General
-
Target
JaffaCakes118_a305812df6a47d17d49fc193c72d6a3cf40ffa895524f93f2e9ab89a698d5772
-
Size
150KB
-
Sample
241228-228eyavjez
-
MD5
439a68e32bbc6f90aab17a9b9b235b14
-
SHA1
942b9ef1370d05a2e07de3a1df351979d98fbf74
-
SHA256
a305812df6a47d17d49fc193c72d6a3cf40ffa895524f93f2e9ab89a698d5772
-
SHA512
1a331ee27bc70aa80bd9c31555976d29efdc29144ce4b1e86c0448b42b656a97d072c95372e8030954dbf121c84b0f790ee9d64fa37c556f82dab91540cd5e8a
-
SSDEEP
3072:oFcF4QNzX7aWGHtA4UDVoTfwK2O1gTUsy4lbu5hsuAh:oFc97aW/NDVoT+pTUsFKRAh
Static task
static1
Behavioral task
behavioral1
Sample
run_revil.bat
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
run_revil.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
xx.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
xx.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
sodinokibi
$2a$10$nwwfZNzFITdTfTQYluhtfeuhXAkam0kR.vjHqfobssJwiPLmkLcMS
7296
musictreehouse.net
webcodingstudio.com
lebellevue.fr
nvwoodwerks.com
zervicethai.co.th
ino-professional.ru
helenekowalsky.com
lukeshepley.wordpress.com
jasonbaileystudio.com
simpkinsedwards.co.uk
whittier5k.com
huehnerauge-entfernen.de
bestbet.com
beautychance.se
maureenbreezedancetheater.org
ai-spt.jp
comparatif-lave-linge.fr
hhcourier.com
sahalstore.com
kalkulator-oszczednosci.pl
tulsawaterheaterinstallation.com
asteriag.com
embracinghiscall.com
romeguidedvisit.com
fibrofolliculoma.info
huesges-gruppe.de
haar-spange.com
fensterbau-ziegler.de
chavesdoareeiro.com
skiltogprint.no
sojamindbody.com
smokeysstoves.com
tuuliautio.fi
xtptrack.com
stoneys.ch
saarland-thermen-resort.com
rhinosfootballacademy.com
baylegacy.com
nmiec.com
whyinterestingly.ru
baustb.de
pawsuppetlovers.com
alvinschwartz.wordpress.com
rollingrockcolumbia.com
dr-pipi.de
daklesa.de
thaysa.com
turkcaparbariatrics.com
boompinoy.com
parkstreetauto.net
kao.at
manijaipur.com
centuryrs.com
groupe-frayssinet.fr
gonzalezfornes.es
blog.solutionsarchitect.guru
shadebarandgrillorlando.com
ausbeverage.com.au
cafemattmeera.com
aminaboutique247.com
mylolis.com
zonamovie21.net
bargningavesta.se
foryourhealth.live
greenfieldoptimaldentalcare.com
seevilla-dr-sturm.at
smartypractice.com
kenhnoithatgo.com
garage-lecompte-rouen.fr
nuzech.com
catholicmusicfest.com
mooglee.com
parkcf.nl
simpliza.com
darnallwellbeing.org.uk
highimpactoutdoors.net
tigsltd.com
deschl.net
pmc-services.de
bowengroup.com.au
quizzingbee.com
havecamerawilltravel2017.wordpress.com
tennisclubetten.nl
schoellhammer.com
theduke.de
systemate.dk
insigniapmg.com
campusoutreach.org
oldschoolfun.net
tampaallen.com
purposeadvisorsolutions.com
mountaintoptinyhomes.com
brigitte-erler.com
rehabilitationcentersinhouston.net
mardenherefordshire-pc.gov.uk
yousay.site
space.ua
nijaplay.com
boosthybrid.com.au
aakritpatel.com
hardinggroup.com
mirkoreisser.de
dw-css.de
dr-seleznev.com
amerikansktgodis.se
baronloan.org
portoesdofarrobo.com
kunze-immobilien.de
panelsandwichmadrid.es
innote.fi
katiekerr.co.uk
centromarysalud.com
lenreactiv-shop.ru
tanzprojekt.com
katketytaanet.fi
montrium.com
hvccfloorcare.com
