General
-
Target
JaffaCakes118_bbc954b3fc530cc78e31bde1143a776c569c429010e0e5edcc35c0af49bd280a
-
Size
262KB
-
Sample
241221-y7gbvsyqbp
-
MD5
f6911c254588cafde26c259e5b65c216
-
SHA1
e39121841f8bf65a20a6e6ab39c920e85cc57a4f
-
SHA256
bbc954b3fc530cc78e31bde1143a776c569c429010e0e5edcc35c0af49bd280a
-
SHA512
c07e7a58d472944f7482238c0273843b2ec43c9f8d7f89d798dcdeab1ef9622a8b8e4cdabaf6c3f5dd11ddb3710a18153fb7f0301442742a3a90f2cb7845d826
-
SSDEEP
6144:hN4mxOdSFN7OlLU/06XNMxYj6tvtQ6eOoHBRjzb7bqkj5qllP:hN4KOJU/0KMYjItQ6eRtzb7Gkj5qllP
Static task
static1
Behavioral task
behavioral1
Sample
DHL __.pdf(1).exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
DHL __.pdf(1).exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
sodinokibi
30
97
sytzedevries.com
druktemakersheerenveen.nl
energosbit-rp.ru
business-basic.de
acibademmobil.com.tr
leansupremegarcinia.net
worldproskitour.com
shortsalemap.com
pansionatblago.ru
humanviruses.org
ya-elka.ru
block-optic.com
silkeight.com
carmel-york.com
unexplored.gr
hotjapaneselesbian.com
forextimes.ru
avisioninthedesert.com
agenceassemble.fr
keyboardjournal.com
omnicademy.com
nginx.com
bodet150ans.com
hostaletdelsindians.es
blueridgeheritage.com
richardiv.com
adedesign.com
keuken-prijs.nl
jmmartinezilustrador.com
lumturo.academy
gaearoyals.com
reizenmetkinderen.be
diverfiestas.com.es
thepixelfairy.com
theboardroomafrica.com
brisbaneosteopathic.com.au
specialtyhomeservicesllc.com
greenrider.nl
fire-space.com
jobscore.com
airserviceunlimited.com
activeterroristwarningcompany.com
o2o-academy.com
tatyanakopieva.ru
5pointpt.com
letsstopsmoking.co.uk
the5thquestion.com
bourchier.org
dmlcpa.com
lovetzuchia.com
groovedealers.ru
liveyourheartout.co
grupoexin10.com
istantidigitali.com
turing.academy
avtoboss163.ru:443
drvoip.com
dentourage.com
sharonalbrightdds.com
gardenpartner.pl
nvisionsigns.com
asiaartgallery.jp
jag.me
skolaprome.eu
anleggsregisteret.no
teethinadaydentalimplants.com
spartamovers.com
prodentalblue.com
carsten.sparen-it.de
mrkluttz.com
pajagus.fr
advanced-removals.co.uk
trevi-vl.ru
dierenambulancealkmaar.nl
radishallgood.com
fta-media.com
myplaywin3.com
kartuindonesia.com
apmollerpension.com
tanatek.com
cp-bap.de
eshop.design
brighthillgroup.com
toranjtuition.org
distrifresh.com
fascaonline.com
cardsandloyalty.com
watchsale.biz
ilovefullcircle.com
mazzaropi.com.br
ziliak.com
rhino-turf.com
geoweb.software
hameghlim.com
johnkoen.com
riffenmattgarage.ch
bohrlochversicherung.info
motocrosshideout.com
hiddensee-buhne11.de
omegamarbella.com
memphishealthandwellness.com
geitoniatonaggelon.gr
angeleyezstripclub.com
dogsunlimitedguide.com
qrs-international.com
dinedrinkdetroit.com
hoteltantra.com
kelsigordon.com
nutriwell.com.sg
ced-elec.com
schluesseldienste-hannover.de
k-zubki.ru
chorusconsulting.net
ludoil.it
mollymccarthydesign.com
fidelitytitleoregon.com
powershell.su
michaelfiegel.com
nicksrock.com
vapiano.fr
biblica.com
renehartman.nl
switch-made.com
xn--80addfr4ahr.dp.ua
cac2040.com
birthplacemag.com
