General
-
Target
JaffaCakes118_3f50b89979ffff65668924c1b935cf655b8efc46d4c121ae8627a0474f1d9e0a
-
Size
599KB
-
Sample
241224-r9cywszpar
-
MD5
fd6d16ef09a96897604557faf17ac1f9
-
SHA1
8b702da8f8426af9f501ba546f273c2d5f79f75d
-
SHA256
3f50b89979ffff65668924c1b935cf655b8efc46d4c121ae8627a0474f1d9e0a
-
SHA512
d68c63366abcf5b19417d165e4b483cd660235e8ce1b4abaf943e1f2985d8c58f71a03da90c55dc73e4c95945baed3d78d23bda00122ee5bf230e43ef751f34e
-
SSDEEP
6144:brcj5kylPt7lBGughNrYjgKQsLbxUvTzbJ63hDQXQP2FD8nDDX1:bIRt/y+ebPJG0Xq24nn1
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_3f50b89979ffff65668924c1b935cf655b8efc46d4c121ae8627a0474f1d9e0a.dll
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_3f50b89979ffff65668924c1b935cf655b8efc46d4c121ae8627a0474f1d9e0a.dll
Resource
win10v2004-20241007-en
Malware Config
Extracted
sodinokibi
$2a$10$IPiW2KVZ6.EncqncWsH0DOQxumQO.ZRLYn0MVYoeGgiVYLdGlGgMG
6769
sportiomsportfondsen.nl
bayoga.co.uk
fax-payday-loans.com
advokathuset.dk
patrickfoundation.net
321play.com.hk
aminaboutique247.com
makeitcount.at
liikelataamo.fi
testcoreprohealthuk.com
luckypatcher-apkz.com
lascuola.nl
architecturalfiberglass.org
dareckleyministries.com
moveonnews.com
michaelsmeriglioracing.com
humanityplus.org
familypark40.com
coastalbridgeadvisors.com
brandl-blumen.de
sobreholanda.com
rehabilitationcentersinhouston.net
craigvalentineacademy.com
elimchan.com
creative-waves.co.uk
retroearthstudio.com
vietlawconsultancy.com
div-vertriebsforschung.de
ceid.info.tr
bestbet.com
camsadviser.com
xltyu.com
sportsmassoren.com
webhostingsrbija.rs
euro-trend.pl
dezatec.es
rksbusiness.com
goodgirlrecovery.com
quizzingbee.com
mymoneyforex.com
rocketccw.com
almosthomedogrescue.dog
milanonotai.it
esope-formation.fr
jenniferandersonwriter.com
ctrler.cn
sarbatkhalsafoundation.org
smithmediastrategies.com
psc.de
autopfand24.de
ccpbroadband.com
boulderwelt-muenchen-west.de
live-your-life.jp
cursosgratuitosnainternet.com
thedad.com
gamesboard.info
tophumanservicescourses.com
lefumetdesdombes.com
lebellevue.fr
alhashem.net
smalltownideamill.wordpress.com
mindpackstudios.com
tongdaifpthaiphong.net
ahouseforlease.com
stoneys.ch
songunceliptv.com
piajeppesen.dk
polychromelabs.com
i-arslan.de
bsaship.com
vorotauu.ru
corola.es
citymax-cr.com
maryloutaylor.com
rollingrockcolumbia.com
1kbk.com.ua
alten-mebel63.ru
walter-lemm.de
mediaacademy-iraq.org
abuelos.com
ledmes.ru
irishmachineryauctions.com
calxplus.eu
synlab.lt
bunburyfreightservices.com.au
asiluxury.com
schlafsack-test.net
panelsandwichmadrid.es
gporf.fr
pmcimpact.com
kafu.ch
stupbratt.no
edgewoodestates.org
theapifactory.com
kedak.de
extraordinaryoutdoors.com
mooreslawngarden.com
mirjamholleman.nl
uimaan.fi
kostenlose-webcams.com
nijaplay.com
enovos.de
gw2guilds.org
candyhouseusa.com
wari.com.pe
jolly-events.com
troegs.com
zieglerbrothers.de
helenekowalsky.com
judithjansen.com
centromarysalud.com
dlc.berlin
tecnojobsnet.com
fannmedias.com
artige.com
nokesvilledentistry.com
degroenetunnel.com
all-turtles.com
penco.ie
denovofoodsgroup.com
beautychance.se
linnankellari.fi
tux-espacios.com
poultrypartners.nl
craigmccabe.fun
freie-baugutachterpraxis.de
fotoideaymedia.es
zewatchers.com
vibethink.net
zflas.com
caribdoctor.org
ulyssemarketing.com
caribbeansunpoker.com
polzine.net
corelifenutrition.com
revezlimage.com
pubweb.carnet.hr
systemate.dk
