Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us

Ransom Note: dagonlocker.html

Group: Dagonlocker 
<!DOCTYPE html lang="en">
   <head>
      <meta charset="utf-8">
      <meta name="viewport" content="width=device-width, initial-scale=1.0, shrink-to-fit=no">
      <title>Pwned by DAGON Locker</title>
      <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAYAAACqaXHeAAABhWlDQ1BJQ0MgcHJvZmlsZQAAKJF9kT1Iw0AcxV/TSkUqohYRcQhSnSyIijhKFYtgobQVWnUwufQLmjQkKS6OgmvBwY/FqoOLs64OroIg+AHi6OSk6CIl/i8ptIj14Lgf7+497t4BQq3EVNM3AaiaZSSiETGdWRX9r/ChDwPoxYjETD2WXEyh7fi6h4evd2Ge1f7cn6NbyZoM8IjEc0w3LOIN4plNS+e8TxxkBUkhPiceN+iCxI9cl11+45x3WOCZQSOVmCcOEov5FpZbmBUMlXiaOKSoGuULaZcVzluc1VKFNe7JXxjIaitJrtMcRhRLiCEOETIqKKIEC2FaNVJMJGg/0sY/5Pjj5JLJVQQjxwLKUCE5fvA/+N2tmZuadJMCEaDjxbY/RgH/LlCv2vb3sW3XTwDvM3ClNf3lGjD7SXq1qYWOgJ5t4OK6qcl7wOUOMPikS4bkSF6aQi4HvJ/RN2WA/luga83trbGP0wcgRV0t3wAHh8BYnrLX27y7s7W3f880+vsBfKdyq3K9C9gAAAAGYktHRAD/AP8A/6C9p5MAAAAJcEhZcwAACxIAAAsSAdLdfvwAAAAHdElNRQfmBBMTMSax1ZPoAAAAGXRFWHRDb21tZW50AENyZWF0ZWQgd2l0aCBHSU1QV4EOFwAABXpJREFUeNrtm0toFFkUhr9bVd1d3WljlFF0nMmMQZCABGYwGElEF1m4iCASshLdJBJBF+4EcSESXLhzoRvDKIpk484EceMbgruAo6KDjBCSIYkRTb/qeWdRSfphxH5UrE46B2pT3XXqnv+ce151rvgXJBWQEo+DEKxU0uwKGYhMBhGPg+uuSACUShlI2wbLWrEWoPjBxE2nV+w28AUAXBdpmisSBMUvRjKTqW0AkBKZTK44EBQ/mUnLAilrFwAAmUh83wqk/PoKKg/wHQDXBdtGaFq+YI6DtG1cw0AAuRDJ+UsoCkLXEar6w7aSthxMZTKJWL/e8wu2jZtOo3Z2Et23j/q9ewnv3Im2desiSM7sLNaHDySfPiXx7h3W1asIVUXRdVDVZQVA/FNhKvxNCoXAsggdOcKmc+fQW1o8gYsIqa5lMTMwwNydO4jxcUQ4vGwWsSwASMBtamLb7dvEWluLE3wJcubmmOjpwXzwACUWA0WpfgBcQG1upvHRI7TNm5d0gPbEBKknT7CnpxG6jt7cTLS93dNygaalbTN7/TqfTp1CjUZ9B8FXACSgtrXx++PHntnmkPX+PTMjI6TOnvV8BHjCzjtKCYR7e9lw6BDrurryBZWSL8+fM7V/P2pdna/bwTcAJCBbWmh6+BB148bsfcNg+sYNvvT3o4TD2f1cKISUYNs46TSh9na23rpFePv2vCgyNTDA3IULXglebQA4wC+jo8T27Mne+/iR8ePHse7fR43FitacNAwcw2BbAT9pWbw/eBAxOlq2X1mWREgCkb4+Yq2teYudOH8ec3gY4bolma2IRNBiMSba2si8fJm9Hwrx88AAMpWqsnIY2HT0aN6+/XjzJulr17wXSFl6saRpKLrOZE9PXrNF370btbMTbLt6AFC3bCHW0ZHVvuPwqa+P3BRGmmbJXSMRDuO8fs2noaHsPU0jduAArk9NGMUX8z92LE+7X4aGlnQsbhnVohqNkhgezkur13d1eYVXtViA1tSUFUxKkq9eLc3YdUvvHaoq1t27eQBEWlp8i93+ZBW5WpUSe2rq2/4ikSiZtzQMz3py3iGqCoDCxohpfv/3UpOZgv+Lhdyh6gAotn1W4eJl1VpAsaEzlaqK9llgAGDbXvMkYBCUQN+e69hWEwDF5unSdZGGUZQVFPL0y24qqijkfBqcvneP/yYnvb4eYI6N4Ra7yEwGtYikZvry5UXHp6iqV31mMohIpKIeQdnVoARiZ87Q0N/v7eVC7RShVSuZxNI0hJTI7/xfOk42cgiB0DTct29JdHcj6ut/PAAOsO3FC+pyKsBSyZiZwZhvnpa8cIBwmBkhIB4v2woqK6orjeW2jTRNhOOU/qwQCB8iSLBRoApoDYA1ANYAWAMgMBK6jtB10LTAagItKOFnR0ZIT0wgGhqo+/MPlF8bfSmTqx8A12X8xAlSg4OL5pcCNr3+G/FbE1jm6t4Cxps3JAcHUeezuQXDnx38CxEJr34fYE9OflUkCUB+/hzIsOUPByDa0YFobMwrQFwgumtXbUQBJRJh+9gYyo4dXkmradRfuUL85EnPCdZCGNQaGvjp0iVcIHT4MPHTp8v6crSi8wCZMxcgpQxs2Dr4TDDgucK1VLgaNC9qFQAJYFm4AU6LBlYL1Hd3E5mexoxGAz1wERgAQlW9cwaKAoZRo06wnHmBtSiwBsD8HhK+RBDNj0WU/fh8R0iU82FECMTCx5AKPo2VDYAKTPX2suHiRW8OsFQhhMBJJjFzxmVLW7mG8+wZFqAunE8oRwmVToouHHYo2wr8eFZRUNatKwvIisOgCDiTW4gm0jS9OeQSQVg1UUCm02VZwKoKg+XMHa2uPMC2a3cLLFpBMcf2cuh/hJA8cuvOr0QAAAAASUVORK5CYII=">