toponlinecasinosuk.co.uk
spd-ehningen.de
kissit.ca
kaminscy.com
mapawood.com
slashdb.com
henricekupper.com
ruralarcoiris.com
ussmontanacommittee.us
mastertechengineering.com
paymybill.guru
poultrypartners.nl
judithjansen.com
boisehosting.net
ecoledansemulhouse.fr
walter-lemm.de
parking.netgateway.eu
bee4win.com
baptisttabernacle.com
chefdays.de
quickyfunds.com
mrsplans.net
directwindowco.com
milltimber.aberdeen.sch.uk
tsklogistik.eu
physiofischer.de
spargel-kochen.de
withahmed.com
wasmachtmeinfonds.at
run4study.com
theadventureedge.com
thailandholic.com
imperfectstore.com
latestmodsapks.com
alten-mebel63.ru
karacaoglu.nl
mirjamholleman.nl
liikelataamo.fi
smithmediastrategies.com
iwelt.de
americafirstcommittee.org
baumkuchenexpo.jp
delawarecorporatelaw.com
lubetkinmediacompanies.com
siliconbeach-realestate.com
humancondition.com
body-armour.online
cursosgratuitosnainternet.com
koken-voor-baby.nl
planchaavapor.net
bingonearme.org
epwritescom.wordpress.com
makeurvoiceheard.com
candyhouseusa.com
rieed.de
maineemploymentlawyerblog.com
vibehouse.rw
dnepr-beskid.com.ua
tanciu.com
polychromelabs.com
wsoil.com.sg
hmsdanmark.dk
123vrachi.ru
simplyblessedbykeepingitreal.com
gasbarre.com
onlyresultsmarketing.com
psnacademy.in
pay4essays.net
alhashem.net
abogadoengijon.es
christ-michael.net
noixdecocom.fr
smart-light.co.uk
imadarchid.com
fax-payday-loans.com
lorenacarnero.com
tradiematepro.com.au
narcert.com
smale-opticiens.nl
zieglerbrothers.de
verytycs.com
myhostcloud.com
oemands.dk
sevenadvertising.com
bookspeopleplaces.com
comarenterprises.com
stoeferlehalle.de
aselbermachen.com
durganews.com
cyntox.com
spsshomeworkhelp.com
pferdebiester.de
maasreusel.nl
osterberg.fi
cactusthebrand.com
rosavalamedahr.com
supportsumba.nl
architekturbuero-wagner.net
bsaship.com
micahkoleoso.de
augenta.com
talentwunder.com
xoabigail.com
oncarrot.com
abogadosadomicilio.es
dareckleyministries.com
strandcampingdoonbeg.com
sanaia.com
tenacitytenfold.com
schutting-info.nl
rafaut.com
kadesignandbuild.co.uk
clos-galant.com
modelmaking.nl
kostenlose-webcams.com
rushhourappliances.com
ncuccr.org
extraordinaryoutdoors.com
dezatec.es
ditog.fr
officehymy.com
ziegler-praezisionsteile.de
gratispresent.se
beaconhealthsystem.org
theapifactory.com
vitalyscenter.es
people-biz.com
otto-bollmann.de
lloydconstruction.com
charlottepoudroux-photographie.fr
pocket-opera.de
onlybacklink.com
delchacay.com.ar
navyfederalautooverseas.com
marcuswhitten.site
fitnessingbyjessica.com
cerebralforce.net
themadbotter.com
goodgirlrecovery.com
trackyourconstruction.com
seitzdruck.com
corelifenutrition.com
seagatesthreecharters.com
koko-nora.dk
leeuwardenstudentcity.nl
teknoz.net
deko4you.at
irishmachineryauctions.com
personalenhancementcenter.com
pmcimpact.com
naturavetal.hr
scenepublique.net
drugdevice.org
insidegarage.pl
spylista.com
aglend.com.au
izzi360.com
projetlyonturin.fr
bayoga.co.uk
c2e-poitiers.com
farhaani.com
ligiercenter-sachsen.de
admos-gleitlager.de
summitmarketingstrategies.com
eglectonk.online
sairaku.net
pubweb.carnet.hr
unetica.fr