commonground-stories.com
markelbroch.com
trackyourconstruction.com
bbsmobler.se
rosavalamedahr.com
yassir.pro
boompinoy.com
wacochamber.com
bowengroup.com.au
pcprofessor.com
sevenadvertising.com
charlesreger.com
faizanullah.com
seproc.hn
xn--rumung-bua.online
coding-machine.com
firstpaymentservices.com
babcockchurch.org
eglectonk.online
lbcframingelectrical.com
atalent.fi
fiscalsort.com
christ-michael.net
live-con-arte.de
lykkeliv.net
hotelsolbh.com.br
mrsplans.net
symphonyenvironmental.com
insigniapmg.com
binder-buerotechnik.at
freie-gewerkschaften.de
bookspeopleplaces.com
smartypractice.com
lapinvihreat.fi
filmvideoweb.com
botanicinnovations.com
neuschelectrical.co.za
softsproductkey.com
destinationclients.fr
tomaso.gr
makeurvoiceheard.com
tsklogistik.eu
bockamp.com
digivod.de
stemenstilte.nl
smejump.co.th
skanah.com
philippedebroca.com
asgestion.com
nurturingwisdom.com
pridoxmaterieel.nl
daklesa.de
kikedeoliveira.com
ontrailsandboulevards.com
projetlyonturin.fr
yousay.site
tips.technology
vdberg-autoimport.nl
ra-staudte.de
hypozentrum.com
herbayupro.com
sweering.fr
jsfg.com
people-biz.com
buroludo.nl
blumenhof-wegleitner.at
mapawood.com
abogadoengijon.es
beyondmarcomdotcom.wordpress.com
hexcreatives.co
carolinepenn.com
bargningharnosand.se
myhealth.net.au
latestmodsapks.com
anteniti.com
kamienny-dywan24.pl
southeasternacademyofprosthodontics.org
meusharklinithome.wordpress.com
sanyue119.com
johnsonfamilyfarmblog.wordpress.com
body-armour.online
kariokids.com
parebrise-tla.fr
wychowanieprzedszkolne.pl
noixdecocom.fr
milsing.hr
offroadbeasts.com
nativeformulas.com
ai-spt.jp
igorbarbosa.com
ditog.fr
otsu-bon.com
transliminaltribe.wordpress.com
pay4essays.net
epwritescom.wordpress.com
monark.com
longislandelderlaw.com
kadesignandbuild.co.uk
tinyagency.com
globedivers.wordpress.com
filmstreamingvfcomplet.be
groupe-frayssinet.fr
nacktfalter.de
oldschoolfun.net
echtveilig.nl
oncarrot.com
triactis.com
vihannesporssi.fi
spacecitysisters.org
hihaho.com
birnam-wood.com
bricotienda.com
chatizel-paysage.fr
clos-galant.com
noskierrenteria.com
datacenters-in-europe.com
videomarketing.pro
modamilyon.com
apolomarcas.com
zimmerei-fl.de
perbudget.com
dubnew.com
precisionbevel.com
hkr-reise.de
kath-kirche-gera.de
blacksirius.de
ohidesign.com
dinslips.se
ecoledansemulhouse.fr
fitnessingbyjessica.com
amerikansktgodis.se
cyntox.com
oneplusresource.org
mmgdouai.fr
smhydro.com.pl
turkcaparbariatrics.com
ladelirante.fr
12starhd.online
profectis.de
ncid.bc.ca
jasonbaileystudio.com
hatech.io
miriamgrimm.de
alfa-stroy72.com
summitmarketingstrategies.com
sipstroysochi.ru
teresianmedia.org
licor43.de
hoteledenpadova.it
cirugiauretra.es
real-estate-experts.com
kaotikkustomz.com
quickyfunds.com
saka.gr
argos.wityu.fund
bauertree.com
i-trust.dk
praxis-management-plus.de
hokagestore.com
kevinjodea.com
webmaster-peloton.com
adultgamezone.com
kirkepartner.dk
plotlinecreative.com
dsl-ip.de
iyengaryogacharlotte.com
wolf-glas-und-kunst.de
autodemontagenijmegen.nl
americafirstcommittee.org
winrace.no
mooglee.com
ncuccr.org
phantastyk.com
joseconstela.com
ventti.com.ar
seevilla-dr-sturm.at
directwindowco.com
vannesteconstruct.be
foretprivee.ca
mrtour.site
jiloc.com
kindersitze-vergleich.de
bigler-hrconsulting.ch
argenblogs.com.ar
launchhubl.com
morawe-krueger.de
tandartspraktijkhartjegroningen.nl
web.ion.ag
podsosnami.ru
