.se
syndikat-asphaltfieber.de
allamatberedare.se
deko4you.at
whyinterestingly.ru
ledmes.ru
iwr.nl
parkcf.nl
talentwunder.com
smart-light.co.uk
maineemploymentlawyerblog.com
notsilentmd.org
hypozentrum.com
sandd.nl
takeflat.com
sanyue119.com
hugoversichert.de
corola.es
urmasiimariiuniri.ro
spectrmash.ru
international-sound-awards.com
lachofikschiet.nl
celularity.com
bierensgebakkramen.nl
braffinjurylawfirm.com
babcockchurch.org
slashdb.com
consultaractadenacimiento.com
simoneblum.de
ahouseforlease.com
igfap.com
comparatif-lave-linge.fr
ligiercenter-sachsen.de
dontpassthepepper.com
augenta.com
carrybrands.nl
eraorastudio.com
haar-spange.com
kampotpepper.gives
piajeppesen.dk
slimidealherbal.com
hebkft.hu
accountancywijchen.nl
woodworkersolution.com
all-turtles.com
henricekupper.com
videomarketing.pro
femxarxa.cat
tomaso.gr
bee4win.com
dramagickcom.wordpress.com
fitovitaforum.com
rimborsobancario.net
sinal.org
homecomingstudio.com
funjose.org.gt
c2e-poitiers.com
vloeren-nu.nl
hoteledenpadova.it
polzine.net
levihotelspa.fi
maratonaclubedeportugal.com
jenniferandersonwriter.com
grupocarvalhoerodrigues.com.br
intecwi.com
toreria.es
launchhubl.com
aminaboutique247.com
antonmack.de
otsu-bon.com
opatrovanie-ako.sk
besttechie.com
vietlawconsultancy.com
degroenetunnel.com
ftlc.es
parks-nuernberg.de
zso-mannheim.de
cursoporcelanatoliquido.online
importardechina.info
sloverse.com
behavioralmedicinespecialists.com
instatron.net
hairnetty.wordpress.com
fundaciongregal.org
assurancesalextrespaille.fr
waveneyrivercentre.co.uk
upplandsspar.se
bouldercafe-wuppertal.de
nativeformulas.com
centromarysalud.com
trackyourconstruction.com
team-montage.dk
danholzmann.com
diversiapsicologia.es
kosterra.com
miriamgrimm.de
cursosgratuitosnainternet.com
the-domain-trader.com
rksbusiness.com
greenpark.ch
xoabigail.com
DupontSellsHomes.com
outcomeisincome.com
markelbroch.com
denovofoodsgroup.com
jandaonline.com
marietteaernoudts.nl
veybachcenter.de
dpo-as-a-service.com
seevilla-dr-sturm.at
sachnendoc.com
mirjamholleman.nl
siliconbeach-realestate.com
worldhealthbasicinfo.com
spinheal.ru
supportsumba.nl
thewellnessmimi.com
noixdecocom.fr
liveottelut.com
vyhino-zhulebino-24.ru
logopaedie-blomberg.de
devstyle.org
licor43.de
gopackapp.com
delawarecorporatelaw.com
penco.ie
acomprarseguidores.com
lykkeliv.net
retroearthstudio.com
tigsltd.com
xn--vrftet-pua.biz
chatizel-paysage.fr
paymybill.guru
abogadosadomicilio.es
first-2-aid-u.com
gemeentehetkompas.nl
xlarge.at
milsing.hr
daniel-akermann-architektur-und-planung.ch
candyhouseusa.com
maasreusel.nl
mylolis.com
stefanpasch.me
charlesreger.com
mdacares.com
panelsandwichmadrid.es
yourobgyn.net
irinaverwer.com
whittier5k.com
narcert.com
modestmanagement.com
micro-automation.de
baylegacy.com
izzi360.com
littlebird.salon
filmstreamingvfcomplet.be
craftleathermnl.com
triactis.com
qualitaetstag.de
insidegarage.pl
burkert-ideenreich.de
nakupunafoundation.org
stopilhan.com
kalkulator-oszczednosci.pl
igorbarbosa.com
saka.gr
fayrecreations.com
alvinschwartz.wordpress.com
www1.proresult.no
coding-machine.com
brandl-blumen.de
villa-marrakesch.de
ditog.fr
