Public IOC feed / Ransomware

Ransomware

Ransomware samples, leak sites, negotiation portals and payment wallets.

57 high-confidence indicators from the last 30 days of security reporting. Free, refreshed hourly, no login, CC-BY.

Files

• feed.json everything, with reasons and sources
• domains.txt 3 domains, one per line
• domains.csv with metadata
• ips.txt 1 IPs, one per line
• ips.csv with metadata
• hashes.txt 53 hashes, one per line
• hashes.csv with metadata
• RSS new indicators

With an API key: /api/public/v1/iocs/feed?category=ransomware. API reference

Newest indicators

Showing 57 of 57.

• 1f6640102f6472523830d69630def669dc3433bbb1c0e6183458bd792d420f8e sha256, 4 Nov

  Listed as a ransomware sample hash in a threat report Source

• 232f86e26ced211630957baffcd36dd3bcd6a786f3d307127e1ea9a8b31c199f sha256, 4 Nov

  Listed as a ransomware sample hash in a threat report Source

• 28f3de066878cb710fe5d44f7e11f65f25328beff953e00587ffeb5ac4b2faa8 sha256, 4 Nov

  Listed as a ransomware sample hash in a threat report Source

• a8c28bd6f0f1fe6a9b880400853fc86e46d87b69565ef15d8ab757979cd2cc73 sha256, 4 Nov

  Listed as a ransomware sample hash in a threat report Source

• b5e811d7c104ce8dd2509f809a80932540a21ada0ee9e22ac61d080dc0bd237d sha256, 4 Nov

  Listed as a ransomware sample hash in a threat report Source

• 307a1217aac33c4b7a9cd923162439c19483e952c2ceb15aa82a98b46ff8942e sha256, 3 Nov

  Hash of a ransomware sample used in an attack Source

• 08207409e1d789aea68419b04354184490ce46339be071c6c185c75ab9d08cba sha256, 29 Oct

  Listed as a SHA256 hash for Akira ransomware's Windows variant Source

• 0c0e0f9b09b80d87ebc88e2870907b6cacb4cd7703584baf8f2be1fd9438696d sha256, 6 Oct

  Listed as a SHA256 hash for Akira ransomware's Linux/ESXi variant Source

• 0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df282796c sha256, 6 Oct

  Listed as a SHA256 hash for Akira_v2 Source

• 131da83b521f610819141d5c740313ce46578374abb22ef504a7593955a65f07 sha256, 6 Oct

  Listed as a SHA256 hash for Megazord Source

• 1b6af2fbbc636180dd7bae825486ccc45e42aefbb304d5f83fafca4d637c13cc sha256, 29 Oct

  Listed as a SHA256 hash for Akira ransomware's Windows variant Source

• 1ba1ccfacffbb6be9480380f5535a30d3eee1dd7787f3c649ebf8ea2a6a5de51 sha256, 29 Oct

  Listed as SHA256 hash for Akira ransomware's Windows variant Source

• 1d3b5c650533d13c81e325972a912e3ff8776e36e18bca966dae50735f8ab296 sha256, 29 Oct

  Listed as a SHA256 hash for Akira ransomware's Linux/ESXi variant Source

• 2727c73f3069457e9ad2197b3cda25aec864a2ab8da3c2790264d06e13d45c3d sha256, 29 Oct

  Listed as SHA256 hash for Akira ransomware's Windows variant Source

• 28cea00267fa30fb63e80a3c3b193bd9cd2a3d46dd9ae6cede5f932ac15c7e2e sha256, 29 Oct

  Listed as SHA256 hash for Megazord ransomware Source

• 2db4a15475f382e34875b37d7b27c3935c7567622141bc203fde7fe602bc8643 sha256, 29 Oct

  Listed as SHA256 hash for Akira ransomware's Windows variant Source

• 300bc2769c6d62ba9d228cc45e126cd458e1a23fd23092da258053afd82f2755 sha256, 29 Oct