kojinsaisei.info
boosthybrid.com.au
fransespiegels.nl
villa-marrakesch.de
skiltogprint.no
supportsumba.nl
mir-na-iznanku.com
augenta.com
calabasasdigest.com
huesges-gruppe.de
alysonhoward.com
seitzdruck.com
dr-tremel-rednitzhembach.de
seagatesthreecharters.com
beaconhealthsystem.org
homecomingstudio.com
thailandholic.com
slimidealherbal.com
girlillamarketing.com
kunze-immobilien.de
journeybacktolife.com
milestoneshows.com
qualitus.com
biapi-coaching.fr
socialonemedia.com
pogypneu.sk
smale-opticiens.nl
blood-sports.net
spsshomeworkhelp.com
smart-light.co.uk
rozemondcoaching.nl
falcou.fr
iphoneszervizbudapest.hu
crowd-patch.co.uk
darrenkeslerministries.com
cactusthebrand.com
madinblack.com
merzi.info
tarotdeseidel.com
sabel-bf.com
ralister.co.uk
baustb.de
fundaciongregal.org
deoudedorpskernnoordwijk.nl
kuntokeskusrok.fi
paulisdogshop.de
ateliergamila.com
aselbermachen.com
thomas-hospital.de
365questions.org
aarvorg.com
simpliza.com
gastsicht.de
agence-chocolat-noir.com
naturalrapids.com
lorenacarnero.com
christinarebuffetcourses.com
mousepad-direkt.de
artotelamsterdam.com
oemands.dk
pomodori-pizzeria.de
walkingdeadnj.com
2ekeus.nl
arteservicefabbro.com
kaliber.co.jp
eaglemeetstiger.de
employeesurveys.com
tuuliautio.fi
cranleighscoutgroup.org
carriagehousesalonvt.com
scenepublique.net
baumkuchenexpo.jp
ftf.or.at
associationanalytics.com
vanswigchemdesign.com
worldhealthbasicinfo.com
pmc-services.de
westdeptfordbuyrite.com
jadwalbolanet.info
carlosja.com
slupetzky.at
friendsandbrgrs.com
withahmed.com
maureenbreezedancetheater.org
nakupunafoundation.org
allfortheloveofyou.com
cityorchardhtx.com
www1.proresult.no
shhealthlaw.com
naturstein-hotte.de
crosspointefellowship.church
ymca-cw.org.uk
dushka.ua
parkcf.nl
nuzech.com
hotelzentral.at
malychanieruchomoscipremium.com
bouquet-de-roses.com
slashdb.com
shonacox.com
first-2-aid-u.com
easytrans.com.au
gaiam.nl
newstap.com.ng
cwsitservices.co.uk
creamery201.com
ampisolabergeggi.it
herbstfeststaefa.ch
mikeramirezcpa.com
pelorus.group
groupe-cets.com
boisehosting.net
lloydconstruction.com
thedresserie.com
buymedical.biz
eco-southafrica.com
castillobalduz.es
zso-mannheim.de
bridgeloanslenders.com
nhadatcanho247.com
suncrestcabinets.ca
farhaani.com
jerling.de
atmos-show.com
diversiapsicologia.es
bristolaeroclub.co.uk
glennroberts.co.nz
id-et-d.fr
marietteaernoudts.nl
zweerscreatives.nl
balticdermatology.lt
controldekk.com
dr-pipi.de
chavesdoareeiro.com
pivoineetc.fr
finediningweek.pl
vox-surveys.com
lucidinvestbank.com
global-kids.info
joyeriaorindia.com
shiftinspiration.com
rieed.de
manifestinglab.com
jusibe.com
answerstest.ru
siliconbeach-realestate.com
renergysolution.com
huissier-creteil.com
deepsouthclothingcompany.com
charlottepoudroux-photographie.fr
montrium.com
greenpark.ch
nosuchthingasgovernment.com
izzi360.com
elpa.se
caffeinternet.it
evergreen-fishing.com
fatfreezingmachines.com
fitnessbazaar.com
homng.net
logopaedie-blomberg.de
boldcitydowntown.com
bimnapratica.com
streamerzradio1.site
erstatningsadvokaterne.dk
urclan.net
femxarxa.cat
bargningavesta.se
krlosdavid.com
advizewealth.com
idemblogs.com
deko4you.at
drinkseed.com
devlaur.com
brawnmediany.com
rushhourappliances.com
crediacces.com
kojima-shihou.com
bhwlawfirm.com
cafemattmeera.com
coffreo.biz
tennisclubetten.nl
austinlchurch.com
lichencafe.com
antonmack.de
lenreactiv-shop.ru