slimidealherbal.com
jyzdesign.com
web.ion.ag
markelbroch.com
higadograsoweb.com
sportiomsportfondsen.nl
sipstroysochi.ru
bristolaeroclub.co.uk
ledmes.ru
xn--logopdie-leverkusen-kwb.de
berliner-versicherungsvergleich.de
desert-trails.com
psc.de
autofolierung-lu.de
hrabritelefon.hr
dontpassthepepper.com
zweerscreatives.nl
smhydro.com.pl
upmrkt.co
uimaan.fi
myhealth.net.au
www1.proresult.no
radaradvies.nl
thee.network
atalent.fi
ohidesign.com
mmgdouai.fr
glennroberts.co.nz
waveneyrivercentre.co.uk
tomaso.gr
schoolofpassivewealth.com
rimborsobancario.net
unim.su
triactis.com
grupocarvalhoerodrigues.com.br
despedidascostablanca.es
abitur-undwieweiter.de
milanonotai.it
shonacox.com
igorbarbosa.com
instatron.net
spectrmash.ru
jenniferandersonwriter.com
denifl-consulting.at
wellplast.se
blgr.be
bargningharnosand.se
mezhdu-delom.ru
waermetauscher-berechnen.de
mdacares.com
DupontSellsHomes.com
vyhino-zhulebino-24.ru
aco-media.nl
accountancywijchen.nl
caribdoctor.org
jbbjw.com
blossombeyond50.com
ampisolabergeggi.it
happyeasterimages.org
ilcdover.com
blewback.com
8449nohate.org
bierensgebakkramen.nl
kampotpepper.gives
ora-it.de
oslomf.no
victoriousfestival.co.uk
mediaclan.info
elimchan.com
completeweddingkansas.com
tandartspraktijkheesch.nl
klusbeter.nl
freie-baugutachterpraxis.de
braffinjurylawfirm.com
tips.technology
bbsmobler.se
naturstein-hotte.de
live-your-life.jp
upplandsspar.se
homng.net
kojinsaisei.info
ncid.bc.ca
fizzl.ru
craigmccabe.fun
rebeccarisher.com
cursoporcelanatoliquido.online
tongdaifpthaiphong.net
polzine.net
triggi.de
homesdollar.com
kedak.de
classycurtainsltd.co.uk
sauschneider.info
bigler-hrconsulting.ch
pridoxmaterieel.nl
mediaacademy-iraq.org
igrealestate.com
krlosdavid.com
global-kids.info
devok.info
drnice.de
commonground-stories.com
precisionbevel.com
transliminaltribe.wordpress.com
kingfamily.construction
mank.de
truenyc.co
itelagen.com
evologic-technologies.com
macabaneaupaysflechois.com
theshungiteexperience.com.au
edelman.jp
milestoneshows.com
2ekeus.nl
pierrehale.com
roadwarrior.app
kamahouse.net
alsace-first.com
wien-mitte.co.at
conexa4papers.trade
creative-waves.co.uk
beyondmarcomdotcom.wordpress.com
nicoleaeschbachorg.wordpress.com
jandaonline.com
fransespiegels.nl
bradynursery.com
girlillamarketing.com
iyengaryogacharlotte.com
kaliber.co.jp
iwr.nl
filmstreamingvfcomplet.be
pcp-nc.com
artotelamsterdam.com
microcirc.net
adultgamezone.com
fiscalsort.com
pomodori-pizzeria.de
ventti.com.ar
newyou.at
craftleathermnl.com
lange.host
hexcreatives.co
consultaractadenacimiento.com
edrcreditservices.nl
bridgeloanslenders.com
almosthomedogrescue.dog
qualitus.com
diversiapsicologia.es
gemeentehetkompas.nl
bordercollie-nim.nl
ulyssemarketing.com
pickanose.com
importardechina.info
buroludo.nl
liliesandbeauties.org
bockamp.com
vancouver-print.ca
101gowrie.com
plv.media
satyayoga.de
xlarge.at
bastutunnan.se
linnankellari.fi
cirugiauretra.es
calabasasdigest.com
danholzmann.com
jeanlouissibomana.com
advokathuset.dk
myteamgenius.com
12starhd.online
coding-machine.com
digi-talents.com
