malware family
Ako
unknownentity:malware_familyransomware · 1 source
Once installed, Ako will attempt to delete Volume Shadow Copies and disable recovery services. It will then begin to encrypt all files that do not match a hard-coded list using an unknown algorithm. Whilst this is happening, Ako will scan the affected network for any connected devices or drives for it to propagate to.
Curated · btcintel
claims we make, each with its source and citation · sources may contradict; we show the set, never a score
Facts
- id
- ako
- kind
- malware family
- status
- unknown
- aliases
- MedusaReborn
- jurisdictions
- —
- claims naming it
- 13 · 0 attributions · 0 relations · 0 events
Identifiers
- misp-galaxy 7de070ce-4b63-4d3c-be73-1ede22565fafvia misp-galaxy-ransomware
Relations
computedno relations recorded for this entity
Events
computedno dated events recorded for this entity
Claims naming this entitynewest first · 13 of 13
- AkoransomwarepaymentsourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0evidencepayment 1DUBrMcH9T13oFSa59jxtFDM5eWTP8v2yc · 24,648,543 sat · time 2020-01-13 03:26 UTC · url https://ransomwhe.re/#address/1DUBrMcH9T13oFSa59jxtFDM5eWTP8v2ycfetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3ann_25056btcintel:annotations:25056@v3 sha256:7e39fbc5a987e5e3confidencetrusted provider · 50
- AkoransomwarepaymentsourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0evidencepayment 1DUBrMcH9T13oFSa59jxtFDM5eWTP8v2yc · 46,940,000 sat · time 2020-01-14 09:29 UTC · url https://ransomwhe.re/#address/1DUBrMcH9T13oFSa59jxtFDM5eWTP8v2ycfetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3ann_25055btcintel:annotations:25055@v3 sha256:358174175e38517econfidencetrusted provider · 50
- AkoransomwarepaymentsourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0evidencepayment 1DUBrMcH9T13oFSa59jxtFDM5eWTP8v2yc · 36,579,501 sat · time 2020-01-14 10:17 UTC · url https://ransomwhe.re/#address/1DUBrMcH9T13oFSa59jxtFDM5eWTP8v2ycfetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3ann_25054btcintel:annotations:25054@v3 sha256:e650de32fac2c367confidencetrusted provider · 50
- AkoransomwarepaymentsourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0evidencepayment 1DUBrMcH9T13oFSa59jxtFDM5eWTP8v2yc · 1,000,000 sat · time 2020-01-25 22:50 UTC · url https://ransomwhe.re/#address/1DUBrMcH9T13oFSa59jxtFDM5eWTP8v2ycfetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3ann_25053btcintel:annotations:25053@v3 sha256:5ac0107c6669d796confidencetrusted provider · 50
- AkoransomwarepaymentsourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0evidencepayment 1DUBrMcH9T13oFSa59jxtFDM5eWTP8v2yc · 29,000,000 sat · time 2020-01-25 23:19 UTC · url https://ransomwhe.re/#address/1DUBrMcH9T13oFSa59jxtFDM5eWTP8v2ycfetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3ann_25052btcintel:annotations:25052@v3 sha256:c03a78927e2cebb4confidencetrusted provider · 50
- AkoransomwarepaymentsourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0evidencepayment 1DUBrMcH9T13oFSa59jxtFDM5eWTP8v2yc · 24,908,607 sat · time 2020-01-27 18:28 UTC · url https://ransomwhe.re/#address/1DUBrMcH9T13oFSa59jxtFDM5eWTP8v2ycfetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3ann_25051btcintel:annotations:25051@v3 sha256:0d1fba63ebd0e091confidencetrusted provider · 50
- AkoransomwarepaymentsourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0evidencepayment 1DUBrMcH9T13oFSa59jxtFDM5eWTP8v2yc · 49,050,000 sat · time 2020-02-01 18:42 UTC · url https://ransomwhe.re/#address/1DUBrMcH9T13oFSa59jxtFDM5eWTP8v2ycfetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3ann_25050btcintel:annotations:25050@v3 sha256:f11a22fca99a2d4aconfidencetrusted provider · 50
- AkoransomwarepaymentsourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0evidencepayment 1DUBrMcH9T13oFSa59jxtFDM5eWTP8v2yc · 32,098,356 sat · time 2020-02-01 19:29 UTC · url https://ransomwhe.re/#address/1DUBrMcH9T13oFSa59jxtFDM5eWTP8v2ycfetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3ann_25049btcintel:annotations:25049@v3 sha256:9eb2b0d662151212confidencetrusted provider · 50
- AkoransomwarepaymentsourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0evidencepayment 1DUBrMcH9T13oFSa59jxtFDM5eWTP8v2yc · 50,600,000 sat · time 2020-02-04 20:07 UTC · url https://ransomwhe.re/#address/1DUBrMcH9T13oFSa59jxtFDM5eWTP8v2ycfetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3ann_25048btcintel:annotations:25048@v3 sha256:a439e272e180b6bdconfidencetrusted provider · 50
- AkoransomwarepaymentsourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0evidencepayment 1DUBrMcH9T13oFSa59jxtFDM5eWTP8v2yc · 47,040,000 sat · time 2020-02-07 18:34 UTC · url https://ransomwhe.re/#address/1DUBrMcH9T13oFSa59jxtFDM5eWTP8v2ycfetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3ann_25047btcintel:annotations:25047@v3 sha256:53b3007b9a661fe3confidencetrusted provider · 50
- AkoransomwarepaymentsourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0evidencepayment 1DUBrMcH9T13oFSa59jxtFDM5eWTP8v2yc · 20,000 sat · time 2020-02-07 20:31 UTC · url https://ransomwhe.re/#address/1DUBrMcH9T13oFSa59jxtFDM5eWTP8v2ycfetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3ann_25046btcintel:annotations:25046@v3 sha256:ecfc6f39dfbb2af0confidencetrusted provider · 50
- AkoransomwarepaymentsourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0evidencepayment 1DUBrMcH9T13oFSa59jxtFDM5eWTP8v2yc · 24,900,000 sat · time 2020-02-10 17:07 UTC · url https://ransomwhe.re/#address/1DUBrMcH9T13oFSa59jxtFDM5eWTP8v2ycfetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3ann_25045btcintel:annotations:25045@v3 sha256:9b177db68355a93dconfidencetrusted provider · 50
- Akoransomwarepayment addresssourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0evidencefamily raw Ako · url https://ransomwhe.re/#address/1DUBrMcH9T13oFSa59jxtFDM5eWTP8v2ycfetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2ann_25044btcintel:annotations:25044@v2 sha256:184b2908d6983f5dconfidencetrusted provider · 50
Subjects13 subjects carry a claim naming this entity · a sample
- 1DUBrMcH9T13oFSa59jxtFDM5eWTP8v2ycaddress
- 03c4a6a2769128a4b67ff4ce33d71d3edeb8f3cd48c195948410874a873f3068tx
- 0d9d2c0288bbd4bcf18ad11e5d42128d935a1b4f50c6f61e1b6451b78d6463d4tx
- 24cd2c33b8318a7479806f1f9d94c2e36428945145e584800a077acc009f65dctx
- 30f2065438ab1497568b93ee16c8ad4dac10aa844872478cc6284c858258c6b2tx
- 49be83110bc7df11570c2d6ff2ed3d8edad61e27f2d2de625ad1fd55abbc70d0tx
- 4e300fbd2914c366ec3e88f7afecfbffd6ea13d3e359058db58c18addf3f3d74tx
- 57da827c0b7581e8b8b77c94770d0a6b28217ffb01b5699dbd807ea2ed8a33e6tx
- 80cc5d1b9cd4c16b82569dba4c513a31f5865f4e7459af9f6bf15aa053aef381tx
- 8f5d9ed1fc94be8c34d487ebd9029810a84ce39cd2d0d5b4644c1b92fa1dbb0dtx
Community
notes from Nostr labelers · never merged with the bands above · not endorsed
Community content is indexed from Nostr and not endorsed by btcintel.
not computed yetNot indexed yet: the community index has not looked at this subject.