  Listed as SHA256 hash for Akira ransomware's Linux/ESXi variant Source

• 3298d203c2acb68c474e5fdad8379181890b4403d6491c523c13730129be3f75 sha256, 6 Oct

  Listed as a SHA256 hash for Akira_v2 Source

• 3805f299d33ef43d17a5a1040149f0e5e2d5db57ec6f03c5687ac23db1f77a30 sha256, 29 Oct

  Listed as SHA256 hash for Akira ransomware's Linux/ESXi variant Source

• 3999a25f8f0fd8252aa9250fa9bd70aae202f181812cc6c230c8ea2842340f18 sha256, 29 Oct

  Listed as SHA256 hash for Akira ransomware's Linux/ESXi variant Source

• 3dc7d4023c7380ed740ac5ac7d82a4ba6f587f430b2b7b66f1d34a44f89c39cb sha256, 29 Oct

  Listed as SHA256 hash for Akira ransomware's Linux/ESXi variant Source

• 43c5a487329f5d6b4a6d02e2f8ef62744b850312c5cb87c0a414f3830767be72 sha256, 29 Oct

  Listed as SHA256 hash for Akira ransomware's Linux/ESXi variant Source

• 56f1014eb2d145c957f9bc0843f4e506735d7821e16355bcfbb6150b1b5f39db sha256, 29 Oct

  Listed as SHA256 hash for Akira ransomware's Windows variant Source

• 58e9cd249d947f829a6021cf6ab16c2ca8e83317dbe07a294e2035bb904d0cf3 sha256, 29 Oct

  Listed as SHA256 hash for Akira ransomware's Windows variant Source

• 5f72bdb14e138f10c1658248fdaf10db2fd1e812240966e009bbcf8d463e099c sha256, 29 Oct

  Listed as SHA256 hash for Akira_v2 Source

• 6005dcbe15d60293c556f05e98ed9a46d398a82e5ca4d00c91ebec68a209ea84 sha256, 29 Oct

  Listed as SHA256 hash for Akira ransomware's Linux/ESXi variant Source

• 678ec8734367c7547794a604cc65e74a0f42320d85a6dce20c214e3b4536bb33 sha256, 29 Oct

  Listed as SHA256 hash for Akira ransomware's Windows variant Source

• 67f82a54ea49c6f286681d179cc7afc8b41b6b34284cc17bdd52916cc3656160 sha256, 29 Oct

  Listed as SHA256 hash for Akira_v2 Source

• 68d5944d0419bd123add4e628c985f9cbe5362ee19597773baea565bff1a6f1a sha256, 29 Oct

  Listed as SHA256 hash for Megazord ransomware Source

• 6a5e547756ef1256f1eb9df0249245c35461affd009be8f046559bc007cafcf2 sha256, 29 Oct

  Listed as a SHA256 hash for Akira_v2 Source

• 74f497088b49b745e6377b32ed5d9dfaef3c84c7c0bb50fabf30363ad2e0bfb1 sha256, 29 Oct

  Listed as SHA256 hash for Akira ransomware's Linux/ESXi variant Source

• 7ca3e6b4dd4d98506faa92ab590108cacb2945b8c27dcf1ac75b0df4a206493a sha256, 29 Oct

  Listed as SHA256 hash for Akira ransomware's Linux/ESXi variant Source

• 82e25f32e01f1898ccce2b6d5292245759733c22a104443a8a9c7db1ebf05c57 sha256, 29 Oct

  Listed as SHA256 hash for Akira ransomware's Linux/ESXi variant Source

• 8816caf03438cd45d7559961bf36a26f26464bab7a6339ce655b7fbad68bb439 sha256, 29 Oct

  Listed as SHA256 hash for Megazord ransomware Source

• 8e9a33809b9062c5033928f82e8adacbef6cd7b40e73da9fcf13ec2493b4544c sha256, 29 Oct

  Listed as SHA256 hash for Akira ransomware's Linux/ESXi variant Source

• 9f873c29a38dd265decb6517a2a1f3b5d4f90ccd42eb61039086ea0b5e74827e sha256, 29 Oct

  Listed as SHA256 hash for Akira ransomware's Windows variant Source

• a6b0847cf31ccc3f76538333498f8fef79d444a9d4ecfca0592861cf731ae6cb sha256, 29 Oct

  Listed as SHA256 hash for Megazord ransomware Source

• b55fbe9358dd4b5825ce459e84cd0823ecdf7b64550fe1af968306047b7de5c9 sha256, 29 Oct

  Listed as SHA256 hash for Megazord ransomware Source

• bcae978c17bcddc0bf6419ae978e3471197801c36f73cff2fc88cecbe3d88d1a sha256, 29 Oct

  Listed as SHA256 hash for Akira_v2 Source

• c0c0b2306d31e8962973a22e50b18dfde852c6ddf99baf849e3384ed9f07a0d6 sha256, 29 Oct

  Listed as SHA256 hash for Akira ransomware's Linux/ESXi variant Source

• cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8 sha256, 29 Oct

  Listed as a SHA256 hash for Akira ransomware's Windows variant Source

• e3fa93dad8fb8c3a6d9b35d02ce97c22035b409e0efc9f04372f4c1d6280a481 sha256, 29 Oct

  Listed as SHA256 hash for Akira ransomware's Linux/ESXi variant Source

• e702a572b514984deacaa54408059c6eac28e46111cb6f0f4190a3a6a72dd41d sha256, 29 Oct

  Listed as a SHA256 hash for Akira_v2 Source

• 45.227.254.43 ipv4, 23 Oct

  Identified as an exposed command-and-control server used by the ransomware groups Source

• whitearmor.cc domain, 23 Oct

  Listed as a clearnet domain established by the Whitearmor group Source

• a0dc80a37eb7e2716c02a94adc8df9baedec192a77bde31669faed228d9ff526 sha256, 21 Oct

  SHA256 hash listed as an IOC related to ransomware activity Source

• shinywire.com domain, 19 Oct

  Described as a victim extortion website operated by ShinyHunters. Source

• www.hookphish.com domain, 7 Oct

  Listed as an indicator for ransomware detection Source

• 30a8cf3e6863030c762b468bf48d679f3dd053a80793770443938fa18de89617 sha256, 7 Oct

  Confirmed SHA256 hash of the Termite ransomware sample. Source

• 2f629395fdfa11e713ea8bf11d40f6f240acf2f5fcf9a2ac50b6f7fbc7521c83 sha256, 6 Oct

  Listed in a table of Akira ransomware IOCs Source

• 7f731cc11f8e4d249142e99a44b9da7a48505ce32c4ee4881041beeddb3760be sha256, 6 Oct

  Listed in a table of Akira ransomware IOCs Source

• 95477703e789e6182096a09bc98853e0a70b680a4f19fa2bf86cbb9280e8ec5a sha256, 6 Oct

  Listed in a table of Akira ransomware IOCs Source

• 9585af44c3ff8fd921c713680b0c2b3bbc9d56add848ed62164f7c9b9f23d065 sha256, 6 Oct

  Listed in a table of Akira ransomware IOCs Source

• 9f393516edf6b8e011df6ee991758480c5b99a0efbfd68347786061f0e04426c sha256, 6 Oct

  Listed in a table of Akira ransomware IOCs Source

• c9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b3898b0 sha256, 6 Oct

  Listed in a table of Akira ransomware IOCs Source

• dfe6fddc67bdc93b9947430b966da2877fda094edf3e21e6f0ba98a84bc53198 sha256, 6 Oct

  Listed in a table of Akira ransomware IOCs Source

• ffd9f58e5fe8502249c67cad0123ceeeaa6e9f69b4ec9f9e21511809849eb8fc sha256, 6 Oct

  Listed in a table of Akira ransomware IOCs Source

Think one of these is wrong? Email [email protected].