devstyle.org
schraven.de
monark.com
sobreholanda.com
id-et-d.fr
bloggyboulga.net
vloeren-nu.nl
finediningweek.pl
jobmap.at
xn--fn-kka.no
trulynolen.co.uk
erstatningsadvokaterne.dk
ihr-news.jp
praxis-foerderdiagnostik.de
cleliaekiko.online
plastidip.com.ar
ikads.org
argenblogs.com.ar
homecomingstudio.com
uranus.nl
harpershologram.wordpress.com
appsformacpc.com
alfa-stroy72.com
destinationclients.fr
cuspdental.com
restaurantesszimmer.de
hypozentrum.com
torgbodenbollnas.se
norovirus-ratgeber.de
gaiam.nl
backstreetpub.com
pt-arnold.de
launchhubl.com
notmissingout.com
esope-formation.fr
ctrler.cn
krcove-zily.eu
autodujos.lt
woodworkersolution.com
chaotrang.com
norpol-yachting.com
hotelsolbh.com.br
hoteledenpadova.it
operaslovakia.sk
dr-tremel-rednitzhembach.de
vermoote.de
gamesboard.info
leoben.at
coding-marking.com
euro-trend.pl
id-vet.com
funjose.org.gt
ogdenvision.com
thedresserie.com
kirkepartner.dk
sanyue119.com
harveybp.com
webhostingsrbija.rs
christinarebuffetcourses.com
theletter.company
actecfoundation.org
spacecitysisters.org
galserwis.pl
tinkoff-mobayl.ru
allfortheloveofyou.com
ostheimer.at
xn--vrftet-pua.biz
presseclub-magdeburg.de
365questions.org
lightair.com
femxarxa.cat
pv-design.de
sarbatkhalsafoundation.org
leda-ukraine.com.ua
smogathon.com
gadgetedges.com
pier40forall.org
bafuncs.org
zzyjtsgls.com
hushavefritid.dk
castillobalduz.es
finde-deine-marke.de
sachnendoc.com
wmiadmin.com
rumahminangberdaya.com
travelffeine.com
stingraybeach.com
boldcitydowntown.com
adoptioperheet.fi
wraithco.com
35-40konkatsu.net
gastsicht.de
wurmpower.at
selfoutlet.com
leather-factory.co.jp
dsl-ip.de
webmaster-peloton.com
mytechnoway.com
abuelos.com
dublikator.com
botanicinnovations.com
balticdermatology.lt
asiluxury.com
richard-felix.co.uk
sinal.org
hotelzentral.at
collaborativeclassroom.org
d1franchise.com
xn--fnsterputssollentuna-39b.se
mbxvii.com
synlab.lt
ontrailsandboulevards.com
jorgobe.at
symphonyenvironmental.com
acomprarseguidores.com
allure-cosmetics.at
stacyloeb.com
fatfreezingmachines.com
dirittosanitario.biz
shsthepapercut.com
bouncingbonanza.com
urmasiimariiuniri.ro
interactcenter.org
knowledgemuseumbd.com
werkkring.nl
vox-surveys.com
houseofplus.com
edv-live.de
iphoneszervizbudapest.hu
nataschawessels.com
blacksirius.de
videomarketing.pro
the-domain-trader.com
kuntokeskusrok.fi
team-montage.dk
brandl-blumen.de
brawnmediany.com
logopaedie-blomberg.de
ncs-graphic-studio.com
ftf.or.at
lionware.de
puertamatic.es
binder-buerotechnik.at
sagadc.com
sweering.fr
the-virtualizer.com
dpo-as-a-service.com
marchand-sloboda.com
suncrestcabinets.ca
smalltownideamill.wordpress.com
solhaug.tk
better.town
refluxreducer.com
maratonaclubedeportugal.com
heurigen-bauer.at
lascuola.nl
hebkft.hu
lapinvihreat.fi
proudground.org
pivoineetc.fr
verbisonline.com
agence-chocolat-noir.com
lapmangfpt.info.vn
simulatebrain.com
extensionmaison.info
socstrp.org
carrybrands.nl
mrxermon.de
veybachcenter.de
socialonemedia.com
deltacleta.cat
fotoideaymedia.es
mooshine.com
advizewealth.com
courteney-cox.net
