Doppelpaymer
Doppelpaymer is a ransomware family that encrypts user data and later on it asks for a ransom in order to restore original files. It is recognizable by its trademark file extension added to encrypted files: .doppeled. It also creates a note file named: ".how2decrypt.txt".
Victims
25
First Discovered
2019-05-25
victim
Last Discovered
2021-04-10
victim
Inactive Since
5yrs
more than
Avg Delay
N/A
attack→claim
Infostealer
66.7%
victims with domain
Countries
5
hit
Known Locations (1)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | |
|---|---|---|---|---|---|---|---|
|
Start-maximized.com | No | 2026-04-28T07:23:39 |
hpoo4dosa3x4ognfxpqcrjwnsigvslm7kv6hvmhh2yqczaxy3j6qnwad.onion
|
Target
Top 5 Activity Sectors
- Manufacturing 9
- Public Sector 9
- Technology 2
- Education 2
- Transportation/Logistics 1
Top 5 Countries
-
United States
15
-
France
4
-
Mexico
1
-
Canada
1
-
Chile
1
Heatmap
Ransom Notes (4)
YARA Rules (1)
Indicators of Compromise (IoCs) (4)
Email
4
| Type | IOC |
|---|---|
Email
|
btpsupport@protonmail.com
|
Email
|
kobieboho@protonmail.com
|
Email
|
reltypade1977@protonmail.com
|
Email
|
smutnykobimtochukwu@protonmail.com
|
Victims (25)
No description available
