General
-
Target
JaffaCakes118_c1bd164d64f45a036ef5fa99bef568119d5b4e90bfe9dcc8b89a4019cce61da8
-
Size
2.0MB
-
Sample
241227-b626lsylhs
-
MD5
9628bd785e93046d488fac58f8eff877
-
SHA1
906f09b48ef0190db2af394c712d8e4fbe6e6ea0
-
SHA256
c1bd164d64f45a036ef5fa99bef568119d5b4e90bfe9dcc8b89a4019cce61da8
-
SHA512
56867952350c277aecbd0c4a9d47700d082a8fd4cbad7e260c0bb4cf49a98d36720e16bcd6098043254c48f060e1a37ba594770b1a7a1246d5047b007414c5cf
-
SSDEEP
49152:2IUWUa9oVgzjFNZ0Weda9oVgzjF5LkzjFF:OWleL
Behavioral task
behavioral1
Sample
JaffaCakes118_c1bd164d64f45a036ef5fa99bef568119d5b4e90bfe9dcc8b89a4019cce61da8.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_c1bd164d64f45a036ef5fa99bef568119d5b4e90bfe9dcc8b89a4019cce61da8.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
sodinokibi
19
29
schluesseldienste-hannover.de
alpesiberie.com
bratek-immobilien.de
bcmets.info
log-barn.co.uk
diverfiestas.com.es
nexstagefinancial.com
mundo-pieces-auto.fr
marmarabasin.com
walterman.es
juergenblaetz.de
centuryvisionglobal.com
witraz.pl
aslog.fr
qandmmusiccenter.com
awag-blog.de
domilivefurniture.com
penumbuhrambutkeiskei.com
from02pro.com
teamsegeln.ch
scholarquotes.com
mind2muscle.nl
karmeliterviertel.com
rs-danmark.dk
amco.net.au
oro.ae
jayfurnitureco.com
bellesiniacademy.org
georgemuncey.com
catering.com
limounie.com
cssp-mediation.org
eyedoctordallas.com
craftingalegacy.com
innervisions-id.com
brunoimmobilier.com
richardiv.com
randyabrown.com
buffdaddyblog.com
kombi-dress.com
chorusconsulting.net
silverbird.dk
oraweb.net
burg-zelem.de
rhino-turf.com
paardcentraal.nl
kellengatton.com
larchwoodmarketing.com
terraflair.de
redpebblephotography.com
alabamaroofingllc.com
ludoil.it
outstandingminialbums.com
efficiencyconsulting.es
9nar.com
jlwilsonbooks.com
tellthebell.website
carolynfriedlander.com
aheadloftladders.co.uk
eafx.pro
otpusk.zp.ua
jdscenter.com
mariajosediazdemera.com
so-sage.fr
quitescorting.com
ayudaespiritualtamara.com
mikegoodfellow.co.uk
peninggibadan.co.id
ivancacu.com
lyricalduniya.com
zumrutkuyutemel.com
dibli.store
ziliak.com
circlecitydj.com
forumsittard.nl
collegetennis.info
g2mediainc.com
ufovidmag.com
luvinsburger.fr
jimprattmediations.com
skoczynski.eu
projektparkiet.pl
miscbo.it
switch-made.com
laaisterplakky.nl
grafikstudio-visuell.de
bodymindchallenger.com
carsten.sparen-it.de
boomerslivinglively.com
motocrosshideout.com
cesep2019.com
hartofurniture.com
interlinkone.com
buerocenter-butzbach-werbemittel.de
nuohous.com
lovcase.com
ijsselbeton.nl
glende-pflanzenparadies.de
rsidesigns.com
mustangmarketinggroup.com
eurethicsport.eu
ledyoucan.com
breathebettertolivebetter.com
pinkxgayvideoawards.com
molinum.pt
dmlcpa.com
animation-pro.co.uk
photographycreativity.co.uk
skidpiping.de
artvark.nl
anleggsregisteret.no
advanced-removals.co.uk
cuadc.org
worldproskitour.com
innovationgames-brabant.nl
mrkluttz.com
encounter-p.net
texanscan.org
topvijesti.net
vdolg24.online
yournextshoes.com
renderbox.ch
