Overview

overview

10

Static

static

10

a083060d38...96.exe

windows10-2004-x64

10

a083060d38...96.exe

windows11-ltsc_2024-x64

10

a130125a49...09.elf

ubuntu-18.04-amd64

3

a4337294dc...0f.exe

windows10-2004-x64

9

a4337294dc...0f.exe

windows11-ltsc_2024-x64

9

a87658cd12...85.exe

windows10-2004-x64

a87658cd12...85.exe

windows11-ltsc_2024-x64

aa503ddb16...eb.exe

windows10-2004-x64

10

aa503ddb16...eb.exe

windows11-ltsc_2024-x64

10

aa7ef4bb8d...d2.exe

windows10-2004-x64

aa7ef4bb8d...d2.exe

windows11-ltsc_2024-x64

aae8f44136...00.exe

windows10-2004-x64

10

aae8f44136...00.exe

windows11-ltsc_2024-x64

1

ab04ff1b0d...6d.exe

windows10-2004-x64

ab04ff1b0d...6d.exe

windows11-ltsc_2024-x64

ab14f46214...e9.exe

windows10-2004-x64

6

ab14f46214...e9.exe

windows11-ltsc_2024-x64

6

ab24df3877...95.dll

windows10-2004-x64

10

ab24df3877...95.dll

windows11-ltsc_2024-x64

10

ab62ae9f4f...58.exe

windows10-2004-x64

10

ab62ae9f4f...58.exe

windows11-ltsc_2024-x64

10

ab8d097bd5...7b.exe

windows10-2004-x64

10

ab8d097bd5...7b.exe

windows11-ltsc_2024-x64

10

ab8eee432f...d2.exe

windows10-2004-x64

10

ab8eee432f...d2.exe

windows11-ltsc_2024-x64

10

abbac1d240...3f.exe

windows10-2004-x64

10

abbac1d240...3f.exe

windows11-ltsc_2024-x64

7

abd49fd6f5...14.exe

windows10-2004-x64

10

abd49fd6f5...14.exe

windows11-ltsc_2024-x64

10

ac73e3c9e7...5f.exe

windows10-2004-x64

10

ac73e3c9e7...5f.exe

windows11-ltsc_2024-x64

10

ac7a0aaa0e...bd.exe

windows10-2004-x64

10

Resubmissions

14/11/2026, 11:15

261114-nclyrafz8y10

14/11/2026, 11:03

261114-m5nsdads2q10

11/10/2026, 17:40

261011-v816wavsht10

Sharing

Copy URL Twitter E-mail

General

  • Target
    jaffacakes118_samples.part026.rar
  • Size 15.0MB
  • Sample261114-m5nsdads2q
  • SHA256 2bd509669c694baeb1234cc20b362e3b9a5d7619e200d949a0c9fd425e206ef3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
upxstealerrat482699asyncratransomwareech0raixblackbastabackdoorgandcrabeternitychaossurtrnominatuscryptotrojannjratxoristpenterwarenocrysodinokibiblackmagickeyloggerspywarenanocore

Malware Config

Extracted

Family

  • gandcrab

C2

  • http://gdcbghvjyqy7jclk.onion.top/

Extracted

Family

  • nanocore

Version

  • 1.2.2.0

C2

  • sussyamous34.ddns.net:1604

  • 127.0.0.1:1604

Mutex

  • ec97bb2a-97e2-4ed2-ab3e-80470b0fcb3b

Attributes
  • activate_away_mode

    true

  • backup_connection_host

    127.0.0.1

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2022-04-01T11:36:09.798698936Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    true

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    1604

  • default_group

    Default

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    ec97bb2a-97e2-4ed2-ab3e-80470b0fcb3b

