Rapid
Tags
| country: | India |
| attack-pattern: | Data Malware - T1587.001 Malware - T1588.001 Server - T1583.004 Server - T1584.004 Software - T1592.002 |
Common Information
| Type | Value |
|---|---|
| UUID | 65096203-4d0e-4a97-8a92-f4fce9ecdb77 |
| Fingerprint | 163688db6c761e09 |
| Analysis status | DONE |
| Considered CTI value | 0 |
| Text language | |
| Published | Jan. 2, 2018, 8:14 a.m. |
| Added to db | Jan. 18, 2023, 7:53 p.m. |
| Last updated | Nov. 17, 2024, 6:55 p.m. |
| Headline | Шифровальщики-вымогатели The Digest "Crypto-Ransomware" |
| Title | Rapid |
| Detected Hints/Tags/Attributes | 62/2/141 |
Source URLs
| Redirection | Url | |
|---|---|---|
| Details | Source | http://id-ransomware.blogspot.com/2018/01/rapid-ransomware.html |
URL Provider
Attributes
| Details | Type | #Events | CTI | Value |
|---|---|---|---|---|
| Details | Domain | 24 | rape.lol |
|
| Details | Domain | 21 | oracle.com |
|
| Details | Domain | 99 | qq.com |
|
| Details | Domain | 144 | cock.li |
|
| Details | Domain | 1 | fbamasters.com |
|
| Details | Domain | 99 | india.com |
|
| Details | Domain | 83 | tuta.io |
|
| Details | Domain | 84 | airmail.cc |
|
| Details | Domain | 46 | firemail.cc |
|
| Details | Domain | 2 | cairihi.com |
|
| Details | Domain | 30 | bitmessage.ch |
|
| Details | Domain | 2 | wizrac.com |
|
| Details | Domain | 167 | tutanota.com |
|
| Details | Domain | 396 | protonmail.com |
|
| Details | Domain | 1 | file.wtf |
|
| Details | Domain | 10 | nigge.rs |
|
| Details | Domain | 35 | tutamail.com |
|
| Details | Domain | 15 | paxful.com |
|
| Details | Domain | 162 | localbitcoins.com |
|
| Details | Domain | 1 | helprapid.org |
|
| Details | Domain | 136 | mail.com |
|
| Details | Domain | 1174 | gmail.com |
|
| Details | Domain | 5 | aaathats3as.com |
|
| Details | Domain | 68 | keemail.me |
|
| Details | Domain | 2 | rapidteamail.com |
|
| Details | Domain | 4 | mailchuck.com |
|
| Details | Domain | 89 | protonmail.ch |
|
| Details | Domain | 18 | cock.lu |
|
| Details | Domain | 1 | rapid0.com |
|
| Details | Domain | 1 | recovery.company |
|
| Details | Domain | 1 | ytufnh2mbniwh437.onion |
|
| Details | Domain | 1 | recovery.hk |
|
| Details | Domain | 59 | torproject.org |
|
| Details | Domain | 1 | rapid2019.com |
|
| Details | Domain | 42 | www.coinbase.com |
|
| Details | Domain | 13 | www.buybitcoinworldwide.com |
|
| Details | 1 | jpcrypt@rape.lol |
||
| Details | 1 | rapid@rape.lol |
||
| Details | 1 | fileskey@qq.com |
||
| Details | 1 | fileskey@cock.li |
||
| Details | 1 | support@fbamasters.com |
||
| Details | 1 | unlockforyou@india.com |
||
| Details | 1 | frenkmoddy@tuta.io |
||
| Details | 1 | paymeme@cock.li |
||
| Details | 1 | paymeme@india.com |
||
| Details | 1 | decryptsupport@airmail.cc |
||
| Details | 1 | supportlocker@firemail.cc |
||
| Details | 1 | lola2017@tuta.io |
||
| Details | 2 | help@cairihi.com |
||
| Details | 1 | bm-2cveahvzzjuf8m1v7azkweopqcyntvfvzg@bitmessage.ch |
||
| Details | 1 | alexgen@cock.li |
||
| Details | 1 | alexgen@tuta.io |
||
| Details | 2 | help@wizrac.com |
||
| Details | 1 | anonimus852@tutanota.com |
||
| Details | 1 | anonimus852@cock.li |
||
| Details | 1 | asgard201@cock.li |
||
| Details | 1 | asgard2018@cock.li |
||
| Details | 1 | decrfile@protonmail.com |
||
| Details | 1 | file.wtf@protonmail.com |
||
| Details | 1 | hersgory@india.com |
||
| Details | 1 | auditt@cock.li |
||
| Details | 1 | ataprof@cock.li |
||
| Details | 1 | wolksvagen@protonmail.com |
||
| Details | 1 | dataprof@cock.li |
||
| Details | 1 | rapidadmins@nigge.rs |