paymybill.guru
funjose.org.gt
resortmtn.com
huehnerauge-entfernen.de
ogdenvision.com
ncs-graphic-studio.com
blgr.be
tomoiyuma.com
pickanose.com
gmto.fr
servicegsm.net
mountsoul.de
iwelt.de
csgospeltips.se
bigbaguettes.eu
microcirc.net
schoellhammer.com
geekwork.pl
tanzschule-kieber.de
devok.info
ravensnesthomegoods.com
sexandfessenjoon.wordpress.com
schmalhorst.de
nvwoodwerks.com
sla-paris.com
strategicstatements.com
vyhino-zhulebino-24.ru
heurigen-bauer.at
stampagrafica.es
durganews.com
xn--fn-kka.no
atozdistribution.co.uk
kalkulator-oszczednosci.pl
aprepol.com
spargel-kochen.de
the-domain-trader.com
connectedace.com
xoabigail.com
tetinfo.in
ecopro-kanto.com
rota-installations.co.uk
mytechnoway.com
lillegrandpalais.com
bodyfulls.com
stemplusacademy.com
layrshift.eu
stormwall.se
iwr.nl
wien-mitte.co.at
wellplast.se
highimpactoutdoors.net
paradicepacks.com
harpershologram.wordpress.com
darnallwellbeing.org.uk
trulynolen.co.uk
stingraybeach.com
lapmangfpt.info.vn
edrcreditservices.nl
yourobgyn.net
mardenherefordshire-pc.gov.uk
fizzl.ru
imperfectstore.com
dutchbrewingcoffee.com
brevitempore.net
theletter.company
starsarecircular.org
stoeberstuuv.de
mercantedifiori.com
bodyforwife.com
quemargrasa.net
maineemploymentlawyerblog.com
knowledgemuseumbd.com
effortlesspromo.com
ouryoungminds.wordpress.com
hmsdanmark.dk
gantungankunciakrilikbandung.com
jakekozmor.com
actecfoundation.org
smogathon.com
fairfriends18.de
vancouver-print.ca
ussmontanacommittee.us
koken-voor-baby.nl
theclubms.com
muamuadolls.com
unim.su
greenko.pl
naswrrg.org
truenyc.co
abogadosaccidentetraficosevilla.es
wurmpower.at
dnepr-beskid.com.ua
danholzmann.com
aakritpatel.com
extensionmaison.info
jobmap.at
love30-chanko.com
intecwi.com
hairnetty.wordpress.com
personalenhancementcenter.com
syndikat-asphaltfieber.de
slimani.net
braffinjurylawfirm.com
mooshine.com
sanaia.com
edelman.jp
allamatberedare.se
broseller.com
tigsltd.com
pcp-nc.com
stopilhan.com
olejack.ru
samnewbyjax.com
transportesycementoshidalgo.es
higadograsoweb.com
gopackapp.com
kisplanning.com.au
vloeren-nu.nl
marathonerpaolo.com
centuryrs.com
tstaffing.nl
gymnasedumanagement.com
gasbarre.com
123vrachi.ru
figura.team
spectrmash.ru
nicoleaeschbachorg.wordpress.com
imadarchid.com
ecpmedia.vn
mrsfieldskc.com
finde-deine-marke.de
allentownpapershow.com
ilive.lt
em-gmbh.ch
bierensgebakkramen.nl
tandartspraktijkheesch.nl
shsthepapercut.com
sw1m.ru
xtptrack.com
rumahminangberdaya.com
loprus.pl
agence-referencement-naturel-geneve.net
anthonystreetrimming.com
cnoia.org
securityfmm.com
mbxvii.com
ausbeverage.com.au
urmasiimariiuniri.ro
educar.org
cite4me.org
coding-marking.com
mepavex.nl
importardechina.info
drnice.de
manijaipur.com
blogdecachorros.com
vermoote.de
serce.info.pl
psnacademy.in
klimt2012.info
amylendscrestview.com
spylista.com
porno-gringo.com
101gowrie.com
jvanvlietdichter.nl
ki-lowroermond.nl
labobit.it
nandistribution.nl
airconditioning-waalwijk.nl
alvinschwartz.wordpress.com
plv.media
itelagen.com
hellohope.com
ora-it.de
marcuswhitten.site
simpkinsedwards.co.uk
levdittliv.se
igfap.com
talentwunder.com
deschl.net
appsformacpc.com
spd-ehningen.de
saxtec.com
compliancesolutionsstrategies.com
the-virtualizer.com
faroairporttransfers.net
wmiadmin.com
stallbyggen.se
grupocarvalhoerodrigues.com.br
verifort-capital.de
apprendrelaudit.com
schutting-info.nl
sporthamper.com