kidbucketlist.com.au
antiaginghealthbenefits.com
micro-automation.de
offroadbeasts.com
tastewilliamsburg.com
aunexis.ch
plotlinecreative.com
ecopro-kanto.com
mountsoul.de
nacktfalter.de
buymedical.biz
hkr-reise.de
besttechie.com
zimmerei-deboer.de
rozemondcoaching.nl
moveonnews.com
globedivers.wordpress.com
fotoscondron.com
sofavietxinh.com
schmalhorst.de
educar.org
blogdecachorros.com
gymnasedumanagement.com
jobcenterkenya.com
modestmanagement.com
pinkexcel.com
littlebird.salon
zimmerei-fl.de
aurum-juweliere.de
mercantedifiori.com
resortmtn.com
tandartspraktijkhartjegroningen.nl
revezlimage.com
bxdf.info
kindersitze-vergleich.de
mdk-mediadesign.de
bodyfulls.com
southeasternacademyofprosthodontics.org
rostoncastings.co.uk
ivfminiua.com
trapiantofue.it
craigvalentineacademy.com
verifort-capital.de
coastalbridgeadvisors.com
cnoia.org
minipara.com
nokesvilledentistry.com
otsu-bon.com
jvanvlietdichter.nl
bricotienda.com
tonelektro.nl
thefixhut.com
tarotdeseidel.com
vitavia.lt
parebrise-tla.fr
all-turtles.com
nhadatcanho247.com
longislandelderlaw.com
vesinhnha.com.vn
siluet-decor.ru
birnam-wood.com
jolly-events.com
filmvideoweb.com
perbudget.com
prochain-voyage.net
tinyagency.com
compliancesolutionsstrategies.com
austinlchurch.com
agence-referencement-naturel-geneve.net
insp.bi
mooreslawngarden.com
lusak.at
memaag.com
1team.es
roygolden.com
aniblinova.wordpress.com
kamienny-dywan24.pl
hugoversichert.de
fitovitaforum.com
stopilhan.com
sw1m.ru
neuschelectrical.co.za
stampagrafica.es
familypark40.com
fitnessbazaar.com
controldekk.com
mariposapropaneaz.com
mepavex.nl
madinblack.com
carolinepenn.com
levdittliv.se
hihaho.com
dlc.berlin
lachofikschiet.nl
bptdmaluku.com
drinkseed.com
mikeramirezcpa.com
dinslips.se
latribuessentielle.com
huissier-creteil.com
cuppacap.com
sexandfessenjoon.wordpress.com
midmohandyman.com
labobit.it
amylendscrestview.com
psa-sec.de
sandd.nl
winrace.no
campus2day.de
manifestinglab.com
herbayupro.com
digivod.de
troegs.com
kikedeoliveira.com
gmto.fr
idemblogs.com
urist-bogatyr.ru
chatizel-paysage.fr
csgospeltips.se
bimnapratica.com
jusibe.com
forskolorna.org
vetapharma.fr
connectedace.com
tophumanservicescourses.com
allamatberedare.se
vannesteconstruct.be
atmos-show.com
argos.wityu.fund
lbcframingelectrical.com
enovos.de
devlaur.com
skanah.com
slupetzky.at
centrospgolega.com
waynela.com
easytrans.com.au
copystar.co.uk
executiveairllc.com
thedad.com
greenko.pl
corendonhotels.com
reddysbakery.com
nurturingwisdom.com
geoffreymeuli.com
pogypneu.sk
jadwalbolanet.info
gw2guilds.org
tstaffing.nl
iyahayki.nl
simoneblum.de
raschlosser.de
croftprecision.co.uk
elpa.se
andersongilmour.co.uk
bundabergeyeclinic.com.au
teresianmedia.org
chandlerpd.com
carriagehousesalonvt.com
pasvenska.se
pcprofessor.com
caribbeansunpoker.com
mrtour.site
fairfriends18.de
seproc.hn
spinheal.ru
promesapuertorico.com
myzk.site
entopic.com
limassoldriving.com
marketingsulweb.com
anybookreader.de
punchbaby.com
stemplusacademy.com
ccpbroadband.com
thomasvicino.com
expandet.dk
kojima-shihou.com
toreria.es