hawthornsretirement.co.uk
secrets-clubs.co.uk
ncjc.ca
nykfdyrehospital.dk
liverpoolabudhabi.ae
katherinealy.com
slideevents.be
kosten-vochtbestrijding.be
linearete.com
xn--ziinoapte-6ld.ro
itheroes.dk
selected-minds.de
agenceassemble.fr
explora.nl
funworx.de
loparnille.se
greenrider.nl
a-zpaperwork.eu
agriturismocastagneto.it
whoopingcrane.com
o90.dk
theboardroomafrica.com
lexced.com
ddmgen.com
techybash.com
glennverschueren.be
subquercy.fr
tastevirginia.com
goodherbalhealth.com
jaaphoekzema.nl
fridakids.com
tilldeeke.de
karelinjames.com
dogsunlimitedguide.com
cincinnatiphotocompany.org
trivselsguide.dk
zwemofficial.nl
wirmuessenreden.com
comoserescritor.com
unboxtherapy.site
towelroot.co
stanleyqualitysystems.com
1deals.com
bluetenreich-brilon.de
albcleaner.fr
valiant-voice.com
fsbforsale.com
schulz-moelln.de
lagschools.ng
c-sprop.com
hypogenforensic.com
jalkapuu.net
awaisghauri.com
janasfokus.com
rarefoods.ro
ruggestar.ch
leatherjees.com
loysonbryan.com
thehovecounsellingpractice.co.uk
pazarspor.org.tr
o2o-academy.com
hensleymarketing.com
neonodi.be
mjk.digital
3daywebs.com
reygroup.pt
alaskaremote.com
lovetzuchia.com
nutriwell.com.sg
nvisionsigns.com
four-ways.com
anchelor.com
catalyseurdetransformation.com
spirello.nl
rattanwarehouse.co.uk
endstarvation.com
lapponiasafaris.com
mbuildinghomes.com
ox-home.com
rivermusic.nl
chinowarehousespace.com
fazagostar.co
wallflowersandrakes.com
patassociation.com
cmeow.com
happylublog.wordpress.com
palmenhaus-erfurt.de
arabianmice.com
jax-interim-and-projectmanagement.com
atelierkomon.com
thestudio.academy
onesynergyinternational.com
furland.ru
shrinkingplanet.com
cyberpromote.de
nalliasmali.net
moira-cristescu.com
pourlabretagne.bzh
iron-mine.ru
limmortelyouth.com
legundschiess.de
11.in.ua
lassocrm.com
tbalp.co.uk
crestgood.com
customroasts.com
nxtstg.org
mangimirossana.it
ciga-france.fr
metroton.ru
alnectus.com
speakaudible.com
solutionshosting.co.uk
agendatwentytwenty.com
bajova.sk
wademurray.com
sambaglow.com
heimdalbygg.no
leloupblanc.gr
affligemsehondenschool.be
blucamp.com
medicalsupportco.com
molade.nl
lmmont.sk
fluzfluzrewards.com
b3b.ch
direitapernambuco.com
grupoexin10.com
suitesartemis.gr
louiedager.com
nourella.com
tramadolhealth.com
ronielyn.com
frimec-international.es
billyoart.com
nicksrock.com
altocontatto.net
line-x.co.uk
donau-guides.eu
mollymccarthydesign.com
raeoflightmusic.com
ilveshistoria.com
brannbornfastigheter.se
licensed-public-adjuster.com
neolaiamedispa.com
smarttourism.academy
kdbrh.com
trainiumacademy.com
thisprettyhair.com
nepal-pictures.com
colored-shelves.com
graygreenbiomedservices.com
xtensifi.com
citiscapes-art.com
devus.de
bubbalucious.com
mariannelemenestrel.com
hom-frisor.dk
hepishopping.com
benchbiz.com
pankiss.ru
hostastay.com
belofloripa.be
janellrardon.com
keuken-prijs.nl
davedavisphotos.com
scietech.academy
5pointpt.com
hotelturbo.de
fotoeditores.com
business-basic.de
kartuindonesia.com
smartspeak.com