urist-bogatyr.ru
operaslovakia.sk
zimmerei-deboer.de
happyeasterimages.org
selfoutlet.com
cuppacap.com
entopic.com
cerebralforce.net
blewback.com
admos-gleitlager.de
iviaggisonciliegie.it
xn--vrftet-pua.biz
instatron.net
eadsmurraypugh.com
schoolofpassivewealth.com
x-ray.ca
humancondition.com
myhostcloud.com
dontpassthepepper.com
dw-css.de
polymedia.dk
lachofikschiet.nl
chrissieperry.com
puertamatic.es
surespark.org.uk
ziegler-praezisionsteile.de
ceres.org.au
carrybrands.nl
denifl-consulting.at
homesdollar.com
thewellnessmimi.com
lange.host
balticdentists.com
ostheimer.at
henricekupper.com
notsilentmd.org
tonelektro.nl
karacaoglu.nl
bouncingbonanza.com
coursio.com
htchorst.nl
julis-lsa.de
qlog.de
modelmaking.nl
upmrkt.co
cheminpsy.fr
petnest.ir
musictreehouse.net
corona-handles.com
xlarge.at
geisterradler.de
body-guards.it
teczowadolina.bytom.pl
restaurantesszimmer.de
edv-live.de
juneauopioidworkgroup.org
anybookreader.de
mank.de
norovirus-ratgeber.de
manutouchmassage.com
fensterbau-ziegler.de
no-plans.com
aodaichandung.com
berlin-bamboo-bikes.org
leather-factory.co.jp
victoriousfestival.co.uk
associacioesportivapolitg.cat
ausair.com.au
forestlakeuca.org.au
slwgs.org
geoffreymeuli.com
zonamovie21.net
autodujos.lt
kissit.ca
autofolierung-lu.de
pinkexcel.com
ilso.net
naturavetal.hr
embracinghiscall.com
pv-design.de
praxis-foerderdiagnostik.de
sagadc.com
assurancesalextrespaille.fr
antiaginghealthbenefits.com
pier40forall.org
haremnick.com
cursoporcelanatoliquido.online
kosterra.com
8449nohate.org
rimborsobancario.net
myzk.site
promesapuertorico.com
sandd.nl
innote.fi
analiticapublica.es
sloverse.com
better.town
schraven.de
senson.fi
gonzalezfornes.es
danubecloud.com
kaminscy.com
tenacitytenfold.com
whyinterestingly.ru
mariposapropaneaz.com
gadgetedges.com
plantag.de
maratonaclubedeportugal.com
bigasgrup.com
hugoversichert.de
desert-trails.com
deltacleta.cat
vitalyscenter.es
oslomf.no
bptdmaluku.com
xn--logopdie-leverkusen-kwb.de
siluet-decor.ru
heliomotion.com
lmtprovisions.com
richard-felix.co.uk
webcodingstudio.com
expandet.dk
raschlosser.de
bingonearme.org
jyzdesign.com
foryourhealth.live
modestmanagement.com
vitavia.lt
radaradvies.nl
grelot-home.com
frontierweldingllc.com
sportverein-tambach.de
behavioralmedicinespecialists.com
centrospgolega.com
presseclub-magdeburg.de
testzandbakmetmening.online
bordercollie-nim.nl
cimanchesterescorts.co.uk
pixelarttees.com
koko-nora.dk
mountaintoptinyhomes.com
havecamerawilltravel2017.wordpress.com
architekturbuero-wagner.net
ianaswanson.com
planchaavapor.net
partnertaxi.sk
besttechie.com
abl1.net
marchand-sloboda.com
travelffeine.com
outcomeisincome.com
healthyyworkout.com
kao.at
milltimber.aberdeen.sch.uk
smessier.com
tampaallen.com
remcakram.com
plastidip.com.ar
tanzprojekt.com
interactcenter.org
harveybp.com
d1franchise.com
kampotpepper.gives
baylegacy.com
abogados-en-alicante.es
jbbjw.com
qualitaetstag.de
comparatif-lave-linge.fr
croftprecision.co.uk
odiclinic.org
vesinhnha.com.vn
theduke.de
maasreusel.nl
kamahouse.net
work2live.de
baptisttabernacle.com
lukeshepley.wordpress.com
bloggyboulga.net
katketytaanet.fi
thee.network
chaotrang.com
copystar.co.uk
abitur-undwieweiter.de
evangelische-pfarrgemeinde-tuniberg.de
conasmanagement.de
mastertechengineering.com
shadebarandgrillorlando.com
hrabritelefon.hr
gasolspecialisten.se
socstrp.org