basindentistry.com
fysiotherapierijnmond.nl
leadforensics.com
creohn.de
noda.com.ua
lmmont.sk
airvapourbarrier.com
bagaholics.in
thisprettyhair.com
signamedia.de
skooppi.fi
mariamalmahdi.com
greeneyetattoo.com
jimprattmediations.com
bertbutter.nl
michal-s.co.il
smartmind.net
iron-mine.ru
augen-praxisklinik-rostock.de
iactechnologies.net
salonlamar.nl
jayfurnitureco.com
wrinstitute.org
veggienessa.com
baikalflot.ru
adabible.org
delegationhub.com
soncini.ch
georgemuncey.com
hekecrm.com
kemtron.fr
logosindustries.com
lookandseen.com
buffdaddyblog.com
relevantonline.eu
redpebblephotography.com
skidpiping.de
jglconsultancy.com
90nguyentuan.com
shortysspices.com
yvesdoin-aquarelles.fr
nevadaruralhousingstudies.org
amelielecompte.wordpress.com
arthakapitalforvaltning.dk
skyscanner.ro
rarefoods.ro
blucamp.com
zealcon.ae
mangimirossana.it
amyandzac.com
metcalfe.ca
smartworkplaza.com
guohedd.com
akcadagofis.com
drnelsonpediatrics.com
charlesfrancis.photos
weddingceremonieswithtim.com
bcabattoirs.org
four-ways.com
insane.agency
chris-anne.com
fskhjalmar.se
altocontatto.net
cymru.futbol
bubbalucious.com
alnectus.com
directique.com
mazift.dk
neolaiamedispa.com
mieleshopping.it
entdoctor-durban.com
lesyeuxbleus.net
itheroes.dk
craftingalegacy.com
sycamoregreenapts.com
broccolisoep.nl
mondolandscapes.com
andermattswisswatches.ch
nepal-pictures.com
afbudsrejserallinclusive.dk
aidanpublishing.co.uk
11.in.ua
sealgrinderpt.com
alpesiberie.com
the-beauty-guides.com
perfectgrin.com
krishnabrawijaya.com
gazelle-du-web.com
oexebusiness.com
whoopingcrane.com
nalliasmali.net
buzzneakers.com
cssp-mediation.org
clemenfoto.dk
reputation-medical.online
andreaskildegaard.dk
malevannye.ru
ivancacu.com
spacebel.be
cops4causes.org
glennverschueren.be
adaduga.info
innervisions-id.com
animation-pro.co.uk
aoyama.ac
aciscomputers.com
bajova.sk
cascinarosa33.it
trainiumacademy.com
tages-geldvergleich.de
casinodepositors.com
rivermusic.nl
digitale-elite.de
eatyoveges.com
almamidwifery.com
log-barn.co.uk
projektparkiet.pl
barbaramcfadyenjewelry.com
schulz-moelln.de
hensleymarketing.com
gta-jjb.fr
abulanov.com
skyboundnutrition.co.uk
jaaphoekzema.nl
mslp.org
curtsdiscountguns.com
ownidentity.com
morgansconsult.com
poems-for-the-soul.ch
selected-minds.de
cc-experts.de
koncept-m.ru
rtc24.com
look.academy
latableacrepes-meaux.fr
cincinnatiphotocompany.org
boloria.de
irizar.com
louiedager.com
ruggestar.ch
peppergreenfarmcatering.com.au
goddardleadership.org
rino-gmbh.com
customroasts.com
lassocrm.com
theintellect.edu.pk
alaskaremote.com
elex.is
parseport.com
thegrinningmanmusical.com
makingmillionaires.net
2020hindsight.info
nepressurecleaning.com
legundschiess.de
charlottelhanna.com
triplettabordeaux.fr
utilisacteur.fr
optigas.com
jameswilliamspainting.com
zumrutkuyutemel.com
factorywizuk.com
awaisghauri.com
yayasanprimaunggul.org
speiserei-hannover.de
fsbforsale.com
mahikuchen.com
narca.net
easydental.ae
1deals.com
domaine-des-pothiers.com
mercadodelrio.com
fann.ru
lovcase.com