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    sussyamous34.ddns.net

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    false

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Extracted

Family

  • sodinokibi

Botnet

  • 48

Campaign

  • 2699

Decoy

  • onlinemarketingsurgery.co.uk

  • skinkeeper.li

  • metroton.ru

  • fta-media.com

  • skolaprome.eu

  • carolynfriedlander.com

  • fotoslubna.com

  • stressreliefadvice.com

  • condormobile.fr

  • michal-s.co.il

  • andrealuchesi.it

  • 1deals.com

  • hawthornsretirement.co.uk

  • gatlinburgcottage.com

  • voice2biz.com

  • enews-qca.com

  • thenalpa.com

  • modamarfil.com

  • primemarineengineering.com

  • internestdigital.com

Attributes
  • net

    false

  • pid

    48

  • prc

    mydesktopqos

    pvlsvr

    tbirdconfig

    agntsvc

    isqlplussvc

    vxmon

    CagService

    VeeamDeploymentSvc

    benetns

    winword

    ocomm

    firefox

    steam

    powerpnt

    dbeng50

    bengien

    visio

    mydesktopservice

    bedbh

    DellSystemDetect

    mspub

    thebat

    infopath

    encsvc

    synctime

    ocssd

    dbsnmp

    sql

    xfssvccon

    EnterpriseClient

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    2699

  • svc

    MVarmor64

    backup

    memtas

    VSNAPVSS

    WSBExchange

    svc$

    MVArmor

    veeam

    bedbg

    BackupExecAgentBrowser

    BackupExecDiveciMediaService

    BackupExecVSSProvider

    MSExchange

    sophos

    AcrSch2Svc

    VeeamDeploymentService

    CAARCUpdateSvc

    PDVFSService

    BackupExecRPCService

    MSExchange$

    BackupExecJobEngine

    vss

    AcronisAgent

    MSSQL$

    stc_raw_agent

    VeeamNFSSvc

    BackupExecManagementService

    ARSM

    BackupExecAgentAccelerator

    VeeamTransportSvc

Signatures

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Family: Black Basta

    A ransomware family targeting Windows and Linux ESXi first seen in February 2022.

    ransomwareblackbasta
  • Family: BlackMagic

    BlackMagic is a Windows ransomware written in C++.

    ransomwareblackmagic
  • Family: Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos
  • Family: Eternity

    Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

    eternity
  • Family: Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

    ransomwarebackdoorgandcrab
  • Family: NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore
  • Family: NoCry

    NoCry is a Windows ransomware written in C#.

    ransomwarenocry
  • Family: NominatusCrypto,NominatusStorm

    NominatusCrypto aka NominatusStorm is a ransomware written in C#.

    ransomwarenominatuscrypto
  • Family: PenterWare

    PenterWare is a Windows ransomware written in C#.

    ransomwarepenterware
  • Family: Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Family: Surtr

    Ransomware family first seen in late 2021.

    ransomwaresurtr
  • Family: Xorist Ransomware

    Xorist is a ransomware first seen in 2020.

    ransomwarexorist
  • Family: eCh0raix, QNAPCrypt

    Ransomware targeting network-attached storage devices.

    ransomwareech0raix
  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • Async RAT payload 1 IoCs
    rat
  • Black Basta payload 1 IoCs
  • Chaos Ransomware 1 IoCs
  • Detected Xorist Ransomware 1 IoCs
  • Detects BlackBasta Ransomware 1 IoCs
  • Detects BlackMagic ransomware 1 IoCs
  • Detects Eternity stealer 1 IoCs
    stealer
  • Detects NoCry ransomware 1 IoCs
  • Detects NominatusCrypto C# variant 1 IoCs
  • Detects NominatusCrypto DOS executable variant 1 IoCs
  • Detects PenterWare ransomware 1 IoCs
  • Detects Surtr Payload 1 IoCs
  • GandCrab payload 1 IoCs
  • eCh0raix ransomware 1 IoCs
  • SmartAssembly .NET packer 1 IoCs

    Detects SmartAssembly .NET packer.