jobstomoveamerica.org
goeppinger-teppichreinigung.de
grancanariaregional.com
thepixelfairy.com
tecleados.com
nieuwsindeklas.be
liveyourheartout.co
sveneulberg.de
ncn.nl
cookinn.nl
cxcompany.com
concontactodirecto.com
descargandoprogramas.com
mahikuchen.com
teethinadaydentalimplants.com
markseymourphotography.co.uk
acumenconsultingcompany.com
andreaskildegaard.dk
letsstopsmoking.co.uk
thegetawaycollective.com
angeleyezstripclub.com
maxcube24.com.ua
axisoflove.org:443
spacebel.be
druktemakersheerenveen.nl
fla.se
lidkopingsnytt.nu
bcabattoirs.org
riffenmattgarage.ch
wrinstitute.org
der-stempelking.de
campusescalade.com
frankgoll.com
fann.ru
dierenambulancealkmaar.nl
aoyama.ac
metcalfe.ca
lumturo.academy
santastoy.store
bmw-i-pure-impulse.com
jmmartinezilustrador.com
bluelakevision.com
stressreliefadvice.com
k-v-f.de
mariamalmahdi.com
husetsanitas.dk
rino-gmbh.com
annenymus.com
volta.plus
mindsparkescape.com
newonestop.com
pureelements.nl
lsngroupe.com
latableacrepes-meaux.fr
iexpert99.com
pansionatblago.ru
the3-week-diet.net
lifeinbreaths.com
prometeyagro.com.ua
kroophold-sjaelland.dk
sytzedevries.com
jakubrybak.com
gbk-tp1.de
sealgrinderpt.com
johnkoen.com
glas-kuck.de
bonitabeachassociation.com
wyreforest.net
theatre-embellie.fr
indiebizadvocates.org
site.markkit.com.br
jollity.hu
kvetymichalovce.sk
ingresosextras.online
denhaagfoodie.nl
universelle.fr
placermonticello.com
nevadaruralhousingstudies.org
mike.matthies.de
renehartman.nl
livelai.com
banukumbak.com
agrifarm.dk
premiumweb.com.ua:443
fysiotherapierijnmond.nl
baumfinancialservices.com
operativadigital.com
parksideseniorliving.net
humanviruses.org
rapid5kloan.org
motocrossplace.co.uk
trevi-vl.ru
teutoradio.de
handyman-silkeborg.dk
hameghlim.com
studionumerik.fr
bakingismyyoga.com
malzomattalar.com
mac-computer-support-hamburg.de
almamidwifery.com
perceptdecor.com
aidanpublishing.co.uk
skolaprome.eu
jameswilliamspainting.com
girlish.ae
xrresources.com
triavlete.com
stathmoulis.gr
weddingceremonieswithtim.com
ntinasfiloxenia.gr
optigas.com
allinonecampaign.com
stralsund-ansichten.de
memphishealthandwellness.com
angelsmirrorus.com
qrs-international.com
die-immo-agentur.de
charlottelhanna.com
modamarfil.com
alexwenzel.de
andermattswisswatches.ch
alattekniksipil.com
kookooo.com
nrgvalue.com
paprikapod.com
simpleitsolutions.ch
thegrinningmanmusical.com
inewsstar.com
avisioninthedesert.com
sochi-okna23.ru
onlinetvgroup.com
rossomattonecase.it
kickittickets.com
eos-horlogerie.com
alltagsrassismus-entknoten.de
brownswoodblog.com
heuvelland-oaze.nl
drbrianhweeks.com
mediabolmong.com
michaelfiegel.com
yuanshenghotel.com
polynine.com
bulyginnikitav.000webhostapp.com
acb-gruppe.ch
mercadodelrio.com
finnergo.eu
sber-biznes.com
dr-vita.de
racefietsenblog.nl
aceroprime.com
verbouwingsdouche.nl
ultimatelifesource.com
diakonie-weitramsdorf-sesslach.de
ramirezprono.com
artcase.pl
bendel-partner.de
enews-qca.com
pokemonturkiye.com
alcye.com
tzn.nu
