Exposing the Sonatrach Data Leak and the Data Leak Broker Behind it – An OSINT Analysis
Dear blog readers,
In this analysis I’ll offer and provide an in-depth technical overview of the Internet-connected infrastructure behind the Maze Ransomware Group using public sources including the data leak broker who’s responsible for the Sonatrach Data Leak with the idea to assist the appropriate parties researchers and analysts on their way to properly attribute the leak to the cyber threat actor known as Maze Ransomware Group where the ultimate idea would be to prevent future network intrusions including to actually assist in attempting to take their Internet-connected infrastructure offline.
Although the group has publicly announced that it’s shutting down its operations its Internet-connected infrastructure remains online and operational.
Sample screenshots:
Sample screenshots of the ISPs currently hosting the Maze Ransomware Group’s Internet-connected infrastructure include:
Sample personally identifiable email of the individual involved in the leak:
s0natrach[.]proton.me
Sample URLs for leaked information obtained from the leak:
hxxp://anonfiles[.]com/cbz9z225y4/Le_contr_le_de_gestion_pour_managers_zip
hxxp://easyupload[.]io/rps33q
hxxp://easyupload[.]io/ax8jh3
hxxp://easyupload[.]io/n443ev
hxxp://easyupload[.]io/dw9209
Sample domains known to have been involved in the campaign include:
hxxp://mazedecrypt[.]top
hxxp://mazenews[.]top
hxxp://newsmaze[.]top
hxxp://mazedecrypt[.]top
Related actionable intelligence and C&Cs on the Maze Ransomware Group:
hxxp://mazedecrypt[.]top – 35[.]205[.]61[.]67
Name servers used: ns1[.]csof[.]net
Dark Web Onion: aoacugmutagkwctu[.]onion
Sample Bitcoin Address: 3JGqKRWSsXQsnHWDpHXXNg7TJcubszJher
Related domains:
hxxp://munsys[.]icu
hxxp://deepletelyre[.]club
hxxp://gamsaymin[.]club
hxxp://hersendentp[.]club
hxxp://nistreecongl[.]club
hxxp://cllbguhxggwd[.]club
hxxp://cxwbtywohnimbat[.]biz
hxxp://xbknggwrsigwvqg[.]biz
hxxp://xyrcwgdibytikak[.]biz
hxxp://okxlqotixjlxbst[.]biz
hxxp://mazedecrypt[.]top
hxxp://avoirparticulierserv[.]xyz – 94[.]140[.]114[.]197 – 146[.]0[.]72[.]74
Sample malicious MD5s known to have been involved in the campaign include:
4e22ab46a8d5dc5fea6c41ea6fdc913b793a4e33df8f0bc1868b72b180c0e6e
067f1b8f1e0b2bfe286f5169e17834e8cf7f4266b8d97f28ea78995dc81b0e7b
1161b030293e58d15b6a6a814a61a6432cf2c98ce9d156986157b432f3ebcf78
153defee225de889d2ac66605f391f4aeaa8b867b4093c686941e64d0d245a57
195ef8cfabc2e877ebb1a60a19850c714fb0a477592b0a8d61d88f0f96be5de9
30b72e83d66cbe9e724c8e2b21179aecd4bcf68b2ec7895616807df380afab54
33afa2f1d53d5279b6fc87ce6834193fdd7e16e4b44e895aae4b9da00be0c502
4080402553e9a86e954c1d9b7d0bb059786f52aba4a179a5d00e219500c8f43d
5603a16cbf81d183d3ff4ffea5477af1a4be01321865f0978c0e128051ec0a82
58fe9776f33628fd965d1bcc442ec8dc5bfae0c648dcaec400f6090633484806
5c9b7224ffd2029b6ce7b82ea40d63b9d4e4f502169bc91de88b4ea577f52353
6878f7bd90434ac5a76ac2208a5198ce1a60ae20e8505fc110bd8e42b3657d13
6a22220c0fe5f578da11ce22945b63d93172b75452996defdc2ff48756bde6af