transportesycementoshidalgo.es
dramagickcom.wordpress.com
ftlc.es
jerling.de
bigbaguettes.eu
makeitcount.at
strategicstatements.com
div-vertriebsforschung.de
podsosnami.ru
remcakram.com
muamuadolls.com
odiclinic.org
kevinjodea.com
lecantou-coworking.com
nosuchthingasgovernment.com
profectis.de
broseller.com
darrenkeslerministries.com
imaginado.de
mediaplayertest.net
faronics.com
vibethink.net
opatrovanie-ako.sk
justinvieira.com
datacenters-in-europe.com
tanzschule-kieber.de
cranleighscoutgroup.org
songunceliptv.com
stormwall.se
sportverein-tambach.de
autopfand24.de
stallbyggen.se
herbstfeststaefa.ch
sterlingessay.com
saxtec.com
visiativ-industry.fr
layrshift.eu
pointos.com
sabel-bf.com
kosterra.com
answerstest.ru
ianaswanson.com
testcoreprohealthuk.com
streamerzradio1.site
evergreen-fishing.com
iqbalscientific.com
coursio.com
thewellnessmimi.com
associationanalytics.com
lmtprovisions.com
drfoyle.com
conasmanagement.de
steampluscarpetandfloors.com
quemargrasa.net
highlinesouthasc.com
michaelsmeriglioracing.com
mindpackstudios.com
hatech.io
galleryartfair.com
handi-jack-llc.com
milsing.hr
grelot-home.com
first-2-aid-u.com
zenderthelender.com
bunburyfreightservices.com.au
nsec.se
love30-chanko.com
juneauopioidworkgroup.org
dushka.ua
solerluethi-allart.ch
daniel-akermann-architektur-und-planung.ch
x-ray.ca
sla-paris.com
pelorus.group
alysonhoward.com
nestor-swiss.ch
facettenreich27.de
miriamgrimm.de
ungsvenskarna.se
new.devon.gov.uk
yourobgyn.net
waywithwords.net
yassir.pro
seminoc.com
naturalrapids.com
takeflat.com
body-guards.it
deepsouthclothingcompany.com
hairnetty.wordpress.com
merzi.info
mylovelybluesky.com
heidelbergartstudio.gallery
ceid.info.tr
associacioesportivapolitg.cat
marathonerpaolo.com
serce.info.pl
aarvorg.com
shhealthlaw.com
manutouchmassage.com
retroearthstudio.com
rocketccw.com
i-arslan.de
antenanavi.com
urclan.net
nativeformulas.com
fannmedias.com
anthonystreetrimming.com
1kbk.com.ua
bouldercafe-wuppertal.de
exenberger.at
nandistribution.nl
softsproductkey.com
outcomeisincome.com
oceanastudios.com
danubecloud.com
readberserk.com
cheminpsy.fr
arteservicefabbro.com
irinaverwer.com
brevitempore.net
calxplus.eu
servicegsm.net
aprepol.com
ilive.lt
journeybacktolife.com
freie-gewerkschaften.de
jacquin-maquettes.com
westdeptfordbuyrite.com
heliomotion.com
dutchbrewingcoffee.com
licor43.de
samnewbyjax.com
fayrecreations.com
slwgs.org
danielblum.info
liveottelut.com
rota-installations.co.uk
loprus.pl
deprobatehelp.com
starsarecircular.org
praxis-management-plus.de
faroairporttransfers.net
bauertree.com
mir-na-iznanku.com
philippedebroca.com
klimt2012.info
peterstrobos.com
kaotikkustomz.com
xn--singlebrsen-vergleich-nec.com
faizanullah.com
slimani.net
xn--thucmctc-13a1357egba.com
kisplanning.com.au
echtveilig.nl
friendsandbrgrs.com
em-gmbh.ch
c-a.co.in
zewatchers.com
foretprivee.ca
lynsayshepherd.co.uk
real-estate-experts.com
babcockchurch.org
twohourswithlena.wordpress.com
joseconstela.com
jiloc.com
xltyu.com
you-bysia.com.au
colorofhorses.com
eaglemeetstiger.de
employeesurveys.com