christopherhannan.com
broccolisoep.nl
factoriareloj.com
production-stills.co.uk
deziplan.ru
eastgrinsteadwingchun.com
aciscomputers.com
luvbec.com
bescomedical.de
claudiakilian.de
ocduiblog.com
tweedekansenloket.nl
awaitspain.com
pinthelook.com
laylavalentine.com
alharsunindo.com
linkbuilding.life
cl0nazepamblog.com
sellthewrightway.com
tutvracks.com
imajyuku-sozoku.com
justaroundthecornerpetsit.com
craftron.com
tieronechic.com
fbmagazine.ru
spectamarketingdigital.com.br
queertube.net
solidhosting.nl
rvside.com
gatlinburgcottage.com
latteswithleslie.com
askstaffing.com
scotlandsroute66.co.uk
rentingwell.com
singletonfinancial.com
afbudsrejserallinclusive.dk
airserviceunlimited.com
topautoinsurers.net
primemarineengineering.com
kompresory-opravy.com
augen-praxisklinik-rostock.de
victorvictoria.com
taulunkartano.fi
birthplacemag.com
aquacheck.co.za
suonenjoen.fi
kryddersnapsen.dk
corporacionrr.com
m2graph.fr
globalskills.pt
nginx.com
physio-lang.de
olry-cloisons.fr
reputation-medical.online
apiarista.de
deduktia.fi
turing.academy
mensemetgesigte.co.za
rechtenplicht.be
opticahubertruiz.com
morgansconsult.com
ced-elec.com
kuriero.pro
bookingwheel.com
bagaholics.in
biblica.com
signamedia.de
denverwynkoopdentist.com
schroederschoembs.com
p-ride.live
signededenroth.dk
clemenfoto.dk
avis.mantova.it
hostaletdelsindians.es
altitudeboise.com
global-migrate.com
makingmillionaires.net
brighthillgroup.com
sweetz.fr
ketomealprep.academy
mazift.dk
schlagbohrmaschinetests.com
barbaramcfadyenjewelry.com
cardsandloyalty.com
kryptos72.com
yourcosmicbeing.com
mediahub.co.nz
tradenavigator.ch
napisat-pismo-gubernatoru.ru:443
jefersonalessandro.com
cormanmarketing.com
theater-lueneburg.de
plbinsurance.com
hm-com.com
fidelitytitleoregon.com
martha-frets-ceramics.nl
webforsites.com
lisa-poncon.fr
smartercashsystem.com
dantreranch.com
edvestors.org
goddardleadership.org
tanatek.com
parseport.com
cymru.futbol
angelika-schwarz.com
initconf.com
michal-s.co.il
hutchstyle.co.uk
metriplica.academy
pxsrl.it
sshomme.com
margaretmcshane.com
wineandgo.hu
xn--billigafrgpatroner-stb.se
redctei.co
oncarrot.com
yourhappyevents.fr
kenmccallum.com
opt4cdi.com
yvesdoin-aquarelles.fr
chomiksy.net
monstarrsoccer.com
frameshift.it
citydogslife.com
mesajjongeren.nl
eventosvirtualesexitosos.com
chatberlin.de
invela.dk
sppdstats.com
111firstdelray.com
designimage.ae
90nguyentuan.com
poems-for-the-soul.ch
kerstliedjeszingen.nl
nepressurecleaning.com
hotjapaneselesbian.com
internalresults.com
pharmeko-group.com
livedeveloper.com
cap29010.it
condormobile.fr
distrifresh.com
adaduga.info
elex.is
vvego.com
qwikcoach.com
fitnessblenderstory.com
directique.com
soncini.ch
subyard.com
xn--80abehgab4ak0ddz.xn--p1ai
acibademmobil.com.tr
kelsigordon.com
kafkacare.com
innersurrection.com
ygallerysalonsoho.com:443
stitch-n-bitch.com
hospitalitytrainingsolutions.co.uk
triplettagaite.fr
thesilkroadny.com
cc-experts.de
johnstonmingmanning.com
sarahspics.co.uk
