malware family

Egregor

unknownentity:malware_familyransomware · 1 source

The threat group behind this malware seems to operate by hacking into companies, stealing sensitive data, and then running Egregor to encrypt all the files. According to the ransom note, if the ransom is not paid by the company within 3 days, and aside from leaking part of the stolen data, they will distribute via mass media where the company's partners and clients will know that the company was attacked.

Curated · btcintel

claims we make, each with its source and citation · sources may contradict; we show the set, never a score

Facts

id: egregor
kind: malware family
status: unknown
aliases: —
jurisdictions: —
claims naming it: 18 · 0 attributions · 0 relations · 0 events

Identifiers

attack S0554via mitre-attack
misp-galaxy 8bd094a7-103f-465f-8640-18dcc53042e5via misp-galaxy-ransomware

Relations

computedno relations recorded for this entity

Events

computedno dated events recorded for this entity

Claims naming this entitynewest first · 18 of 18

Egregorransomwarepayment
subjecttransaction6195dbe29f…d9352aa80b
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 112yZpAs3Va6az6JTKZ7iQZEAWdvD5DYoj · 521,700,000 sat · time 2020-12-07 18:59 UTC · url https://ransomwhe.re/#address/112yZpAs3Va6az6JTKZ7iQZEAWdvD5DYoj
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_3064btcintel:annotations:3064@v3 sha256:6feba457ace8b3b9
confidencetrusted provider · 50
Egregorransomwarepayment address
subjectaddress112yZpAs3Va6az6JTKZ7iQZEAWdvD5DYoj
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Egregor · url https://ransomwhe.re/#address/112yZpAs3Va6az6JTKZ7iQZEAWdvD5DYoj
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_3063btcintel:annotations:3063@v2 sha256:6f6268a710d37c01
confidencetrusted provider · 50
Egregorransomwarepayment
subjecttransactionf9961be7e6…18a788c663
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1Mk96FcixjayGZgdPgo4GrnPPSn7rL1jpE · 2,802,300,000 sat · time 2020-11-28 21:01 UTC · url https://ransomwhe.re/#address/1Mk96FcixjayGZgdPgo4GrnPPSn7rL1jpE
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_2499btcintel:annotations:2499@v3 sha256:1562440c775796b6
confidencetrusted provider · 50
Egregorransomwarepayment address
subjectaddress1Mk96FcixjayGZgdPgo4GrnPPSn7rL1jpE
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Egregor · url https://ransomwhe.re/#address/1Mk96FcixjayGZgdPgo4GrnPPSn7rL1jpE
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_2498btcintel:annotations:2498@v2 sha256:1d934af520fc43b7
confidencetrusted provider · 50
Egregorransomwarepayment
subjecttransaction0f0e6aedda…f2989c2ef8
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1GJ4dp5vwK2E9PZ4eF7FVujJiTHERDTFJX · 6,190,752,563 sat · time 2020-10-23 21:58 UTC · url https://ransomwhe.re/#address/1GJ4dp5vwK2E9PZ4eF7FVujJiTHERDTFJX
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_2497btcintel:annotations:2497@v3 sha256:22a9ca3522306a50
confidencetrusted provider · 50
Egregorransomwarepayment address
subjectaddress1GJ4dp5vwK2E9PZ4eF7FVujJiTHERDTFJX
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Egregor · url https://ransomwhe.re/#address/1GJ4dp5vwK2E9PZ4eF7FVujJiTHERDTFJX
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_2496btcintel:annotations:2496@v2 sha256:89ba72473f2c62b1
confidencetrusted provider · 50
Egregorransomwarepayment
subjecttransaction5cb7fad138…22fbb92ae0
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1LdrbQEAersWLi6A83JrCzERyXEZWD4hBP · 2,186,270,223 sat · time 2020-11-08 01:15 UTC · url https://ransomwhe.re/#address/1LdrbQEAersWLi6A83JrCzERyXEZWD4hBP
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_2485btcintel:annotations:2485@v3 sha256:e96e14f6ec1c1698
confidencetrusted provider · 50
Egregorransomwarepayment address
subjectaddress1LdrbQEAersWLi6A83JrCzERyXEZWD4hBP
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Egregor · url https://ransomwhe.re/#address/1LdrbQEAersWLi6A83JrCzERyXEZWD4hBP
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_2484btcintel:annotations:2484@v2 sha256:82f9afccad8d0b84
confidencetrusted provider · 50
Egregorransomwarepayment
subjecttransactionbca2ed5791…861333a028
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1D2ZiHwE4pQb8X6NNcXdfHwncHa3yrDdYr · 2,026,068,751 sat · time 2020-11-08 01:12 UTC · url https://ransomwhe.re/#address/1D2ZiHwE4pQb8X6NNcXdfHwncHa3yrDdYr