otpusk.zp.ua
enews-qca.com
premier-iowa.com
ledyoucan.com
innovationgames-brabant.nl
wademurray.com
rvside.com
oro.ae
alisodentalcare.com
mursall.de
oncarrot.com
moira-cristescu.com
buonabitare.com
ramirezprono.com
rapid5kloan.org
startuplive.org
alattekniksipil.com
ygallerysalonsoho.com:443
pinthelook.com
khtrx.com
bayshoreelite.com
janmorgenstern.com
kdbrh.com
bilius.dk
stoneridgemontessori.com
wordpress.idium.no
colored-shelves.com
hutchstyle.co.uk
deziplan.ru
finsahome.co.uk
factoriareloj.com
pilotgreen.com
subquercy.fr
anchelor.com
bakingismyyoga.com
triavlete.com
fitnessblenderstory.com
hartofurniture.com
bratek-immobilien.de
a-zpaperwork.eu
redctei.co
p-ride.live
acornishstudio.co.uk
teamsegeln.ch
production-stills.co.uk
quitescorting.com
bellesiniacademy.org
janellrardon.com
iexpert99.com
agriturismocastagneto.it
hotelturbo.de
campusce.com
dcc-eu.com
heuvelland-oaze.nl
orchardbrickwork.com
rizplakatjaya.com
burg-zelem.de
imaginekithomes.co.nz
pokemonturkiye.com
napisat-pismo-gubernatoru.ru:443
9nar.com
margaretmcshane.com
bonitabeachassociation.com
littlesaints.academy
globalcompliancenews.com
zwemofficial.nl
metriplica.academy
davedavisphotos.com
raeoflightmusic.com
catering.com
brannbornfastigheter.se
wribrazil.com
jdscenter.com
belofloripa.be
efficiencyconsulting.es
prometeyagro.com.ua
saboboxtel.uk
monstarrsoccer.com
jlwilsonbooks.com
mamajenedesigns.com
motocrossplace.co.uk
shrinkingplanet.com
protoplay.ca
jobstomoveamerica.org
pays-saint-flour.fr
animalfood-online.de
modamarfil.com
onlinemarketingsurgery.co.uk
forumsittard.nl
parksideseniorliving.net
kryddersnapsen.dk
jalkapuu.net
goodboyscustom.com
queertube.net
kookooo.com
b3b.ch
chatterchatterchatter.com
ox-home.com
karelinjames.com
premiumweb.com.ua:443
from02pro.com
pixelhealth.net
banukumbak.com
awaitspain.com
laylavalentine.com
explora.nl
profibersan.com
wasnederland.nl
campinglaforetdetesse.com
greatofficespaces.net
primemarineengineering.com
belinda.af
bjornvanvulpen.nl
der-stempelking.de
k-v-f.de
fotoslubna.com
sjtpo.org
uncensoredhentaigif.com
alabamaroofingllc.com
artvark.nl
yourhappyevents.fr
brinkdoepke.eu
skoczynski.eu
jollity.hu
topautoinsurers.net
glas-kuck.de
subyard.com
harleystreetspineclinic.com
fluzfluzrewards.com
the-cupboard.co.uk
kroophold-sjaelland.dk
zuerich-umzug.ch
mediogiro.com.ar
alharsunindo.com
galatee-couture.com
espaciopolitica.com
zorgboerderijravensbosch.nl
paardcentraal.nl
mayprogulka.ru
acumenconsultingcompany.com
smartercashsystem.com
annenymus.com
palmenhaus-erfurt.de
laaisterplakky.nl
markseymourphotography.co.uk
phukienbepthanhdat.com
smartspeak.com
terraflair.de
sachainchiuk.com
bruut.online
coachpreneuracademy.com
qandmmusiccenter.com
dnqa.co.uk
beandrivingschool.com.au
julielusktherapy.com
eyedoctordallas.com
dr-vita.de
rishigangoly.com
rsidesigns.com
rubyaudiology.com
deduktia.fi
stitch-n-bitch.com
egpu.fr
tradenavigator.ch
wg-heiligenstadt.de
tramadolhealth.com
billigeflybilletter.dk
chomiksy.net
licensed-public-adjuster.com
