Vice Society Ransomeware attack IOCs and TTPs
Vice Society Ransomeware Tools and Techniques:
VSR uses HelloKitty Elf Samples and Zeppelin
IOCs:
HelloKitty (SHA256)
643a3121166cd1ee5fc6848f099be7c7c24d36f5922f58052802b91f032a5f0f
754f2022b72da704eb8636610c6d2ffcbdae9e8740555030a07c8c147387a537
78efe6f5a34ba7579cfd8fc551274029920a9086cb713e859f60f97f591a7b04
16a0054a277d8c26beb97850ac3e86dd0736ae6661db912b8782b4eb08cfd36e
501487b025f25ddf1ca32deb57a2b4db43ccf6635c1edc74b9cff54ce0e5bcfe
9a7daafc56300bd94ceef23eac56a0735b63ec6b9a7a409fb5a9b63efe1aa0b0
3ae7bedf236d4e53a33f3a3e1e80eae2d93e91b1988da2f7fcb8fde5dcc3a0e9
10887d13dba1f83ef34e047455a04416d25a83079a7f3798ce3483e0526e3768
fa722d0667418d68c4935e1461010a8f730f02fa1f595ee68bd0768fd5d1f8bb
c7d6719bbfb5baaadda498bf5ef49a3ada1d795b9ae4709074b0e3976968741e
38d9a71dc7b3c257e4bd0a536067ff91a500a49ece7036f9594b042dd0409339
Zeppelin Ransomeware (SHA256)
08c6e20b1785d4ec4e3f9956931d992377963580b4b2c6579fd9930e08882b1c
a23110f763cbecc6f2de868d413073d4af7a3514d5e728eac4989c33191be227
4a4be110d587421ad50d2b1a38b108fa05f314631066a2e96a1c85cc05814080
307877881957a297e41d75c84e9a965f1cd07ac9d026314dcaff55c4da23d03e
faa79c796c27b11c4f007023e50509662eac4bca99a71b26a9122c260abfb3c6
dd89d939c941a53d6188232288a3bd73ba9baf0b4ca6bf6ccca697d9ee42533f
4440763b18d75a0f9de30b1c4c2aeb3f827bc4f5ea9dd1a2aebe7e5b23cfdf94
24efa10a2b51c5fd6e45da6babd4e797d9cae399be98941f950abf7b5e9a4cd7
bafd3434f3ba5bb9685e239762281d4c7504de7e0cfd9d6394e4a85b4882ff5d
aa7e2d63fc991990958dfb795a0aed254149f185f403231eaebe35147f4b5ebe
001938ed01bfde6b100927ff8199c65d1bff30381b80b846f2e3fe5a0d2df21d
Ab440c4391ea3a01bebbb651c80c27847b58ac928b32d73ed3b19a0b17dd7e75
Contacts:
vicesociety@onionmail[.]org
v-society.official@onionmail[.]org
LarryGold@onionmail[.]org
MollyThomson@onionmail[.]org
BruceBoyle@onionmail[.]org
SylvesterJones@onionmail[.]org
brendaevans4454@onionmail[.]org
warreinolds77@onionmail[.]org
DaltonReed@onionmail[.]org
FreddieFerrell@onionmail[.]org
lewiselsberry@onionmail[.]org
inezeng@onionmail[.]org
lonnieguzman@onionmail[.]org
thomasmoore@onionmail[.]org
Domains:
vsociethok6sbprvevl4dlwbqrzyhxcxaqpvcqt5belwvsuxaxsutyad[.]onion
Qu5dci2k25x2imgki2dbhcwegqqsqsrjj5d3ugcc5kpsgbtj2psaedqd[.]onion
Wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtffqd[.]onion
gunyhng6pabzcurl7ipx2pbmjxpvqnu6mxf2h3vdeenam34inj4ndryd[.]onion
6x7dp6h3w6q3ugjv4yv5gycj3femb24kysgry5b44hhgfwc5ml5qrdad[.]onion
x6gjpqs4jjvgpfvhghdz2dk7be34emyzluimticj5s5fexf4wa65ngad[.]onion
IPs:
5.255.99[.]59
5.161.136[.]176
198.252.98[.]184
194.34.246[.]90