blueridgeheritage.com
blavait.fr
foerderverein-vatterschule.de
saint-malo-developpement.fr
gratiocafeblog.wordpress.com
look.academy
autoteamlast.de
beandrivingschool.com.au
clinic-beethovenstrasse-ag.ch
lookandseen.com
animalfood-online.de
dennisverschuur.com
devplus.be
tetameble.pl
apogeeconseils.fr
levelseven.be
xn--80addfr4ahr.dp.ua
startuplive.org
jonnyhooley.com
gsconcretecoatings.com
narca.net
yayasanprimaunggul.org
mieleshopping.it
mayprogulka.ru
satoblog.org
kiraribeaute-nani.com
gaearoyals.com
tages-geldvergleich.de
profibersan.com
sololibrerie.it
tothebackofthemoon.com
eksperdanismanlik.com
logosindustries.com
matthieupetel.fr
happycatering.de
agora-collectivites.com
csaballoons.com
vedsegaard.dk
tchernia-conseil.fr
istantidigitali.com
kamin-somnium.de
sunsolutions.es
soundseeing.net
atrgroup.it
ninjaki.com
gosouldeep.com
2020hindsight.info
triplettabordeaux.fr
elitkeramika-shop.com.ua
web865.com
jlgraphisme.fr
levencovka.ru
slotspinner.com
gardenpartner.pl
vitormmcosta.com
astrographic.com
dentourage.com
bumbipdeco.site
fixx-repair.com
salonlamar.nl
scentedlair.com
epicjapanart.com
midwestschool.org
hiddensee-buhne11.de
rishigangoly.com
envomask.com
jobscore.com
lollachiro.com
bavovrienden.nl
phukienbepthanhdat.com
rhino-storage.co.uk
drbenveniste.com
magnetvisual.com
belinda.af
publicompserver.de
dieetuniversiteit.nl
datatri.be
springfieldplumbermo.com
voice2biz.com
greeneyetattoo.com
onlinemarketingsurgery.co.uk
auberives-sur-vareze.fr
purepreprod4.com
nauticmarine.dk
dinecorp.com
focuskontur.com
thiagoperez.com
dentalcircle.com
cotton-avenue.co.il
jeanmonti.com
lashandbrowenvy.com
mrcar.nl
galatee-couture.com
nbva.co.uk
insane.agency
promus.ca
alene.co
geoweb.software
computer-place.de
baptistdistinctives.org
housesofwa.com
wasnederland.nl
stoneridgemontessori.com
bundan.com
docarefoundation.org
thenalpa.com
premier-iowa.com
expohomes.com
rtc24.com
chatterchatterchatter.com
palmecophilippines.com
ilovefullcircle.com
bjornvanvulpen.nl
pedmanson.com
mazzaropi.com.br
vitoriaecoturismo.com.br
gavelmasters.com
etgdogz.de
lgiwines.com
sycamoregreenapts.com
acornishstudio.co.uk
gazelle-du-web.com
berdonllp.com
delegationhub.com
watchsale.biz
liepertgrafikweb.at
banksrl.co.za
skyscanner.ro
maryairbnb.wordpress.com
futurenetworking.com
apmollerpension.com
hinotruckwreckers.com.au
silkeight.com
professionetata.com
malevannye.ru
kristianboennelykke.dk
ronaldhendriks.nl
ravage-webzine.nl
buonabitare.com
daveystownhouse.com
groovedealers.ru
easydental.ae
leijstrom.com
buzzneakers.com
successcolony.com.ng
osn.ro
the-cupboard.co.uk
julielusktherapy.com
sachainchiuk.com
imagine-entertainment.com
peppergreenfarmcatering.com.au
piestar.com
hostingbangladesh.net
ceocenters.com
strauchs-wanderlust.info
phoenixcrane.com
pajagus.fr
mneti.ru
klapanvent.ru
creohn.de
n-newmedia.de
lattalvor.com
landgoedspica.nl
aberdeenartwalk.org
cleanroomequipment.ie
naukaip.ru
min-virksomhed.dk
fire-space.com
vipcarrental.ae