kenmccallum.com
bulyginnikitav.000webhostapp.com
line-x.co.uk
profiz.com
ijsselbeton.nl
supercarhire.co.uk
paradigmlandscape.com
internestdigital.com
eastgrinsteadwingchun.com
fotoeditores.com
proffteplo.com
foerderverein-vatterschule.de
affligemsehondenschool.be
piestar.com
askstaffing.com
fanuli.com.au
mariannelemenestrel.com
tilldeeke.de
direitapernambuco.com
pankiss.ru
walterman.es
funworx.de
die-immo-agentur.de
precisetemp.com
physio-lang.de
graygreenbiomedservices.com
happylublog.wordpress.com
skinkeeper.li
oraweb.net
stage-infirmier.fr
bd2fly.com
happycatering.de
kellengatton.com
osn.ro
thestudio.academy
eksperdanismanlik.com
auto-opel.ro
pedmanson.com
lifeinbreaths.com
lyricalduniya.com
envomask.com
midwestschool.org
ayudaespiritualtamara.com
stagefxinc.com
hm-com.com
computer-place.de
soundseeing.net
jefersonalessandro.com
lisa-poncon.fr
thenalpa.com
condormobile.fr
miscbo.it
scentedlair.com
epicjapanart.com
speakaudible.com
descargandoprogramas.com
mind2muscle.nl
frimec-international.es
avis.mantova.it
luvinsburger.fr
hawaiisteelbuilding.com
saberconcrete.com
kafkacare.com
internalresults.com
furland.ru
penumbuhrambutkeiskei.com
unislaw-narty.pl
marcandy.com
hepishopping.com
carolynfriedlander.com
opt4cdi.com
tastevirginia.com
brownswoodblog.com
larchwoodmarketing.com
texanscan.org
magrinya.net
edrickennedymacfoy.com
circlecitydj.com
witraz.pl
mgimalta.com
kerstliedjeszingen.nl
ravage-webzine.nl
lunoluno.com
ahgarage.com
galaniuklaw.com
frameshift.it
kompresory-opravy.com
pazarspor.org.tr
billscars.net
zdrowieszczecin.pl
spectamarketingdigital.com.br
mbuildinghomes.com
levencovka.ru
tothebackofthemoon.com
gratiocafeblog.wordpress.com
evsynthacademy.org
ideamode.com
cmeow.com
masecologicos.com
bg.szczecin.pl
azerbaycanas.com
tutvracks.com
dreamvoiceclub.org
flossmoordental.com
letterscan.de
bookingwheel.com
designimage.ae
mneti.ru
yourcosmicbeing.com
purepreprod4.com
go.labibini.ch
sellthewrightway.com
mrcar.nl
chinowarehousespace.com
breathebettertolivebetter.com
gosouldeep.com
promus.ca
matteoruzzaofficial.com
global-migrate.com
bodymindchallenger.com
agrifarm.dk
peninggibadan.co.id
cesep2019.com
tbalp.co.uk
artcase.pl
jandhpest.com
web865.com
kristianboennelykke.dk
electricianul.com
hvitfeldt.dk
amco.net.au
adterium.com
oportowebdesign.com
thehovecounsellingpractice.co.uk
cuadc.org
fi-institutionalfunds.com
transifer.fr
livedeveloper.com
karmeliterviertel.com
forskolinslimeffect.net
santastoy.store
loysonbryan.com
levelseven.be
endlessrealms.net
invela.dk
kosten-vochtbestrijding.be
antesacademy.it
voice2biz.com
leijstrom.com
cap29010.it
vitormmcosta.com
rokthetalk.com
hostastay.com
inewsstar.com
wallflowersandrakes.com
centuryvisionglobal.com
bridalcave.com
ufovidmag.com
ntinasfiloxenia.gr
etgdogz.de
werkzeugtrolley.net
jobkiwi.com.ng
clinic-beethovenstrasse-ag.ch
husetsanitas.dk
kuriero.pro
finnergo.eu
topvijesti.net
ultimatelifesource.com
unboxtherapy.site
perceptdecor.com
zaczytana.com
enactusnhlstenden.com
rename.kz
dinecorp.com