822a264191230f753546407a823c6993e1a83a83a75fa36071a874318893afb8
83f8ce81f71d6f0b1ddc6b4f3add7a5deef8367a29f59b564c9539d6653d1279
877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1
91514e6be3f581a77daa79e2a4905dcbdf6bdcc32ee0f713599a94d453a26fc1
9751ae55b105ad8ffe6fc5dc7aea60ad723b6df67a959aa2ea6f4fa640d20a71
9ad15385f04a6d8dd58b4390e32d876070e339eee6b8da586852d7467514d1b1
9be70b7fe15cd64aed5b1adc88c2d5270bce534d167c4a42d143ae0059c3da1c
b30bb0f35a904f67d3ac0082c59770836cc415dc5b7225be04e8d7c79bde73be
c040defb9c90074b489857f328d3e0040ac0ddab26cde132f17cccae7f1309cc
c11b964916457579a268a36e825857866680baf1830cd6e2d26d4e1e24dec91b
ea19736c8e89e871974aabdc0d52ad0f0948159d4cf41d2889f49448cbe5e705
ecd04ebbb3df053ce4efa2b73912fd4d086d1720f9b410235ee9c1e529ea52a2
F491fb72f106e879021b0bb1149c4678fb380c255d2ef11ac4e0897378793f49
fc611f9d09f645f31c4a77a27b6e6b1aec74db916d0712bef5bce052d12c971f
Related C&Cs known to be part of Maze Ransomware Group’s Internet-connected infrastructure include:
hxxp://104[.]168[.]198[.]208/wordupd[.]tmp
hxxp://104[.]168[.]215[.]54/wordupd[.]tmp
hxxp://104[.]168[.]174[.]32/wordupd_3[.]0[.]1[.]tmp
Related C&Cs known to be part of Maze Ransomware Group’s Internet-connected infrastructure include:
91[.]218[.]114[.]4
5[.]199[.]167[.]188
185[.]147[.]15[.]22
91[.]218[.]114[.]11
91[.]218[.]114[.]25
91[.]218[.]114[.]26
91[.]218[.]114[.]31
91[.]218[.]114[.]32
91[.]218[.]114[.]37
91[.]218[.]114[.]38
91[.]218[.]114[.]77
91[.]218[.]114[.]79
Related malicious MD5s known to have been involved in the campaign include:
19aaa6c900a5642941d4ebc309433e783befa4cccd1a5af8c86f6e257bf0a72e
6878f7bd90434ac5a76ac2208a5198ce1a60ae20e8505fc110bd8e42b3657d13
9ad15385f04a6d8dd58b4390e32d876070e339eee6b8da586852d7467514d1b1
b950db9229db2f37a7eb5368308de3aafcea0fd217c614daedb7f334292d801e
Related C&Cs known to be part of Maze Ransomware Group’s Internet-connected infrastructure include:
hxxp://91[.]218[.]114[.]4/nwjknpeevx[.]action?pw=g1y652l&kyn=21y3vvhh&dvr=5e&us=g25e3582a
hxxp://91[.]218[.]114[.]11/forum/siaib[.]jspx?v=h&xyna=0vip863&eul=xsn3q0
hxxp://91[.]218[.]114[.]26/view/ticket/pigut[.]jspx?o=664quo0s&fp=ot52
hxxp://91[.]218[.]114[.]25/xrr[.]jspx?ygad=r35e2cx&e=6as6ta
hxxp://91[.]218[.]114[.]4/j[.]php
hxxp://91[.]218[.]114[.]11/payout/view/fa[.]aspx?y=y&qbx=4&kws=n2&iuy=8k7
hxxp://91[.]218[.]114[.]25/lxh[.]asp?mtxm=l7&r=836wy5
hxxp://91[.]218[.]114[.]26/signin/ticket/eq[.]action?x=yk6rr&e=50b&q=327dr5&ofk=065cdp
hxxp://91[.]218[.]114[.]31/signin/rnmnnekca[.]jsp?kdn=6snl5&e=7a50cx4hyp
hxxp://91[.]218[.]114[.]31/forum/a[.]aspx?byx=56&bc=62t0h&u=75w6n6&sot=2v0l761or6
hxxp://91[.]218[.]114[.]32/withdrawal/checkout/l[.]do?nuny=qj6&sdv=45g2boyf5q&dnr=rh8lk31ed
hxxp://91[.]218[.]114[.]77/task/bxfbpx[.]jspx?nq=cge63
hxxp://91[.]218[.]114[.]38/account/payout/ujwkjhoui[.]shtml
hxxp://91[.]218[.]114[.]37/imrhhjitop[.]phtml?wto=344dsc84&sp=x&oml=c173s71u&iy=m3u2
hxxp://91[.]218[.]114[.]38/auth/login
hxxp://91[.]218[.]114[.]79/logout/hfwdmugdi[.]php?upaj=mj7g
hxxp://91[.]218[.]114[.]38/sepa/juel[.]php?ars=51qse4p3y&xjaq=r5o4t4dp
