ALPHV ransomware gang analysis
Tags
Common Information
| Type | Value |
|---|---|
| UUID | ea7306bc-c53b-4f60-b071-b9f333148e8d |
| Fingerprint | b7a981db0e83a6c6 |
| Analysis status | DONE |
| Considered CTI value | 2 |
| Text language | |
| Published | Jan. 26, 2022, 7:03 p.m. |
| Added to db | Sept. 26, 2022, 9:33 a.m. |
| Last updated | Nov. 18, 2024, 1:38 a.m. |
| Headline | ALPHV ransomware gang analysis |
| Title | ALPHV ransomware gang analysis |
| Detected Hints/Tags/Attributes | 270/4/54 |
Source URLs
URL Provider
RSS Feed
| Details | Id | Enabled | Feed title | Url | Added to db |
|---|---|---|---|---|---|
| Details | 322 | ✔ | Cybersécurité – INTRINSEC | https://www.intrinsec.com/feed/ | 2024-08-30 22:08 |
Attributes
| Details | Type | #Events | CTI | Value |
|---|---|---|---|---|
| Details | Domain | 1 | av3toruniquehiddenwebaddress.onion |
|
| Details | Domain | 4128 | github.com |
|
| Details | Domain | 13 | id-ransomware.blogspot.com |
|
| Details | Domain | 1 | support-global-it-ss.com |
|
| Details | Domain | 1 | hosting-global-it-ss.com |
|
| Details | Domain | 1 | intrinsec.com |
|
| Details | 1 | contact@intrinsec.com |
||
| Details | File | 3 | zone.js |
|
| Details | File | 208 | setup.exe |
|
| Details | File | 6 | runner.exe |
|
| Details | File | 1 | toolname.exe |
|
| Details | File | 2 | 4mmc.exe |
|
| Details | File | 3 | screensaver.exe |
|
| Details | File | 1 | lockbit_gay.exe |
|
| Details | File | 2 | blackcat-ransomware.html |
|
| Details | File | 8 | cmstplua.dll |
|
| Details | File | 1260 | explorer.exe |
|
| Details | File | 1 | sample_alfa_x86_64_linux_encrypt_app.exe |
|
| Details | File | 1 | scriptslocker.exe |
|
| Details | File | 21 | locker.exe |
|
| Details | File | 2127 | cmd.exe |
|
| Details | File | 1 | yourdomainnetlogonlocker.exe |
|
| Details | Github username | 1 | cdong1012 |
|
| Details | IPv4 | 1 | 141.136.44.54 |
|
| Details | IPv4 | 97 | 10.0.0.1 |
|
| Details | MITRE ATT&CK Techniques | 245 | T1016 |
|
| Details | MITRE ATT&CK Techniques | 174 | T1569.002 |
|
| Details | MITRE ATT&CK Techniques | 44 | T1053.003 |
|
| Details | MITRE ATT&CK Techniques | 310 | T1047 |
|
| Details | MITRE ATT&CK Techniques | 120 | T1129 |
|
| Details | MITRE ATT&CK Techniques | 39 | T1035 |
|
| Details | MITRE ATT&CK Techniques | 41 | T1086 |
|
| Details | MITRE ATT&CK Techniques | 9 | T1557.001 |
|
| Details | MITRE ATT&CK Techniques | 16 | T1003.004 |
|
| Details | MITRE ATT&CK Techniques | 298 | T1562.001 |
|
| Details | MITRE ATT&CK Techniques | 7 | T1218.003 |
|
| Details | MITRE ATT&CK Techniques | 550 | T1112 |
|
| Details | MITRE ATT&CK Techniques | 1006 | T1082 |
|
| Details | MITRE ATT&CK Techniques | 119 | T1049 |
|
| Details | MITRE ATT&CK Techniques | 492 | T1105 |
|
| Details | MITRE ATT&CK Techniques | 126 | T1567 |
|
| Details | MITRE ATT&CK Techniques | 276 | T1490 |
|
| Details | MITRE ATT&CK Techniques | 93 | T1485 |
|
| Details | MITRE ATT&CK Techniques | 197 | T1489 |
|
| Details | MITRE ATT&CK Techniques | 472 | T1486 |
|
| Details | MITRE ATT&CK Techniques | 58 | T1498 |
|
| Details | Url | 1 | http://av3toruniquehiddenwebaddress.onion/?access |
|
| Details | Url | 1 | http://ip_address/files/toolname.exe |
|
| Details | Url | 2 | https://www.bleepingcomputer.com/news/security/alphv-blackcat-this-years-most-sophisticated-ransomware |
|
| Details | Url | 1 | https://github.com/cdong1012/rust-ransomware |
|
| Details | Url | 2 | https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/noberus-blackcat-alphv-rust-ransomware |
|
| Details | Url | 1 | https://medium.com/s2wblog/blackcat-new-rust-based-ransomware-borrowing-blackmatters-configuration-31c8d330a809 |
|
| Details | Url | 1 | https://id-ransomware.blogspot.com/2021/12/blackcat-ransomware.html |
|
| Details | Windows Registry Key | 1 | HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesLanmanServerParameters |