malware family
RIP (Phoenix) Ransomware
unknownentity:malware_familyransomware · 1 source
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Based on HiddenTear
Curated · btcintel
claims we make, each with its source and citation · sources may contradict; we show the set, never a score
Facts
- id
- rip-phoenix-ransomware
- kind
- malware family
- status
- unknown
- aliases
- Phoenix · RIP
- jurisdictions
- —
- claims naming it
- 2 · 0 attributions · 0 relations · 0 events
Identifiers
- misp-galaxy 5705df4a-42b0-4579-ad9f-8bfa42bae471via misp-galaxy-ransomware
Relations
computedno relations recorded for this entity
Events
computedno dated events recorded for this entity
Claims naming this entitynewest first · 2 of 2
- PhoenixransomwarepaymentsourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0evidencepayment 1KdiPSdmqn7BsQFs9kqXdRqygruQeGzCx · 256,772 sat · time 2016-12-14 11:10 UTC · url https://ransomwhe.re/#address/1KdiPSdmqn7BsQFs9kqXdRqygruQeGzCxfetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3ann_21563btcintel:annotations:21563@v3 sha256:a2ab1d0c32ccbe0cconfidencetrusted provider · 50
- Phoenixransomwarepayment addresssourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0evidencefamily raw Phoenix · url https://ransomwhe.re/#address/1KdiPSdmqn7BsQFs9kqXdRqygruQeGzCxfetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2ann_21562btcintel:annotations:21562@v2 sha256:bbe4b7382f118488confidencetrusted provider · 50
Subjects2 subjects carry a claim naming this entity · a sample
Community
notes from Nostr labelers · never merged with the bands above · not endorsed
Community content is indexed from Nostr and not endorsed by btcintel.
not computed yetNot indexed yet: the community index has not looked at this subject.