catchup-mag.com
devplus.be
haus-landliebe.de
linearete.com
initconf.com
altitudeboise.com
bescomedical.de
berdonllp.com
scholarquotes.com
bychowo.pl
metallbau-hartmann.eu
sppdstats.com
agendatwentytwenty.com
xtensifi.com
marmarabasin.com
reygroup.pt
ketomealprep.academy
johnstonmingmanning.com
landgoedspica.nl
sochi-okna23.ru
lagschools.ng
wineandgo.hu
satoblog.org
slotenmakerszwijndrecht.nl
wirmuessenreden.com
lattalvor.com
triplettagaite.fr
webforsites.com
3daywebs.com
imagine-entertainment.com
molade.nl
aberdeenartwalk.org
ceocenters.com
bendel-partner.de
newonestop.com
thiagoperez.com
boyfriendsgoal.site
nykfdyrehospital.dk
buerocenter-butzbach-werbemittel.de
cleanroomequipment.ie
mindfuelers.com
photographycreativity.co.uk
palema.gr
craftstone.co.nz
putzen-reinigen.com
ocduiblog.com
site.markkit.com.br
patassociation.com
ncjc.ca
xn--80abehgab4ak0ddz.xn--p1ai
pinkxgayvideoawards.com
allinonecampaign.com
leopoldineroux.com
christianscholz.de
awag-blog.de
rs-danmark.dk
imajyuku-sozoku.com
gavelmasters.com
muller.nl
aheadloftladders.co.uk
testitjavertailut.net
expohomes.com
gsconcretecoatings.com
vitoriaecoturismo.com.br
datatri.be
nxtstg.org
duthler.nl
leloupblanc.gr
justaroundthecornerpetsit.com
alcye.com
eafx.pro
ebible.co
biketruck.de
sbit.ag
encounter-p.net
handyman-silkeborg.dk
tellthebell.website
ikadomus.com
mrmac.com
mac-computer-support-hamburg.de
muni.pe
annida.it
mike.matthies.de
bavovrienden.nl
angelika-schwarz.com
sveneulberg.de
klapanvent.ru
livelai.com
globalskills.pt
baita.ac
biodentify.ai
denhaagfoodie.nl
cookinn.nl
autoteamlast.de
heimdalbygg.no
citydogslife.com
hypogenforensic.com
dieetuniversiteit.nl
pro-gamer.pl
innersurrection.com
lgiwines.com
lashandbrowenvy.com
wyreforest.net
valiant-voice.com
onesynergyinternational.com
springfieldplumbermo.com
sarahspics.co.uk
axisoflove.org:443
photonag.com
theater-lueneburg.de
christopherhannan.com
lsngroupe.com
janasfokus.com
catalyseurdetransformation.com
stralsund-ansichten.de
dantreranch.com
albcleaner.fr
strauchs-wanderlust.info
alexwenzel.de
oththukaruva.com
g2mediainc.com
mediahub.co.nz
pharmeko-group.com
towelroot.co
framemyballs.com
luvbec.com
sweetz.fr
teutoradio.de
ciga-france.fr
rattanwarehouse.co.uk
dentalcircle.com
akwaba-safaris.com
opticahubertruiz.com
comoserescritor.com
aceroprime.com
pxsrl.it
suonenjoen.fi
gatlinburgcottage.com
andrealuchesi.it
vipcarrental.ae
yuanshenghotel.com
concontactodirecto.com
taulunkartano.fi
kombi-dress.com
parisschool.ru
aquacheck.co.za
katherinealy.com
slotspinner.com
bmw-i-pure-impulse.com
mjk.digital
alene.co
outstandingminialbums.com
donau-guides.eu
atma.nl
saint-malo-developpement.fr
myfbateam.com
volta.plus
nbva.co.uk
richardmaybury.co.uk
hospitalitytrainingsolutions.co.uk
onlinetvgroup.com
nrgvalue.com
ikzoekgod.be
solidhosting.nl
cmascd.com
drbrianhweeks.com
elliemaccreative.wordpress.com
tecleados.com
rolleepollee.com
amorbellezaysalud.com
arabianmice.com
campusescalade.com
schroederschoembs.com
mikegoodfellow.co.uk