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 32 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • jaffacakes118_samples.part026.rar
    .rar 15.0MB
  • a083060d38984e7c6f36dcd2c57ec1aa3f50f9c201c8538257c8cbf2b3217e96.exe
    .exe 720KB
  • a130125a498a358b75cd9a1256ea873baeacd81f77c3d2ea475f3e547f899509.elf
    .elf 4.0MB
  • a4337294dc51518284641982a28df585ede9b5f0e3f86be3c2c6bb5ad766a50f.exe
    .exe 226KB
  • a87658cd123b8352396116b4ee5fb36cfaf83493d30aefc01bd2aacc4d1c1885.exe
    159KB
  • aa48acaef62a7bfb3192f8a7d6e5229764618ac1ad1bd1b5f6d19a78864eb31f.exe
    .dll 79KB
  • aa503ddb166aff5790a44dc1cf64840fb7251d2b509f7b3eeb072f59b5cc7aeb.exe
    .exe 2.8MB
  • aa7ef4bb8d0eab74af36162fe42056008d7e19e62ff1b50b870e72140a7b5bd2.exe
    .exe 532KB
  • aae8f441367e5b86a5f46bfd062c42886c6df0cff410a2a91c5334e321e54200.exe
    .exe 1.4MB
  • ab04ff1b0d5f70c43a0985f3b0b3b8bc1150ab9e74d56f3b1c4043a51aabf76d.exe
    .exe 136KB
  • ab14f462141fd6d559fcf50dd92e7c7571a6ecf8986c9be7af85baf8f025bbe9.exe
    .exe 73KB
  • ab24df3877345cfab2c946d8a714f1ef17fe18c6744034b44ec0c83a3b613195.dll
    .dll 850KB
  • ab62ae9f4f7e797648fd4de6633357f704d4799f77844a0368a17ad21d2a2958.exe
    .exe 743KB
  • ab8d097bd5fb7fe03f5e40abd77652210e635b0a253c578db76d2cf844e9147b.exe
    .exe 281KB
  • ab8eee432fa636360b3c6724fe6851e9cf8eeae1ee9da6fc576bee1cd5d7fad2.exe
    .exe 79KB
  • abbac1d240758fe349c6765e118ff6a5e34e080d10542593a154ca32b222b83f.exe
    .exe 61KB
  • abd49fd6f57d4f0ffef794257692c61b2089ee412ae27fe36a9ffee41f9d5e14.exe
    .exe 1.1MB
  • ac73e3c9e7ee62be2d2138fa5f8ef28679c0a191882b7a30e35ce7b89786935f.exe
    .exe 244KB
  • ac7a0aaa0e361b368d88b60fe956e5f492e7c89135c0f3b8294a176ada5de2bd.exe
    .exe 2.6MB
  • accf87917bd2ea6c5f3ff155078002eab423fd2de3b60abfe22614562c9c4fad.exe
    .exe 9KB
  • acdc1eaeda437252235b4207bd3920c8bbb596a7290f06560415c06af7907e5f.exe
    .sys 2.2MB
  • ad0edd2bac12a5710015b2c2e83e3416b38997c91edfe327344d1b56f6e9f035.exe
    .exe 500KB
  • ad55f0db99cb7b4cc2189bb0434d6002f8bd2bf99e25d56d61d12e82dd8320d9.exe
    .exe 244KB
  • adf42396a578e577bc1eb5324130a091a9600ea25adaccda7bd29429400dcab6.exe
    .exe 61KB
  • ae1a5efe5dd100b08fe84ec75c0e8c803a52b94d38e452d7c224347ec965ba01.exe
    .exe 2.1MB
  • ae36758124f59c90cedb85796ff4432fbd25df1a6407b8a0168693664a394fd3.exe
    .exe 496KB
  • ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe
    .exe 179KB
  • af80b807c797d4d5e8141f7d43f08e91181fb94029c84fd41786a883d09dc902.exe
    .dll 663KB
  • b0a7fec34ce8a790e943f4db15e7fe4bef3fdd36b43064b3b01d85ad4601c5f9.exe
    .exe 203KB
  • b0e2a8c3c5d57571c7892940ab531925a2b0451964afd3035f1293062ca6d64e.exe
    .exe 138KB
  • b3c495a36fea5be7069701fc373d83739aa721b87aac18c3abc390d836500047.gz
    .gz 100KB
  • b3c495a36fea5be7069701fc373d83739aa721b87aac18c3abc390d836500047
    .exe 1.8MB
  • b3ea0f4f442da3106c0d4f97cf20e244b84d719232ca90b3b7fc6e59e37e1ca1.exe
    .dll 242KB
  • b4f86ff48c5f6b01e0ad4543fb78e0435e81f3ec2aaca89866862157c0dacf4f.exe
    .exe 3.6MB
  • b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe
    .exe 71KB
  • b5e73c65a92abd6d8ea6040739e6b71a207035f1517f3813c56fbac937b8ff06.exe
    .exe 164KB

jaffacakes118_samples.part026.rar

  • SHA256 2bd509669c694baeb1234cc20b362e3b9a5d7619e200d949a0c9fd425e206ef3
  • MD5 SHA1 SHA512 SSDEEP TLSH