GriefMalware
captcha prevents indexingFrom MISP Galaxy
Last reported 4 years ago, by Group-IB2 reports
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1219Remote Access Tools
“Make your remote access tools secure.”
- T1552.008Chat Messages
“Victim company data: IDs and the number of chat messages with the Hive “sales department””
What the reports say
2 reports, newest first · the exact sentence from each-
Inside the Hive“Only two groups besides Hive have used API: Grief and DoppelPaymer.”
-
It’s alive!“In late May, DoppelPaymer used a marketing trick and renamed its new ransomware Grief (Pay OR Grief).”
Indicators in its reports
named in the reports above- rand[.]readin 1 report
- time[.]nowin 1 report
- cryptorand[.]readin 1 report
- keytab[.]datain 1 report
- 1e21c8e27a97de17…09d4f07db0ffin 1 report
- 2f7d37c22e6199d1…169b4a48afe5in 1 report
- 50ad0e6e9dc72d10…667823e85609in 1 report
- 5954558d43884da2…5b16767a27e5in 1 report
- 5ae51e30817c0d08…baa4ec265ef3in 1 report
- 612e5ffd09ca30ca…14bce45575ecin 1 report
- 77a398c870ad4904…b3c8d9fc6618in 1 report
- 88f7544a29a2ceb1…17f85ea9afd1in 1 report
- a0b4e3d7e4cd20d2…95c5677db749in 1 report
- bf7bc94506eb72da…be911a8f3964in 1 report
- c04509c1b80c129a…b5c2a177ed11in 1 report
- c29bf72d010c32ac…e9d35dd3853din 1 report
- db23ad5a44f67332…b0095a72bf6ein 1 report
- dd1c58c48d46cce9…3e3833fa7ccbin 1 report
- e1a7ddbf735d5c1c…2ec8948ef84ein 1 report
- f99eace78d92e533…3496a9757fa1in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.