hinotruckwreckers.com.au
signededenroth.dk
rozmata.com
trivselsguide.dk
floweringsun.org
zinnystar.com
frankgoll.com
stathmoulis.gr
collegetennis.info
nationnewsroom.com
ilveshistoria.com
advesa.com
jeanmonti.com
stressreliefadvice.com
juergenblaetz.de
chainofhopeeurope.eu
domilivefurniture.com
placermonticello.com
welovecustomers.fr
breakluckrecords.com
matthieupetel.fr
verbouwingsdouche.nl
mariajosediazdemera.com
thegetawaycollective.com
xn--ziinoapte-6ld.ro
thesilkroadny.com
babysitting-hk.helpergo.co
dibli.store
ninjaki.com
interlinkone.com
ronielyn.com
aslog.fr
dennisverschuur.com
agora-collectivites.com
suitesartemis.gr
betterce.com
kryptos72.com
bcmets.info
traitware.com
jlgraphisme.fr
randyabrown.com
sber-biznes.com
fazagostar.co
slideevents.be
solutionshosting.co.uk
rossomattonecase.it
jax-interim-and-projectmanagement.com
blavait.fr
vvego.com
natturestaurante.com.br
fixx-repair.com
johnsonweekly.com
racefietsenblog.nl
vedsegaard.dk
plbinsurance.com
ykobbqchicken.ca
malzomattalar.com
vdolg24.online
naukaip.ru
simpleitsolutions.ch
5thactors.com
drbenveniste.com
hostingbangladesh.net
therapybusinessacademy.com
hawthornsretirement.co.uk
goodherbalhealth.com
eos-horlogerie.com
nuohous.com
dayenne-styling.nl
publicompserver.de
arearugcleaningnyc.com
uci-france.fr
cl0nazepamblog.com
mindsparkescape.com
manzel.tn
advancedeyecare.com
nauticmarine.dk
test-teleachat.fr
golfclublandgoednieuwkerk.nl
kiraribeaute-nani.com
maxcube24.com.ua
gbk-tp1.de
renderbox.ch
claudiakilian.de
secrets-clubs.co.uk
c-sprop.com
scietech.academy
rentsportsequip.com
indiebizadvocates.org
ronaldhendriks.nl
universelle.fr
atrgroup.it
stanleyqualitysystems.com
acb-gruppe.ch
cainlaw-okc.com
beauty-traveller.com
pureelements.nl
kickittickets.com
csaballoons.com
azloans.com
mundo-pieces-auto.fr
maryairbnb.wordpress.com
ddmgen.com
operativadigital.com
studionumerik.fr
silverbird.dk
mesajjongeren.nl
citiscapes-art.com
diakonie-weitramsdorf-sesslach.de
bluetenreich-brilon.de
eventosvirtualesexitosos.com
polynine.com
chatberlin.de
grancanariaregional.com
voetbalhoogeveen.nl
bundan.com
hnkns.com
netadultere.fr
olry-cloisons.fr
bumbipdeco.site
fridakids.com
gurutechnologies.net
holocine.de
jacquesgarcianoto.com
baumfinancialservices.com
leatherjees.com
eurethicsport.eu
ingresosextras.online
alltagsrassismus-entknoten.de
arazi.eus
sprintcoach.com
pourlabretagne.bzh
billyoart.com
aktivfriskcenter.se
apiarista.de
scotlandsroute66.co.uk
metroton.ru
dentallabor-luenen.de
liepertgrafikweb.at
nieuwsindeklas.be
neonodi.be
the3-week-diet.net
linkbuilding.life
qwikcoach.com
endstarvation.com
atelierkomon.com
tweedekansenloket.nl
o90.dk
kamin-somnium.de
denverwynkoopdentist.com
cormanmarketing.com
professionetata.com
cyberpromote.de
rhino-storage.co.uk
fla.se
angelsmirrorus.com
bluemarinefoundation.com
successcolony.com.ng
t3brothers.com
m2graph.fr
jonnyhooley.com
apogeeconseils.fr
advance-refle.com
richardkershawwines.co.za
tieronechic.com
tchernia-conseil.fr
theatre-embellie.fr
hom-frisor.dk
