DoppelPaymerMalware
- bitpaymer
- friedex
- iencrypt
- pay or grief
- wp_encrypt
Doppelpaymer is a ransomware family that encrypts user data and later on it asks for a ransom in order to restore original files. It is recognizable by its trademark file extension added to encrypted files:.doppeled. It also creates a note file named: ".how2decrypt.txt".From MISP Galaxy
Last reported 4 years ago, by Group-IB4 reports
ATT&CK techniques
6 of 9 · each with the sentence it comes from- T1219Remote Access Tools
“Make your remote access tools secure.”
- T1021.001Remote Desktop Protocol
“In addition, lateral movement was enabled by leveraging Remote Desktop Protocol.”
- T1053.005Scheduled Task
“Usually the threat actors try to deploy ransomware as widely as possible, and use PsExec or Group Policy modification to run a scheduled task to run it.”
- T1110Brute Force
“This fact is very important from the TTPs perspective: on rare occasions, the initial access is gained through a brute force attack against public-facing RDP-servers or just using valid accounts obtained from a third party.”
- T1110.003Password Spraying
“It’s important to note that the RaaS affiliates rarely perform brute force or password spraying attacks against such instances themselves, rather they buy accesses from the brokers.”
- T1133External Remote Services
“As already mentioned, many affiliates abuse external remote services, as well as exploit public-facing applications to obtain initial access to the target network.”
What the reports say
4 reports, newest first · the exact sentence from each-
Inside the Hive“Only two groups besides Hive have used API: Grief and DoppelPaymer.”
-
The Darker Things“Previously, this algorithm was found, for example, in such ransomware families as DarkSide, DoppelPaymer, Clop, and others.”
-
It’s alive!“In late May, DoppelPaymer used a marketing trick and renamed its new ransomware Grief (Pay OR Grief).”
-
REvil Twins: Ransomware-as-a-Service program“In the past, IcedID was known to have been used by Maze, Egregor and Conti affiliates, while Qakbot – by ProLock, Egregor and DoppelPaymer.”
Indicators in its reports
named in the reports above- hxxps://paymenthacks[.]comin 2 reports
- paymenthacks[.]comin 2 reports
- hxxp://paymenthacks[.]comin 2 reports
- hxxps://mojobiden[.]comin 2 reports
- mojobiden[.]comin 2 reports
- hxxp://mojobiden[.]comin 2 reports
- exploit[.]inin 1 report
- rand[.]readin 1 report
- time[.]nowin 1 report
- cryptorand[.]readin 1 report
- keytab[.]datain 1 report
- 1e21c8e27a97de17…09d4f07db0ffin 1 report
- 2f7d37c22e6199d1…169b4a48afe5in 1 report
- 50ad0e6e9dc72d10…667823e85609in 1 report
- 5954558d43884da2…5b16767a27e5in 1 report
- 5ae51e30817c0d08…baa4ec265ef3in 1 report
- 612e5ffd09ca30ca…14bce45575ecin 1 report
- 77a398c870ad4904…b3c8d9fc6618in 1 report
- 88f7544a29a2ceb1…17f85ea9afd1in 1 report
- a0b4e3d7e4cd20d2…95c5677db749in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.