operaslovakia.sk
new.devon.gov.uk
philippedebroca.com
satyayoga.de
travelffeine.com
pelorus.group
mepavex.nl
binder-buerotechnik.at
boulderwelt-muenchen-west.de
schoolofpassivewealth.com
psc.de
wsoil.com.sg
mrtour.site
thomasvicino.com
morawe-krueger.de
praxis-management-plus.de
slimani.net
lucidinvestbank.com
faizanullah.com
ampisolabergeggi.it
rumahminangberdaya.com
webcodingstudio.com
lecantou-coworking.com
stampagrafica.es
christinarebuffetcourses.com
foryourhealth.live
ncid.bc.ca
vermoote.de
nicoleaeschbachorg.wordpress.com
navyfederalautooverseas.com
gymnasedumanagement.com
hrabritelefon.hr
stallbyggen.se
limassoldriving.com
otto-bollmann.de
kissit.ca
flexicloud.hk
pcp-nc.com
dr-tremel-rednitzhembach.de
pixelarttees.com
sairaku.net
ogdenvision.com
people-biz.com
advizewealth.com
kedak.de
castillobalduz.es
webmaster-peloton.com
imperfectstore.com
4youbeautysalon.com
humanityplus.org
spd-ehningen.de
kao.at
argos.wityu.fund
coursio.com
lenreactiv-shop.ru
helenekowalsky.com
odiclinic.org
kindersitze-vergleich.de
-
net
true
-
pid
$2a$10$gMHdtu094GE7DD46JvCH6.bPoHnpKjInjjdxBtPaRwAEY6gOWGKYG
-
prc
firefox
agntsvc
tbirdconfig
ocomm
visio
oracle
outlook
winword
isqlplussvc
mydesktopservice
steam
thunderbird
ocautoupds
synctime
infopath
thebat
onenote
excel
encsvc
mspub
dbeng50
sql
sqbcoreservice
xfssvccon
msaccess
powerpnt
ocssd
wordpad
dbsnmp
mydesktopqos
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
3721
-
svc
vss
veeam
sophos
mepocs
svc$
backup
sql
memtas
Extracted
C:\Users\39241-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F98A1D2AB659188B
http://decoder.re/F98A1D2AB659188B
Extracted
C:\Users\ov4ed-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/57D32A2674287429
http://decoder.re/57D32A2674287429
Extracted
C:\Users\s102e1i-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/30CE13B6D81D3151
http://decoder.re/30CE13B6D81D3151
Extracted
C:\Users\dlqoj-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/425D415C9C564E5B
http://decoder.re/425D415C9C564E5B
Targets
-
-
Target
6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11.exe
-
Size
116KB
-
MD5
c647b2da83ef8e1a790d1e0e25898780
-
SHA1
02871c02e581ad345f1c438b6c8c730cf2d2f534
-
SHA256
6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11
-
SHA512
f169ebc4ffbb3d0cf8f526e0cde89706b4521086ccb0f7653cd881b595aae2727891e8ea3eb6bace263d704b0ef9a0151094c03b7c1800cb5d4e54eaaf3453e7
-
SSDEEP
1536:/Ilhrm++mJ0eYjT7LUrACph77pS2i/ICS4Anv++nUSAXvzSPe0+WMpi1NjJiBty:bfcrh7tJFLUdAj11Ji
Score10/10-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Sodinokibi family
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-
-
-
Target
run_revil.bat
-
Size
120B
-
MD5
0d0877a920cc13d77e89e72fd098d238
-
SHA1
3af65d1f0ff34ce90c289b1201a489575dd225e4
-
SHA256
41e9c846ad4099da47e7baa5ebfd51bc53a10716cd00130d843bb33e53440120
-
SHA512
b189fc8d21678926b7d79cdeb0ec44a63519cd7a7c85ce659b78ff7d2f526e2e92a2b308cf791c331cdc5cd5ed1d0fb482996a9587c3ee8c3741307dd9b4b572
Score10/10-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Sodinokibi family
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1