paradigmlandscape.com
christianscholz.de
irizar.com
therapybusinessacademy.com
veggienessa.com
fskhjalmar.se
elliemaccreative.wordpress.com
mindfuelers.com
rokthetalk.com
leansupremegarcinia.net
kausette.com
bourchier.org
mrmac.com
hekecrm.com
shortysspices.com
marcandy.com
abulanov.com
brisbaneosteopathic.com.au
myplaywin3.com
bluemarinefoundation.com
sbit.ag
agencewho-aixenprovence.fr
magrinya.net
oportowebdesign.com
smartworkplaza.com
mondolandscapes.com
bd2fly.com
jacquesgarcianoto.com
tatyanakopieva.ru
noda.com.ua
traitware.com
toranjtuition.org
kemtron.fr
geitoniatonaggelon.gr
oscommunity.de
holocine.de
cainlaw-okc.com
jglconsultancy.com
pisofare.co
circuit-diagramz.com
zdrowieszczecin.pl
radishallgood.com
voetbalhoogeveen.nl
rizplakatjaya.com
basindentistry.com
bringmehope.org
bridalcave.com
evsynthacademy.org
sprintcoach.com
ikadomus.com
mslp.org
khtrx.com
vapiano.fr
theintellect.edu.pk
jandhpest.com
shortsalemap.com
campusce.com
chainofhopeeurope.eu
alisodentalcare.com
sharonalbrightdds.com
craftstone.co.nz
wribrazil.com
stage-infirmier.fr
floweringsun.org
skooppi.fi
tesisatonarim.com
mgimalta.com
imaginekithomes.co.nz
forskolinslimeffect.net
azerbaycanas.com
profiz.com
azloans.com
rubyaudiology.com
carmel-york.com
janmorgenstern.com
aktivfriskcenter.se
catchup-mag.com
ideamode.com
wg-heiligenstadt.de
rentsportsequip.com
boloria.de
transifer.fr
5thactors.com
internestdigital.com
alwaysdc.com
welovecustomers.fr
hvitfeldt.dk
epsondriversforwindows.com
littlesaints.academy
netadultere.fr
cmascd.com
amorbellezaysalud.com
mursall.de
avtoboss163.ru:443
auto-opel.ro
goodboyscustom.com
campinglaforetdetesse.com
achetrabalhos.com
chris-anne.com
t3brothers.com
hnkns.com
harleystreetspineclinic.com
cac2040.com
arazi.eus
koncept-m.ru
advancedeyecare.com
parentsandkids.com
relevantonline.eu
myfbateam.com
k-zubki.ru
activeterroristwarningcompany.com
biketruck.de
ownidentity.com
adedesign.com
bertbutter.nl
finsahome.co.uk
endlessrealms.net
charlesfrancis.photos
gurutechnologies.net
mediogiro.com.ar
fta-media.com
fotoslubna.com
entdoctor-durban.com
orchardbrickwork.com
perfectgrin.com
spartamovers.com
krishnabrawijaya.com
uncensoredhentaigif.com
curtsdiscountguns.com
bodet150ans.com
andrealuchesi.it
testitjavertailut.net
dnqa.co.uk
pilotgreen.com
bruut.online
saboboxtel.uk
bohrlochversicherung.info
stringnosis.academy
richardmaybury.co.uk
speiserei-hannover.de
flossmoordental.com
fascaonline.com
jobkiwi.com.ng
leopoldineroux.com
adabible.org
hawaiisteelbuilding.com
nationnewsroom.com
dcc-eu.com
cp-bap.de
atma.nl
manzel.tn
oththukaruva.com
dentallabor-luenen.de
putzen-reinigen.com
test-teleachat.fr
ya-elka.ru
akwaba-safaris.com
parisschool.ru
energosbit-rp.ru
amelielecompte.wordpress.com
masecologicos.com
hoteltantra.com
eatyoveges.com
pvandambv.nl
arearugcleaningnyc.com
golfclublandgoednieuwkerk.nl
wordpress.idium.no
supercarhire.co.uk
stabilisateur.fr
sjtpo.org
drnelsonpediatrics.com