allure-cosmetics.at
dutchcoder.nl
verbisonline.com
bxdf.info
zenderthelender.com
twohourswithlena.wordpress.com
klusbeter.nl
c-a.co.in
alsace-first.com
brigitte-erler.com
waynela.com
exenberger.at
psa-sec.de
limassoldriving.com
you-bysia.com.au
maxadams.london
lapinlviasennus.fi
roadwarrior.app
jobcenterkenya.com
team-montage.dk
dubscollective.com
saarland-thermen-resort.com
antenanavi.com
stacyloeb.com
bildungsunderlebnis.haus
ivivo.es
comarenterprises.com
wasmachtmeinfonds.at
pawsuppetlovers.com
courteney-cox.net
hebkft.hu
nancy-informatique.fr
4net.guru
consultaractadenacimiento.com
thenewrejuveme.com
celeclub.org
35-40konkatsu.net
jandaonline.com
heidelbergartstudio.gallery
leeuwardenstudentcity.nl
trystana.com
chefdays.de
smokeysstoves.com
sterlingessay.com
midmohandyman.com
haar-spange.com
1team.es
readberserk.com
backstreetpub.com
hardinggroup.com
solinegraphic.com
trapiantofue.it
lecantou-coworking.com
sahalstore.com
lightair.com
minipara.com
lescomtesdemean.be
lynsayshepherd.co.uk
corendonhotels.com
sotsioloogia.ee
jorgobe.at
pointos.com
financescorecard.com
fitovitaforum.com
dekkinngay.com
dr-seleznev.com
roygolden.com
aurum-juweliere.de
littlebird.salon
ungsvenskarna.se
blossombeyond50.com
levihotelspa.fi
devstyle.org
rebeccarisher.com
adoptioperheet.fi
werkkring.nl
pferdebiester.de
mylolis.com
woodworkersolution.com
lusak.at
iqbalscientific.com
norpol-yachting.com
triggi.de
vibehouse.rw
veybachcenter.de
daniel-akermann-architektur-und-planung.ch
bouldercafe-wuppertal.de
satyayoga.de
houseofplus.com
bogdanpeptine.ro
xn--thucmctc-13a1357egba.com
pt-arnold.de
prochain-voyage.net
irinaverwer.com
oceanastudios.com
xn--singlebrsen-vergleich-nec.com
sinal.org
dublikator.com
tastewilliamsburg.com
nachhilfe-unterricht.com
ftlc.es
fotoscondron.com
ihr-news.jp
insidegarage.pl
nsec.se
navyfederalautooverseas.com
mdacares.com
tulsawaterheaterinstallation.com
wraithco.com
justinvieira.com
4youbeautysalon.com
hashkasolutindo.com
garage-lecompte-rouen.fr
theadventureedge.com
kmbshipping.co.uk
takeflat.com
bradynursery.com
insp.bi
c2e-poitiers.com
gratispresent.se
greenfieldoptimaldentalcare.com
tanciu.com
rhinosfootballacademy.com
shiresresidential.com
kingfamily.construction
aco-media.nl
cleliaekiko.online
simplyblessedbykeepingitreal.com
DupontSellsHomes.com
onlybacklink.com
d2marketing.co.uk
purposeadvisorsolutions.com
stoeferlehalle.de
liliesandbeauties.org
mirkoreisser.de
micahkoleoso.de
dirittosanitario.biz
parks-nuernberg.de
aunexis.ch
simulatebrain.com
digi-talents.com
chandlerpd.com
bee4win.com
rostoncastings.co.uk
miraclediet.fun
narcert.com
ino-professional.ru
solhaug.tk
notmissingout.com
steampluscarpetandfloors.com
mezhdu-delom.ru
hairstylesnow.site
berliner-versicherungsvergleich.de
cuspdental.com
ilcdover.com
drfoyle.com
woodleyacademy.org
opatrovanie-ako.sk
accountancywijchen.nl
macabaneaupaysflechois.com
acomprarseguidores.com
executiveairllc.com
classycurtainsltd.co.uk
helikoptervluchtnewyork.nl
whittier5k.com
hvccfloorcare.com
visiativ-industry.fr
kenhnoithatgo.com
aglend.com.au
n1-headache.com
mrxermon.de
evologic-technologies.com
punchbaby.com
ruralarcoiris.com
cortec-neuro.com
yamalevents.com
delawarecorporatelaw.com
wsoil.com.sg
fayrecreations.com
newyou.at
nataschawessels.com
mediaplayertest.net
international-sound-awards.com
drugdevice.org
luxurytv.jp
teknoz.net