||
| Details | 1 | fastsupport@cock.li |
||
| Details | 1 | patapuck@india.com |
||
| Details | 1 | sofrdecrypt@firemail.cc |
||
| Details | 1 | maxspeed@tutamail.com |
||
| Details | 1 | lub@wizrac.com |
||
| Details | 1 | returnthefile@cock.li |
||
| Details | 1 | sheldonleecooper@india.com |
||
| Details | 1 | secure-it@tuta.io |
||
| Details | 1 | mariode@cock.li |
||
| Details | 1 | softdecrypt@firemail.cc |
||
| Details | 1 | maxspeed-dcr@tutamail.com |
||
| Details | 1 | andersoncrypt@firemail.cc |
||
| Details | 1 | belinda@cock.li |
||
| Details | 1 | rapid@helprapid.org |
||
| Details | 1 | bm-gtovgydgs7qxpkoyargrlfufkz1sfpsw@bitmessage.ch |
||
| Details | 1 | gillette_help@mail.com |
||
| Details | 1 | gillette-help@mail.com |
||
| Details | 1 | gagima@gmail.com |
||
| Details | 1 | helperso@protonmail.com |
||
| Details | 1 | heperso@cock.li |
||
| Details | 5 | rpd@keemail.me |
||
| Details | 1 | pay4decrypt1@cock.li |
||
| Details | 1 | pay4decrypt1@protonmail.com |
||
| Details | 1 | rapidka@cock.li |
||
| Details | 2 | donaldtrump@rapidteamail.com |
||
| Details | 1 | mavxfashghgr@mailchuck.com |
||
| Details | 1 | youfile@protonmail.com |
||
| Details | 1 | grupposupp@protonmail.ch |
||
| Details | 1 | grupposupp@airmail.cc |
||
| Details | 2 | pay4dec@cock.lu |
||
| Details | 1 | p4d@tuta.io |
||
| Details | 1 | notnepo@cock.lu |
||
| Details | 1 | burcr@protonmail.com |
||
| Details | 1 | burcr@airmail.cc |
||
| Details | 1 | snhmgmczxapj@mailchuck.com |
||
| Details | 1 | recovery.company@protonmail.com |
||
| Details | 1 | rapid.file@tuta.io |
||
| Details | 2 | bm-2cuprnxjrufykcduclugjrcpy58nrvhrav@bitmessage.ch |
||
| Details | 1 | gufito@tutanota.com |
||
| Details | File | 140 | files.txt |
|
| Details | File | 27 | sql.exe |
|
| Details | File | 2 | sqlite.exe |
|
| Details | File | 345 | vssadmin.exe |
|
| Details | File | 2125 | cmd.exe |
|
| Details | File | 19 | recovery.txt |
|
| Details | File | 13 | info.exe |
|
| Details | File | 74 | mstsc.exe |
|
| Details | File | 1 | fts.exe |
|
| Details | File | 1 | %appdata%\info.exe |
|
| Details | File | 1 | %appdata%\recovery.txt |
|
| Details | File | 1 | %userprofile%\appdata\roaming\info.exe |
|
| Details | File | 1 | c:\windows\fonts\ctfmon.vbs |
|
| Details | File | 1 | no_more_ransom.exe |
|
| Details | File | 1 | leagueclientux.exe |
|
| Details | File | 1 | eslf.exe |
|
| Details | File | 57 | data.txt |
|
| Details | File | 1 | decrypt_droprapid.txt |
|
| Details | File | 4 | decrypt_files.txt |
|
| Details | File | 2 | userkey.dat |
|
| Details | File | 1 | files-recovery.txt |
|
| Details | File | 1 | kakdela.bmp |
|
| Details | Url | 2 | https://paxful.com |
|
| Details | Url | 33 | https://localbitcoins.com |
|
| Details | Url | 4 | https://protonmail.com |
|
| Details | Url | 2 | https://tutanota.com |
|
| Details | Url | 1 | https://cock.li |
|
| Details | Url | 27 | https://torproject.org |
|
| Details | Url | 1 | http://ytufnh2mbniwh437.onion/ca3fcdiie1hstmza |
|
| Details | Url | 1 | http://recovery.hk/ca3fcdiie1hstmza |
|
| Details | Url | 3 | https://www.coinbase.com/signup |
|
| Details | Url | 1 | https://localbitcoins.com/register |
|
| Details | Url | 1 | https://www.coinbase.com/buy_bitcoin |
|
| Details | Url | 52 | https://localbitcoins.com/buy_bitcoins |
|
| Details | Url | 12 | https://www.buybitcoinworldwide.com |
|
| Details | Windows Registry Key | 582 | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run |
|
| Details | Windows Registry Key | 188 | HKCU\Software\Microsoft\Windows\CurrentVersion\Run |