malware family
NotPetya
[NotPetya](https://attack.mitre.org/software/S0368) is malware that was used by [Sandworm Team](https://attack.mitre.org/groups/G0034) in a worldwide attack starting on June 27, 2017. While [NotPetya](https://attack.mitre.org/software/S0368) appears as a form of ransomware, its main purpose was to destroy data and disk structures on compromised systems; the attackers never intended to make the encrypted data recoverable. As such, [NotPetya](https://attack.mitre.org/software/S0368) may be more ap
Curated · btcintel
claims we make, each with its source and citation · sources may contradict; we show the set, never a score
Facts
- id
- notpetya
- kind
- malware family
- status
- unknown
- aliases
- Diskcoder.C · ExPetr · GoldenEye · Nyetya · Petrwrap
- jurisdictions
- —
- claims naming it
- 125 · 0 attributions · 1 relations · 0 events
Identifiers
- attack S0368via mitre-attack
Relations
- fetch —sha256 dc1639caa5501d72rel_184btcintel:relations:184@v1 sha256:db5fef477e708cfeconfidenceauthority data · 60
Events
computedno dated events recorded for this entity
Claims naming this entitynewest first · 20 of 125
- NotPetyaransomwarepaymentsourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0evidencepayment 13KBb1G7pkqcJcxpRHg387roBj2NX7Ufyf · 10,000,000 sat · time 2017-06-26 21:16 UTC · url https://ransomwhe.re/#address/13KBb1G7pkqcJcxpRHg387roBj2NX7Ufyffetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3ann_24920btcintel:annotations:24920@v3 sha256:cc7eb2296e04342fconfidencetrusted provider · 50
- NotPetyaransomwarepaymentsourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0evidencepayment 13KBb1G7pkqcJcxpRHg387roBj2NX7Ufyf · 10,000,000 sat · time 2017-06-26 21:16 UTC · url https://ransomwhe.re/#address/13KBb1G7pkqcJcxpRHg387roBj2NX7Ufyffetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3ann_24919btcintel:annotations:24919@v3 sha256:94969089ddab1b04confidencetrusted provider · 50
- NotPetyaransomwarepaymentsourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0evidencepayment 13KBb1G7pkqcJcxpRHg387roBj2NX7Ufyf · 10,000,000 sat · time 2017-06-26 21:16 UTC · url https://ransomwhe.re/#address/13KBb1G7pkqcJcxpRHg387roBj2NX7Ufyffetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3ann_24918btcintel:annotations:24918@v3 sha256:987dbd8e2cb925b9confidencetrusted provider · 50
- NotPetyaransomwarepaymentsourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0evidencepayment 13KBb1G7pkqcJcxpRHg387roBj2NX7Ufyf · 11,000,000 sat · time 2017-06-26 21:28 UTC · url https://ransomwhe.re/#address/13KBb1G7pkqcJcxpRHg387roBj2NX7Ufyffetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3ann_24917btcintel:annotations:24917@v3 sha256:95a397071623d46econfidencetrusted provider · 50
- NotPetyaransomwarepaymentsourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0evidencepayment 13KBb1G7pkqcJcxpRHg387roBj2NX7Ufyf · 10,000,000 sat · time 2017-06-28 18:10 UTC · url https://ransomwhe.re/#address/13KBb1G7pkqcJcxpRHg387roBj2NX7Ufyffetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3ann_24916btcintel:annotations:24916@v3 sha256:192db60a857bd6c6confidencetrusted provider · 50
- NotPetyaransomwarepaymentsourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0evidencepayment 13KBb1G7pkqcJcxpRHg387roBj2NX7Ufyf · 50,000 sat · time 2017-06-29 13:15 UTC · url https://ransomwhe.re/#address/13KBb1G7pkqcJcxpRHg387roBj2NX7Ufyffetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3ann_24915btcintel:annotations:24915@v3 sha256:14ae864d24e0e831confidencetrusted provider · 50
- NotPetyaransomwarepayment addresssourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0evidencefamily raw NotPetya · url https://ransomwhe.re/#address/13KBb1G7pkqcJcxpRHg387roBj2NX7Ufyffetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2ann_24914btcintel:annotations:24914@v2 sha256:a0fc06d214181362confidencetrusted provider · 50
- NotPetyaransomwarepaymentsourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0evidenceamount sat 792,597,510 sat · payment 1Ftixp78FjTWFi3ssJjBw5NqKf5ZPQjXBb · 396,298,755 sat · payment 1Ftixp78FjTWFi3ssJjBw5NqKf5ZPQjXBb · 396,298,755 sat · time 2017-07-04 22:19 UTC · url https://ransomwhe.re/#address/1Ftixp78FjTWFi3ssJjBw5NqKf5ZPQjXBbfetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3ann_24842btcintel:annotations:24842@v3 sha256:f79aab7d01240b42confidencetrusted provider · 50
- NotPetyaransomwarepayment addresssourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0evidencefamily raw NotPetya · url https://ransomwhe.re/#address/1Ftixp78FjTWFi3ssJjBw5NqKf5ZPQjXBbfetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2ann_24841btcintel:annotations:24841@v2 sha256:f3ac94ce7561a1feconfidencetrusted provider · 50
- NotPetyaransomwarepaymentsourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0evidencepayment 1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWX · 12,140,000 sat · time 2017-06-27 13:27 UTC · url https://ransomwhe.re/#address/1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWXfetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3ann_21138btcintel:annotations:21138@v3 sha256:00eb7977a0428f56confidencetrusted provider · 50
- NotPetyaransomwarepaymentsourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0evidencepayment 1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWX · 13,000,000 sat · time 2017-06-27 13:27 UTC · url https://ransomwhe.re/#address/1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWXfetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3ann_21137btcintel:annotations:21137@v3 sha256:90096ba0e1ab15caconfidencetrusted provider · 50
- NotPetyaransomwarepaymentsourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0evidencepayment 1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWX · 12,001,000 sat · time 2017-06-27 13:41 UTC · url https://ransomwhe.re/#address/1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWXfetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3ann_21136btcintel:annotations:21136@v3 sha256:5582d6965b822b70confidencetrusted provider · 50
- NotPetyaransomwarepaymentsourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0evidencepayment 1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWX · 12,600,000 sat · time 2017-06-27 14:10 UTC · url https://ransomwhe.re/#address/1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWXfetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3ann_21135btcintel:annotations:21135@v3 sha256:f12e064926297dfcconfidencetrusted provider · 50
- NotPetyaransomwarepaymentsourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0evidencepayment 1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWX · 12,856,744 sat · time 2017-06-27 14:24 UTC · url https://ransomwhe.re/#address/1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWXfetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3ann_21134btcintel:annotations:21134@v3 sha256:2223c0edd89550e6confidencetrusted provider · 50
- NotPetyaransomwarepaymentsourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0evidencepayment 1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWX · 12,869,700 sat · time 2017-06-27 14:34 UTC · url https://ransomwhe.re/#address/1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWXfetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3ann_21133btcintel:annotations:21133@v3 sha256:81f496d39d994acaconfidencetrusted provider · 50
- NotPetyaransomwarepaymentsourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0evidencepayment 1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWX · 12,805,000 sat · time 2017-06-27 15:41 UTC · url https://ransomwhe.re/#address/1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWXfetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3ann_21132btcintel:annotations:21132@v3 sha256:d7179a46f12d79dbconfidencetrusted provider · 50
- NotPetyaransomwarepaymentsourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0evidencepayment 1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWX · 12,001,800 sat · time 2017-06-27 16:05 UTC · url https://ransomwhe.re/#address/1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWXfetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3ann_21131btcintel:annotations:21131@v3 sha256:dc41869575f909e7confidencetrusted provider · 50
- NotPetyaransomwarepaymentsourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0evidencepayment 1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWX · 12,409,500 sat · time 2017-06-27 16:05 UTC · url https://ransomwhe.re/#address/1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWXfetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3ann_21130btcintel:annotations:21130@v3 sha256:f61ea9fe141b3e24confidencetrusted provider · 50
- NotPetyaransomwarepaymentsourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0evidencepayment 1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWX · 6,660 sat · time 2017-06-27 16:06 UTC · url https://ransomwhe.re/#address/1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWXfetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3ann_21129btcintel:annotations:21129@v3 sha256:1876a1fbdc5f85deconfidencetrusted provider · 50
- NotPetyaransomwarepaymentsourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0evidencepayment 1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWX · 12,830,125 sat · time 2017-06-27 16:06 UTC · url https://ransomwhe.re/#address/1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWXfetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3ann_21128btcintel:annotations:21128@v3 sha256:feebed8dce13053bconfidencetrusted provider · 50
Subjects125 subjects carry a claim naming this entity · a sample
- 13KBb1G7pkqcJcxpRHg387roBj2NX7Ufyfaddress
- 1Ftixp78FjTWFi3ssJjBw5NqKf5ZPQjXBbaddress
- 1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWXaddress
- 00721247de858a0abeae18430a50a0c15b2607b1e25192770a22e48fa330ec47tx
- 015e102c4266b8ec8cac8d3a5fb115ce8211b6b6760fb6ff4cdee7c8f81ab339tx
- 02a914c33575fbce1d5dcd0c401aa128233496dce01d67ae1e2b1d2561fa3868tx
- 048ec89fe366d87b850180a35c4fe144d2e467dbca5a4329877f8be06109ec11tx
- 094fbe5b3ab797534aafb707d213f7d14881ab9aba8ae2148867fac319817bd0tx
- 0b5ee3e14da0e43d1f8228101029b6a598bb76b1ae0e90cb02fff97923ef80fbtx
- 0d850d533d0dc54cbd5e8a227ce344e82208721392cb2379ab9a1e40b07c3725tx
Community
notes from Nostr labelers · never merged with the bands above · not endorsed
Community content is indexed from Nostr and not endorsed by btcintel.
not computed yetNot indexed yet: the community index has not looked at this subject.