      <link rel="stylesheet" href="https://bootstrapstudio.io/demo//embed//bootstrap/5/default/bootstrap.min.css">
   </head>
   <body>
      <div class="container py-4 py-xl-5">
         <div class="row mb-5">
            <div class="col-md-8 col-xl-6 text-center mx-auto">
               <section class="py-4 py-xl-5">
                  <div class="container">
                     <div class="text-white bg-dark border rounded border-0 p-4 p-md-5">
                        <h2 class="fw-bold text-white mb-3"><span style="color: rgb(255, 0, 0);">Pwned</span><br></h2>
                        <h2 class="fw-bold text-white mb-3"><span style="color: rgb(255, 0, 0);">by DAGON LOCKER</span></h2>
                     </div>
                  </div>
               </section>
            </div>
         </div>
         <div class="row gy-4 row-cols-1 row-cols-md-2 row-cols-xl-3">
            <div class="col">
               <div class="p-4">
                  <span class="badge rounded-pill bg-primary mb-2"></span>
                  <h4>What happened?</h4>
                  <p>All your data is encrypted on all IT systems.<br></p>
                  <p>Your data including financial, customer, partner contracts and employees has been exfiltrated to our internal servers.<br></p>
               </div>
            </div>
            <div class="col">
               <div class="p-4">
                  <span class="badge rounded-pill bg-primary mb-2"></span>
                  <h4>What's next?</h4>
                  <p>You either get in touch with us or get famouse as a company with a large data leak.<br></p>
               </div>
            </div>
            <div class="col">
               <div class="p-4">
                  <span class="badge rounded-pill bg-primary mb-2"></span>
                  <h4>How do I recover?</h4>
                  <p>There is no way to decrypt your files manually unless we provide a special decryption tool.<br></p>
                  <p>Get your copy of <a href="https://www.torproject.org"><span style="color: rgb(255, 0, 0);">Tor browser</span></a> and <a href="http://dgnh6p5uq234zry7qx7bh73hj5ht3jqisgfet6s7j7uyas5i46xfdkyd.onion/?cid=[snip]"><span style="color: rgb(255, 0, 0);">CONTACT US</span></a><br></p>
               </div>
            </div>
         </div>
      </div>
   </body>
</html>
Indicators of Compromise
Type IOC
onion url http://dgnh6p5uq234zry7qx7bh73hj5ht3jqisgfet6s7j7uyas5i46xfdkyd.onion/?cid=[snip]"><span
session id LlCv2vb3sW3XTwDvM3ClNf3lGjD7SXq1qYWOgJ5t4OK6qcl7wOUOMPikS4bkSF6aQi4HvJ
session id 7X4aGlnQsbhnVohqNkhgezkur13d1eYVXtViA1tSUFUxKkq9eLc3YdUvvHaoq1t27eQBEWlp8i93
session id wZFqAunE8oRwmVToouHHYo2wr8eFZRUNatKwvIisOgCDiTW4gm0jS9OeQSQVg1UUCm02VZwKoKg