mamajenedesigns.com
fanuli.com.au
forextimes.ru
electricianul.com
patriotcleaning.net
prodentalblue.com
omegamarbella.com
leadforensics.com
proffteplo.com
richardkershawwines.co.za
annida.it
werkzeugtrolley.net
eshop.design
gta-jjb.fr
greatofficespaces.net
skinkeeper.li
rename.kz
martinipstudios.com
cascinarosa33.it
precisetemp.com
smartmind.net
muller.nl
casinodepositors.com
dayenne-styling.nl
adterium.com
natturestaurante.com.br
akcadagofis.com
framemyballs.com
arthakapitalforvaltning.dk
utilisacteur.fr
enactusnhlstenden.com
zaczytana.com
lesyeuxbleus.net
pro-gamer.pl
coachpreneuracademy.com
amyandzac.com
domaine-des-pothiers.com
edrickennedymacfoy.com
billigeflybilletter.dk
baita.ac
bychowo.pl
globalcompliancenews.com
jag.me
asiaartgallery.jp
unexplored.gr
rolleepollee.com
advesa.com
zuerich-umzug.ch
rozmata.com
babysitting-hk.helpergo.co
fi-institutionalfunds.com
digitale-elite.de
muni.pe
uci-france.fr
billscars.net
bayshoreelite.com
factorywizuk.com
reizenmetkinderen.be
zinnystar.com
betterce.com
guohedd.com
saberconcrete.com
matteoruzzaofficial.com
haard-totaal.nl
skyboundnutrition.co.uk
slotenmakerszwijndrecht.nl
go.labibini.ch
unislaw-narty.pl
the-beauty-guides.com
haus-landliebe.de
powershell.su
pixelhealth.net
keyboardjournal.com
pays-saint-flour.fr
specialtyhomeservicesllc.com
advance-refle.com
letterscan.de
dinedrinkdetroit.com
dreamvoiceclub.org
zealcon.ae
egpu.fr
bg.szczecin.pl
oexebusiness.com
ykobbqchicken.ca
espaciopolitica.com
photonag.com
boyfriendsgoal.site
beauty-traveller.com
cops4causes.org
ahgarage.com
the5thquestion.com
breakluckrecords.com
stagefxinc.com
johnsonweekly.com
pubcon.com
lunoluno.com
ikzoekgod.be
omnicademy.com
drvoip.com
metallbau-hartmann.eu
block-optic.com
bilius.dk
palema.gr
antesacademy.it
duthler.nl
protoplay.ca
galaniuklaw.com
zorgboerderijravensbosch.nl
iactechnologies.net
ebible.co
brinkdoepke.eu
airvapourbarrier.com
baikalflot.ru
biodentify.ai
-
net
true
-
pid
19
-
prc
mysql.exe
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
29
Extracted
C:\Users\Default\u4x57r1-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/343D1088F14E270F
http://decryptor.top/343D1088F14E270F
Extracted
C:\Users\Default\2013g94-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/6C7EFFF2385B9BF4
http://decryptor.top/6C7EFFF2385B9BF4
Targets
-
-
Target
JaffaCakes118_c1bd164d64f45a036ef5fa99bef568119d5b4e90bfe9dcc8b89a4019cce61da8
-
Size
2.0MB
-
MD5
9628bd785e93046d488fac58f8eff877
-
SHA1
906f09b48ef0190db2af394c712d8e4fbe6e6ea0
-
SHA256
c1bd164d64f45a036ef5fa99bef568119d5b4e90bfe9dcc8b89a4019cce61da8
-
SHA512
56867952350c277aecbd0c4a9d47700d082a8fd4cbad7e260c0bb4cf49a98d36720e16bcd6098043254c48f060e1a37ba594770b1a7a1246d5047b007414c5cf
-
SSDEEP
49152:2IUWUa9oVgzjFNZ0Weda9oVgzjF5LkzjFF:OWleL
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Sodinokibi family
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (204) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1