jameskibbie.com
run4study.com
craftleathermnl.com
y-archive.com
spinheal.ru
campusoutreach.org
kidbucketlist.com.au
marketingsulweb.com
gemeentehetkompas.nl
artallnightdc.com
themadbotter.com
jeanlouissibomana.com
torgbodenbollnas.se
krcove-zily.eu
rafaut.com
unetica.fr
celularity.com
ivfminiua.com
colorofhorses.com
waywithwords.net
thomasvicino.com
pierrehale.com
tinkoff-mobayl.ru
igrealestate.com
micro-automation.de
imaginado.de
hannah-fink.de
leoben.at
todocaracoles.com
jacquin-maquettes.com
myteamgenius.com
dpo-as-a-service.com
officehymy.com
baronloan.org
pocket-opera.de
facettenreich27.de
pasvenska.se
highlinesouthasc.com
platformier.com
simoneblum.de
fibrofolliculoma.info
zervicethai.co.th
bundabergeyeclinic.com.au
katiekerr.co.uk
conexa4papers.trade
faronics.com
makeflowers.ru
basisschooldezonnewijzer.nl
nmiec.com
galserwis.pl
xn--fnsterputssollentuna-39b.se
dramagickcom.wordpress.com
new.devon.gov.uk
burkert-ideenreich.de
eraorastudio.com
oneheartwarriors.at
space.ua
sojamindbody.com
promalaga.es
liveottelut.com
commercialboatbuilding.com
otto-bollmann.de
latribuessentielle.com
sachnendoc.com
vetapharma.fr
toreria.es
verytycs.com
danskretursystem.dk
zzyjtsgls.com
delchacay.com.ar
biortaggivaldelsa.com
physiofischer.de
memaag.com
portoesdofarrobo.com
hhcourier.com
ikads.org
reddysbakery.com
mbfagency.com
tradiematepro.com.au
rerekatu.com
noesis.tech
sofavietxinh.com
parking.netgateway.eu
asteriag.com
leda-ukraine.com.ua
bastutunnan.se
danielblum.info
deprobatehelp.com
toponlinecasinosuk.co.uk
lionware.de
blog.solutionsarchitect.guru
campus2day.de
hiddencitysecrets.com.au
parkstreetauto.net
pasivect.co.uk
lubetkinmediacompanies.com
thefixhut.com
forskolorna.org
catholicmusicfest.com
hushavefritid.dk
waermetauscher-berechnen.de
aniblinova.wordpress.com
sairaku.net
waveneyrivercentre.co.uk
thaysa.com
crowcanyon.com
galleryartfair.com
bafuncs.org
refluxreducer.com
id-vet.com
mylovelybluesky.com
flexicloud.hk
mdk-mediadesign.de
upplandsspar.se
andersongilmour.co.uk
proudground.org
mediaclan.info
despedidascostablanca.es
abogadosadomicilio.es
osterberg.fi
romeguidedvisit.com
onlyresultsmarketing.com
handi-jack-llc.com
theshungiteexperience.com.au
peterstrobos.com
vickiegrayimages.com
stefanpasch.me
icpcnj.org
ligiercenter-sachsen.de
completeweddingkansas.com
sauschneider.info
strandcampingdoonbeg.com
art2gointerieurprojecten.nl
collaborativeclassroom.org
solerluethi-allart.ch
uranus.nl
nestor-swiss.ch
iyahayki.nl
seminoc.com
-
net
false
-
pid
$2a$10$IPiW2KVZ6.EncqncWsH0DOQxumQO.ZRLYn0MVYoeGgiVYLdGlGgMG
-
prc
onenote
infopath
ccSetMgr
oracle
Sage.NA.AT_AU.SysTray
msaccess
ShadowProtectSvc
kavfswp
agntsvc
dlomaintsvcu
kavfs
visio
ocautoupds
thebat
Microsoft.exchange.store.worker.exe
Smc
avgadmsv
excel
wordpad
powerpnt
klnagent
mspub
steam
mydesktopservice
sqbcoreservice
lmibackupvssservice
BackupAgent
winword
TSSchBkpService
AmitiAvSrv
dbsnmp
synctime
firefox
BackupExtender
ocomm
NSCTOP
thunderbird
outlook
mydesktopqos
encsvc
SPBBCSvc
BackupUpdater
DLOAdminSvcu
xfssvccon
LogmeInBackupService
ccSvcHst
tbirdconfig
dbeng50
sql
ocssd
CarboniteUI
Rtvscan
isqlplussvc
kavfsscs
BackupMaint
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} =========Attention!!!========= Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. ============================== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