pubcon.com
craftron.com
docarefoundation.org
epsondriversforwindows.com
nexstagefinancial.com
xrresources.com
limmortelyouth.com
martinipstudios.com
kvetymichalovce.sk
jakubrybak.com
smarttourism.academy
corporacionrr.com
stabilisateur.fr
sambaglow.com
lidkopingsnytt.nu
boomerslivinglively.com
so-sage.fr
girlish.ae
auberives-sur-vareze.fr
rechtenplicht.be
edvestors.org
111firstdelray.com
phoenixcrane.com
martha-frets-ceramics.nl
n-newmedia.de
glende-pflanzenparadies.de
pvandambv.nl
banksrl.co.za
goeppinger-teppichreinigung.de
lexced.com
pisofare.co
tetameble.pl
parentsandkids.com
liverpoolabudhabi.ae
sunsolutions.es
magnetvisual.com
tzn.nu
haard-totaal.nl
astrographic.com
lapponiasafaris.com
baptistdistinctives.org
molinum.pt
latteswithleslie.com
lollachiro.com
bluelakevision.com
yournextshoes.com
achetrabalhos.com
brunoimmobilier.com
victorvictoria.com
mustangmarketinggroup.com
futurenetworking.com
cxcompany.com
devus.de
paprikapod.com
focuskontur.com
benchbiz.com
housesofwa.com
fbmagazine.ru
mediabolmong.com
oscommunity.de
cotton-avenue.co.il
ncn.nl
schlagbohrmaschinetests.com
patriotcleaning.net
sshomme.com
stringnosis.academy
loparnille.se
crestgood.com
tesisatonarim.com
bringmehope.org
spirello.nl
medicalsupportco.com
grafikstudio-visuell.de
sololibrerie.it
palmecophilippines.com
rentingwell.com
singletonfinancial.com
daveystownhouse.com
techybash.com
agencewho-aixenprovence.fr
mensemetgesigte.co.za
alwaysdc.com
elitkeramika-shop.com.ua
limounie.com
circuit-diagramz.com
nourella.com
xn--billigafrgpatroner-stb.se
min-virksomhed.dk
kausette.com
-
net
true
-
pid
30
-
prc
mysqld_nt.exe
dbsnmp.exe
ocssd.exe
sqlwriter.exe
winword.exe
oracle.exe
thunderbird.exe
mysqld_opt.exe
agntsvc.exe
excel.exe
ocautoupds.exe
encsvc.exe
infopath.exe
mspub.exe
msaccess.exe
steam.exe
sqlservr.exe
dbeng50.exe
sqlbrowser.exe
onenote.exe
firefoxconfig.exe
mydesktopqos.exe
thebat64.exe
xfssvccon.exe
synctime.exe
ocomm.exe
powerpnt.exe
tbirdconfig.exe
sqbcoreservice.exe
mysqld.exe
visio.exe
wordpad.exe
mydesktopservice.exe
isqlplussvc.exe
sqlagent.exe
thebat.exe
outlook.exe
msftesql.exe
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
97
Extracted
C:\Users\iey029hmi-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B805D138AD2CF8B3
http://decryptor.top/B805D138AD2CF8B3
Extracted
C:\Users\72uub0b-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E0D423B298B5EB40
http://decryptor.top/E0D423B298B5EB40
Targets
-
-
Target
DHL __.pdf(1).bin
-
Size
555KB
-
MD5
cd4a9b992171f893ae11fbff7d1b9252
-
SHA1
7fcb6fa46300ee32d6abb30627e841a13e0269bf
-
SHA256
578d694adb18d1dda0ee217c2c08e2e99f5d1bb9bafe6f3962844bbe6e6ebf12
-
SHA512
24aed4844f20d9b025c8f8ee0429bb4f3432573cc08e86e8014cd82d56ed22c1caa7ac4bbaa95ff4790d5240d0641806f44104f65fa2541803d6552ae5745014
-
SSDEEP
6144:thTFzbi0i83BJ5NraUGTRQrFc67uSCLc9aDYU07XbUAWAVf:DJq0i83B3la7GYDVaXDVf
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Sodinokibi family
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1