cite4me.org
julis-lsa.de
oneplusresource.org
mbfagency.com
lefumetdesdombes.com
forestlakeuca.org.au
smessier.com
fundaciongregal.org
n1-headache.com
ralister.co.uk
nachhilfe-unterricht.com
mrsfieldskc.com
wychowanieprzedszkolne.pl
danskretursystem.dk
airconditioning-waalwijk.nl
financescorecard.com
geekwork.pl
allentownpapershow.com
schlafsack-test.net
denovofoodsgroup.com
lykkeliv.net
crowcanyon.com
bhwlawfirm.com
maxadams.london
kmbshipping.co.uk
celeclub.org
cityorchardhtx.com
iviaggisonciliegie.it
creamery201.com
saka.gr
sloverse.com
healthyyworkout.com
bouquet-de-roses.com
qlog.de
greenpark.ch
asgestion.com
blood-sports.net
vietlawconsultancy.com
work2live.de
wolf-glas-und-kunst.de
stupbratt.no
senson.fi
renergysolution.com
miraclediet.fun
ilso.net
crosspointefellowship.church
edgewoodestates.org
walkingdeadnj.com
vdberg-autoimport.nl
commercialboatbuilding.com
nancy-informatique.fr
4net.guru
smejump.co.th
tux-espacios.com
groupe-cets.com
zso-mannheim.de
polymedia.dk
tomoiyuma.com
321play.com.hk
falcou.fr
promalaga.es
olejack.ru
noskierrenteria.com
hellohope.com
stoeberstuuv.de
art2gointerieurprojecten.nl
mymoneyforex.com
corona-handles.com
bildungsunderlebnis.haus
kariokids.com
cortec-neuro.com
surespark.org.uk
architecturalfiberglass.org
johnsonfamilyfarmblog.wordpress.com
frontierweldingllc.com
modamilyon.com
pasivect.co.uk
morawe-krueger.de
maryloutaylor.com
shiftinspiration.com
analiticapublica.es
crediacces.com
patrickfoundation.net
stemenstilte.nl
kath-kirche-gera.de
igfap.com
ymca-cw.org.uk
thenewrejuveme.com
hashkasolutindo.com
qualitaetstag.de
artige.com
geisterradler.de
platformier.com
meusharklinithome.wordpress.com
ceres.org.au
citymax-cr.com
testzandbakmetmening.online
piajeppesen.dk
y-archive.com
artallnightdc.com
wacochamber.com
levihotelspa.fi
4youbeautysalon.com
wari.com.pe
assurancesalextrespaille.fr
corola.es
theclubms.com
petnest.ir
vanswigchemdesign.com
joyeriaorindia.com
paradicepacks.com
d2marketing.co.uk
antonmack.de
dutchcoder.nl
international-sound-awards.com
shiresresidential.com
icpcnj.org
noesis.tech
rerekatu.com
biapi-coaching.fr
luxurytv.jp
tetinfo.in
lucidinvestbank.com
burkert-ideenreich.de
coffreo.biz
stefanpasch.me
xn--rumung-bua.online
naswrrg.org
villa-marrakesch.de
teczowadolina.bytom.pl
vorotauu.ru
deoudedorpskernnoordwijk.nl
syndikat-asphaltfieber.de
parks-nuernberg.de
oneheartwarriors.at
zflas.com
porno-gringo.com
kafu.ch
ausair.com.au
dubscollective.com
securityfmm.com
chrissieperry.com
hiddencitysecrets.com.au
newstap.com.ng
gantungankunciakrilikbandung.com
jameskibbie.com
eco-southafrica.com
jakekozmor.com
solinegraphic.com
malychanieruchomoscipremium.com
ra-staudte.de
balticdentists.com
behavioralmedicinespecialists.com
sportsmassoren.com
apolomarcas.com
ki-lowroermond.nl
woodleyacademy.org
partnertaxi.sk
gporf.fr
hannah-fink.de
eraorastudio.com
phantastyk.com
vickiegrayimages.com
yamalevents.com
worldhealthbasicinfo.com
blumenhof-wegleitner.at
figura.team
tecnojobsnet.com
hairstylesnow.site
caffeinternet.it
lescomtesdemean.be
carlosja.com