6769
-
svc
Altaro.HyperV.WAN.RemoteService.exe
"Sophos Web Control Service"
AUService
TMBMServer
mysqld
"StorageCraft Shadow Copy Provider"
HuntressUpdater
VeeamMountSvc
"Sophos MCS Client"
MSSQL$SQLEXPRESSADV
"TeamViewer"
BackupExecAgentAccelerator
"Sophos Endpoint Defense Service"
AltiBack
MSSQL$QM
MSSQL$SQLEXPRESS
Altaro.SubAgent.N2.exe
MSSQLFDLauncher$SQLEXPRESS
ofcservice
"ds_notifier"
SQLTELEMETRY$SQLEXPRESS
sppsvc
VSS
MSSQLFDLauncher
KACHIPS906995744173948
MSSQLServerOLAPService
SQLWriter
"Sophos Clean Service"
McAfeeFramework
ntrtscan
SQLAgent$MSGPMR
MSSQLFDLauncher$TESTBACKUP02DEV
"ProtectedStorage"
masvc
"swi_filter"
MsDtsServer110
VeeamHvIntegrationSvc
Altaro.OffsiteServer.Service.exe
MSSQL$HPWJA
AzureADConnectAgentUpdater
SQLEXPRESSADV
Code42Service
psqlWGE
"ds_monitor"
"Sophos System Protection Service"
KaseyaAgent
ThreadLocker
Altaro.Agent.exe
ds_notifier
"swi_service"
"Sage 100cloud Advanced 2020 (9920)"
MBAMService
AzureADConnectHealthSyncInsights
MSSQLServerADHelper100
"StorageCraft Raw Agent"
"SntpService"
LTService
MsDtsServer130
ds_monitor
MSSQL$MSGPMR
"SAVService"
"ofcservice"
KaseyaAgentEndpoint
AzureADConnectHealthSyncMonitor
AltiCTProxy
ds_agent
msseces
"Sophos Device Control Service"
mfevtp
"Amsp"
MsDtsServer120
KAENDCHIPS906995744173948
Altaro.SubAgent.exe
"Sophos MCS Agent"
Altaro.OffsiteServer.UI.Service.exe
AltiPhoneServ
Altaro.UI.Service.exe
VeeamTransportSvc
"Sage.NA.AT_AU.Service"
VeeamNFSSvc
ReportServer
AltiFTPUploader
SBAMSvc
"ds_agent"
Telemetryserver
mfewc
klnagent
"Sophos File Scanner Service"
"SQLServer Analysis Services (MSSQLSERVER)"
"SQLServer Integration Services 12.0"
VipreAAPSvc
ALTIVRM
MSSQLTESTBACKUP02DEV
HuntressAgent
VeeamDeploymentService
MySQL
ViprePPLSvc
tmlisten
bedbg
TmCCSF
mfemms
"StorageCraft ImageReady"
"Sophos Safestore Service"
"SQLServer Reporting Services (MSSQLSERVER)"
SSISTELEMETRY130
macmnsvc
kavfsscs
SQLAgent$SQLEXPRESS
SSASTELEMETRY
Altaro.DedupService.exe
sophossps
"Sophos Health Service"
AzureADConnectAuthenticationAgent
Amsp
VeeamEndpointBackupSvc
LTSvcMon
MSSQLLaunchpad$SQLEXPRESS
SQLBrowser
svcGenericHost
"Sophos AutoUpdate Service"
"SophosFIM"
"Sage 100c Advanced 2017 (9917)"
SQLTELEMETRY
SQLTELEMETRY$MSGPMR
ProtectedStorage
Microsoft.exchange.store.worker.exe
KAVFS
"SAVAdminService"
SQLSERVERAGENT
VeeamDeploySvc
"ThreadLocker"
sqlservr
MSSQLSERVER
ADSync
TeamViewer
DsSvc
Extracted
C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\05281emiw-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/924D574DFF887519
http://decoder.re/924D574DFF887519
Extracted
C:\Users\Admin\pz370-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/6495FD5092B44CCC
http://decoder.re/6495FD5092B44CCC
Targets
-
-
Target
JaffaCakes118_3f50b89979ffff65668924c1b935cf655b8efc46d4c121ae8627a0474f1d9e0a
-
Size
599KB
-
MD5
fd6d16ef09a96897604557faf17ac1f9
-
SHA1
8b702da8f8426af9f501ba546f273c2d5f79f75d
-
SHA256
3f50b89979ffff65668924c1b935cf655b8efc46d4c121ae8627a0474f1d9e0a
-
SHA512
d68c63366abcf5b19417d165e4b483cd660235e8ce1b4abaf943e1f2985d8c58f71a03da90c55dc73e4c95945baed3d78d23bda00122ee5bf230e43ef751f34e
-
SSDEEP
6144:brcj5kylPt7lBGughNrYjgKQsLbxUvTzbJ63hDQXQP2FD8nDDX1:bIRt/y+ebPJG0Xq24nn1
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Sodinokibi family
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-