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_2482btcintel:annotations:2482@v3 sha256:3847d38ea548a36e
confidencetrusted provider · 50
Egregorransomwarepayment address
subjectaddress1D2ZiHwE4pQb8X6NNcXdfHwncHa3yrDdYr
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Egregor · url https://ransomwhe.re/#address/1D2ZiHwE4pQb8X6NNcXdfHwncHa3yrDdYr
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_2481btcintel:annotations:2481@v2 sha256:33d46895c0610ae6
confidencetrusted provider · 50
Egregorransomwarepayment
subjecttransactionbe5bab8dc2…0d6431f9c8
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1MPdDiRhWFawgN2GVi1Jamm8DdC4qypoGL · 1,555,000,000 sat · time 2020-11-30 22:33 UTC · url https://ransomwhe.re/#address/1MPdDiRhWFawgN2GVi1Jamm8DdC4qypoGL
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_2466btcintel:annotations:2466@v3 sha256:06a4f7d5af398ca8
confidencetrusted provider · 50
Egregorransomwarepayment address
subjectaddress1MPdDiRhWFawgN2GVi1Jamm8DdC4qypoGL
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Egregor · url https://ransomwhe.re/#address/1MPdDiRhWFawgN2GVi1Jamm8DdC4qypoGL
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_2465btcintel:annotations:2465@v2 sha256:3a4e4ba4ef3468fb
confidencetrusted provider · 50
Egregorransomwarepayment
subjecttransaction381247ff52…d389c52273
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1GZV41rSAHAj63pNjLCBwo7rfioxU8JPE9 · 1,681,520,094 sat · time 2020-11-18 16:58 UTC · url https://ransomwhe.re/#address/1GZV41rSAHAj63pNjLCBwo7rfioxU8JPE9
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_2450btcintel:annotations:2450@v3 sha256:d8b5cb4740c2c062
confidencetrusted provider · 50
Egregorransomwarepayment address
subjectaddress1GZV41rSAHAj63pNjLCBwo7rfioxU8JPE9
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Egregor · url https://ransomwhe.re/#address/1GZV41rSAHAj63pNjLCBwo7rfioxU8JPE9
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_2449btcintel:annotations:2449@v2 sha256:7bb281f68f78c578
confidencetrusted provider · 50
Egregorransomwarepayment
subjecttransaction7114530ef4…2e4f3121ee
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1PDSGRqkBF7yEJhTNDaxNm6UQT63rrzTGk · 733,379,781 sat · time 2020-10-30 21:02 UTC · url https://ransomwhe.re/#address/1PDSGRqkBF7yEJhTNDaxNm6UQT63rrzTGk
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_2443btcintel:annotations:2443@v3 sha256:bf2a2e91d131b958
confidencetrusted provider · 50
Egregorransomwarepayment address
subjectaddress1PDSGRqkBF7yEJhTNDaxNm6UQT63rrzTGk
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Egregor · url https://ransomwhe.re/#address/1PDSGRqkBF7yEJhTNDaxNm6UQT63rrzTGk
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_2442btcintel:annotations:2442@v2 sha256:f3e712c13eeb5a65
confidencetrusted provider · 50
Egregorransomwarepayment
subjecttransaction5b78370e02…75a8426e72
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 13ELQVGgkM79nW34ncBe7Jz7xhXsXmRruM · 2,098,547,805 sat · time 2020-11-19 23:21 UTC · url https://ransomwhe.re/#address/13ELQVGgkM79nW34ncBe7Jz7xhXsXmRruM
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_2436btcintel:annotations:2436@v3 sha256:9886746690717602
confidencetrusted provider · 50
Egregorransomwarepayment address
subjectaddress13ELQVGgkM79nW34ncBe7Jz7xhXsXmRruM
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Egregor · url https://ransomwhe.re/#address/13ELQVGgkM79nW34ncBe7Jz7xhXsXmRruM
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_2435btcintel:annotations:2435@v2 sha256:8072116b41951c85
confidencetrusted provider · 50

Subjects18 subjects carry a claim naming this entity · a sample

112yZpAs3Va6az6JTKZ7iQZEAWdvD5DYojaddress
13ELQVGgkM79nW34ncBe7Jz7xhXsXmRruMaddress
1D2ZiHwE4pQb8X6NNcXdfHwncHa3yrDdYraddress
1GJ4dp5vwK2E9PZ4eF7FVujJiTHERDTFJXaddress
1GZV41rSAHAj63pNjLCBwo7rfioxU8JPE9address
1LdrbQEAersWLi6A83JrCzERyXEZWD4hBPaddress
1Mk96FcixjayGZgdPgo4GrnPPSn7rL1jpEaddress
1MPdDiRhWFawgN2GVi1Jamm8DdC4qypoGLaddress
1PDSGRqkBF7yEJhTNDaxNm6UQT63rrzTGkaddress
0f0e6aedda37a46255ec6f6eceabd046b3e39b48b3741bf1087681f2989c2ef8tx

Community

notes from Nostr labelers · never merged with the bands above · not endorsed

Community content is indexed from Nostr and not endorsed by btcintel.

not computed yetNot indexed yet: the community index has not looked at this subject.