haremnick.com
ahouseforlease.com
celularity.com
helikoptervluchtnewyork.nl
boulderwelt-muenchen-west.de
htchorst.nl
anteniti.com
basisschooldezonnewijzer.nl
sotsioloogia.ee
dekkinngay.com
flexicloud.hk
autodemontagenijmegen.nl
rksbusiness.com
mousepad-direkt.de
no-plans.com
penco.ie
abl1.net
makeflowers.ru
apprendrelaudit.com
luckypatcher-apkz.com
bigasgrup.com
ouryoungminds.wordpress.com
vihannesporssi.fi
plantag.de
ravensnesthomegoods.com
sporthamper.com
ivivo.es
intecwi.com
hokagestore.com
ecpmedia.vn
dubnew.com
crowd-patch.co.uk
berlin-bamboo-bikes.org
humanityplus.org
degroenetunnel.com
live-con-arte.de
bodyforwife.com
lillegrandpalais.com
abogadosaccidentetraficosevilla.es
bogdanpeptine.ro
abogados-en-alicante.es
todocaracoles.com
lichencafe.com
charlesreger.com
cwsitservices.co.uk
marietteaernoudts.nl
atozdistribution.co.uk
camsadviser.com
notsilentmd.org
lapinlviasennus.fi
thomas-hospital.de
pixelarttees.com
jsfg.com
firstpaymentservices.com
trystana.com
gopackapp.com
effortlesspromo.com
eadsmurraypugh.com
nakupunafoundation.org
aodaichandung.com
evangelische-pfarrgemeinde-tuniberg.de
gasolspecialisten.se
i-trust.dk
cimanchesterescorts.co.uk
ateliergamila.com
biortaggivaldelsa.com
paulisdogshop.de
ladelirante.fr
-
net
true
-
pid
$2a$10$nwwfZNzFITdTfTQYluhtfeuhXAkam0kR.vjHqfobssJwiPLmkLcMS
-
prc
firefox
visio
ocomm
thebat
winword
agntsvc
mydesktopservice
synctime
onenote
wordpad
dbeng50
sqbcoreservice
xfssvccon
powerpnt
tbirdconfig
sql
dbsnmp
steam
ocautoupds
ocssd
oracle
mydesktopqos
outlook
mspub
encsvc
thunderbird
msaccess
isqlplussvc
excel
infopath
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
7296
-
svc
mepocs
svc$
vss
memtas
sql
veeam
backup
sophos
Extracted
C:\Users\m2s3fb66-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/4F87E5337FB47558
http://decoder.re/4F87E5337FB47558
Extracted
C:\Users\4nfg86d09-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A5111EEDBBD7680C
http://decoder.re/A5111EEDBBD7680C
Targets
-
-
Target
run_revil.bat
-
Size
58B
-
MD5
bae60764f29a838b9059a3c88aeae2a9
-
SHA1
06ee64fa2862738d93936a6d062e3c1835b95743
-
SHA256
8019008067f0b734127abaf046a776c03a078eb2f8d730a6a98112896ac0ead7
-
SHA512
4f473c23e876f2346ef1edc5b2bf21d837520201474b28884d798168ac65df8122bfaa91d8d51a618800b1a22b82bcd9dfa269dd8454beff6760e3d92011a044
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Sodinokibi family
-
Modifies boot configuration data using bcdedit
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
-
-
Target
xx.exe
-
Size
225KB
-
MD5
55f79f1d37c122aca47ec7174a72cdde
-
SHA1
20915716ef88afa06057ec26e68d2c3f4a95cf12
-
SHA256
8b7e39a325e6c6cec05fa9ddc8d75f09192e27a22790cf57d56bac289f9bdafd
-
SHA512
a63ba92213fa88c4077b075007d75814abbb69553df964267a6324646188d38b9c6d6d7a9e24694b572508f1090682de12eb215bd21c2fc3e73171fdd42248f6
-
SSDEEP
3072:xHjdVycXwC62au4EYLDiM3w5QKH9RubCAUz7UDV0TfwK2O9gTUEy4Zbu5hYy:Ndscd6xEYLDVw5D8DV0T+JTUEFu
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Sodinokibi family
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1