Egregor

MITRE ATT&CK: S0554 View on attack.mitre.org

Aliases: Egregor

First seen
2020-09-01 00:00:00
Malware type
ransomware
Family
Malware family
Operating systems
windows
Related IoCs
10 (10 malicious)
Last IoC activity
2026-08-12 11:12:29
Profile updated
2026-07-07 12:57:16

Targeted industries: financial-services healthcare-and-pharmaceutical manufacturing technology-and-telecommunications media-and-entertainment

Context

Egregor is a Ransomware-as-a-Service (RaaS) tool that was first observed in September 2020. Researchers have noted code similarities between Egregor and Sekhmet ransomware, as well as Maze ransomware.

Recent IoC activity

10 malicious indicators in Maltiverse are attributed to Egregor (S0554). The 10 most recently updated:

TypeIndicatorUpdatedSources
file sample f0a7ea274f0f17cdb4557661eb50d2a572582db9b68b28090440d3f8dcd23f96 2026-08-12 1
file sample d59b69b897485e72f819646efc4e72305d0ef8c9fdc56c72135d430da7f5d9ce 2026-08-12 1
file sample ac78b5caa7b8932cd745b83940437f4caf6de9e88c4e54bd1eedee667a19eba2 2026-08-12 1
file sample 843fabc75ca67f1fc04b2d94cbd0ae00657f10ca440749a8f50735e0245c6d92 2026-08-12 1
file sample 09941830bf4e3b31546f22fd3a9e5b259944adfe106d92c1400d9206e3dc14e2 2026-08-12 1
file sample sub_6675c2048444.bin 2026-08-02 2
file sample sub_2d563dd113a0.bin 2026-07-15 2
file sample 2026-07-14_0a15a276373677f7fd6908ad03bccb1b_amadey_cobalt-strike_coinminer_gl... 2026-07-14 1
file sample 0fafc1219d1b2ae1485ecc10809c59c655782b48895c7fa72148acf831c20749 2026-03-09 1
file sample 2026-03-05_e74179bf523575403af96ff82ed59ad7_amadey_cobalt-strike_elex_luca-st... 2026-03-05 1

Detection coverage

  • 4 YARA rules
  • 761 Sigma rules

Malware & tools used

  • Time Based Checks (attack-pattern)
  • Rundll32 (attack-pattern)
  • BITS Jobs (attack-pattern)
  • System Time Discovery (attack-pattern)
  • Software Packing (attack-pattern)
  • Data from Network Shared Drive (attack-pattern)
  • Native API (attack-pattern)
  • Deobfuscate/Decode Files or Information (attack-pattern)
  • Masquerade Task or Service (attack-pattern)
  • System Network Connections Discovery (attack-pattern)
  • System Owner/User Discovery (attack-pattern)
  • Ingress Tool Transfer (attack-pattern)
  • Disable or Modify Tools (attack-pattern)
  • Virtualization/Sandbox Evasion (attack-pattern)
  • DLL (attack-pattern)
  • Data Encrypted for Impact (attack-pattern)
  • Domain Groups (attack-pattern)
  • Regsvr32 (attack-pattern)
  • Web Protocols (attack-pattern)
  • Remote Access Tools (attack-pattern)
  • Windows Command Shell (attack-pattern)
  • Group Policy Modification (attack-pattern)
  • Process Injection (attack-pattern)
  • PowerShell (attack-pattern)
  • System Information Discovery (attack-pattern)

Used by threat actors

Detection rules

  • TRELLIX_ARC_Ransom_Egregor (yara-rule)
  • ARKBIRD_SOLG_Ran_Egregor_Sept_2020_1 (yara-rule)
  • ARKBIRD_SOLG_Ran_Egregor_Oct_2020_1 (yara-rule)
  • DITEKSHEN_MALWARE_Win_Egregor (yara-rule)

Related threat objects

Reports & references

  • analyst1.com — Ransom Mafia Analysis Of The World%E2%80%99S First Ransomware Cartel (report)
  • CrowdStrike — Report2021Gtr (report)
  • analyst1.com — Ransom Mafia Analysis Of The Worlds First Ransomware Cartel (report)
  • proofpoint.com — First Step Initial Access Leads Ransomware (report)
  • CrowdStrike — Prophet Spider Exploits Oracle Weblogic To Facilitate Ransomware Activity (report)
  • domaintools.com — The Most Prolific Ransomware Families A Defenders Guide (report)
  • Cisco Talos — Ctir Trends Winter 2020 21 (report)
  • cisoclub.ru — Otchet Kompanii Group Ib Ransomware Uncovered 2020 2021 (report)
  • docs.google.com — 1Mi8Z2Tbhmqq5X8Wf Ozv3Dvjz5Sjos 3 (report)
  • ke-la.com — Zooming Into Darknet Threats Targeting Jp Orgs Kela (report)
  • krebsonsecurity.com — Ransomware Gangs And The Name Game Distraction (report)
  • news.sophos.com — The Ransomware Threat Intelligence Center (report)
  • public.intel471.com — Ransomware As A Service 2020 Ryuk Maze Revil Egregor Doppelpaymer (report)
  • Broadcom/Symantec — The Ransomware Threat September 2021 (report)
  • therecord.media — Ransomwhere Project Wants To Create A Database Of Past Ransomware Payments (report)
  • web.archive.org — Otchet Kompanii Group Ib Ransomware Uncovered 2020 2021 (report)
  • accenture.com — Evolving Danger Ransomware Extortion (report)
  • bleepingcomputer.com — Darkside Ransomware Made 90 Million In Just Nine Months (report)
  • cert.ssi.gouv.fr — Certfr 2021 Cti 009 (report)
  • cert.ssi.gouv.fr — Certfr 2021 Cti 009 (report)
  • coveware.com — Ransomware Attack Vectors Shift As New Software Vulnerability Exploits Abound (report)
  • cronup.com — De Ataque Con Malware A Incidente De Ransomware (report)
  • huntandhackett.com — Advanced Ip Scanner The Preferred Scanner In The Apt Toolbox (report)
  • blog.chainalysis.com — Ransomware Connections Maze Egregor Suncrypt Doppelpaymer (report)
  • zdnet.com — The Malware That Usually Installs Ransomware And You Need To Remove Right Away (report)

External references