hxxp://91[.]218[.]114[.]32/fwno[.]cgi?yd=410&o=y7x5kx371&p=m3361672
hxxp://91[.]218[.]114[.]37/sepa/signout/mjsnm[.]aspx?r=7o47wri&rtew=uu8764ssy&bri=51gxx6k5&opms=72gy0a
hxxp://91[.]218[.]114[.]77/payout/analytics/lrkaaosp[.]do?y=62h&aq=3jq8k6&v=0svt
hxxp://91[.]218[.]114[.]79/create/dpcwk[.]php?u=28qy0dpmt&qwbh=k&f=g1ub5ei&ek=3ee
Related malicious domains known to be part of Maze Ransomware Group’s Internet-connected infrastructure include:
hxxp://mazedecrypt[.]top
hxxp://mazedecrypt[.]top
hxxp://mazenews[.]top
hxxp://newsmaze[.]top
Related C&Cs known to be part of Maze Ransomware Group’s Internet-connected infrastructure include:
91[.]218[.]114[.]11
91[.]218[.]114[.]25
91[.]218[.]114[.]26
91[.]218[.]114[.]31
91[.]218[.]114[.]32
91[.]218[.]114[.]37
91[.]218[.]114[.]38
91[.]218[.]114[.]4
91[.]218[.]114[.]77
91[.]218[.]114[.]79
hxxp://92[.]63[.]8[.]47
hxxp://92[.]63[.]32[.]2
hxxp://92[.]63[.]37[.]100
hxxp://92[.]63[.]194[.]20
hxxp://92[.]63[.]17[.]245
hxxp://92[.]63[.]32[.]55
hxxp://92[.]63[.]11[.]151
hxxp://92[.]63[.]194[.]3
hxxp://92[.]63[.]15[.]8
hxxp://92[.]63[.]29[.]137
hxxp://92[.]63[.]32[.]57
hxxp://92[.]63[.]15[.]56
hxxp://92[.]63[.]11[.]151
hxxp://92[.]63[.]32[.]52
hxxp://92[.]63[.]15[.]6
Related malicious MD5s known to be part of Maze Ransomware Group’s Internet-connected infrastructure include:
064058cf092063a5b69ed8fd2a1a04fe
0f841c6332c89eaa7cac14c9d5b1d35b
108a298b4ed5b4e77541061f32e55751
11308e450b1f17954f531122a56fae3b
15d7dd126391b0e7963c562a6cf3992c
21a563f958b73d453ad91e251b11855c
27c5ecbb94b84c315d56673a851b6cf9
2f78ff32cbb3c478865a88276248d419
335aba8d135cc2e66549080ec9e8c8b7
3bfcba2dd05e1c75f86c008f4d245f62
46b98ee908d08f15137e509e5e69db1b
5774f35d180c0702741a46d98190ff37
5df79164b6d0661277f11691121b1d53
658e9deec68cf5d33ee0779f54806cc2
65cf08ffaf12e47de8cd37098aac5b33
79d137d91be9819930eeb3876e4fbe79
8045b3d2d4a6084f14618b028710ce85
8205a1106ae91d0b0705992d61e84ab2
83b8d994b989f6cbeea3e1a5d68ca5d8
868d604146e7e5cb5995934b085846e3
87239ce48fc8196a5ab66d8562f48f26
89e1ddb8cc86c710ee068d6c6bf300f4
910aa49813ee4cc7e4fa0074db5e454a
9eb13d56c363df67490bcc2149229e4c
a0c5b4adbcd9eb6de9d32537b16c423b
a3a3495ae2fc83479baeaf1878e1ea84
b02be7a336dcc6635172e0d6ec24c554
b40a9eda37493425782bda4a3d9dad58
b4d6cb4e52bb525ebe43349076a240df
b6786f141148925010122819047d1882
b93616a1ea4f4a131cc0507e6c789f94
bd9838d84fd77205011e8b0c2bd711e0
be537a66d01c67076c8491b05866c894
bf2e43ff8542e73c1b27291e0df06afd
c3ce5e8075f506e396ee601f2757a2bd
d2dda72ff2fbbb89bd871c5fc21ee96a
d3eaab616883fcf51dcbdb4769dd86df
d552be44a11d831e874e05cadafe04b6
deebbea18401e8b5e83c410c6d3a8b4e
dfa4631ec2b8459b1041168b1b1d5105
e57ba11045a4b7bc30bd2d33498ef194
e69a8eb94f65480980deaf1ff5a431a6
ef95c48e750c1a3b1af8f5446fa04f54
f04d404d84be66e64a584d425844b926
f457bb5060543db3146291d8c9ad1001
f5ecda7dd8bb1c514f93c09cea8ae00d
f83cef2bf33a4d43e58b771e81af3ecc
fba4cbb7167176990d5a8d24e9505f71
Related C&Cs known to be part of Maze Ransomware Group’s Internet-connected infrastructure include:
91[.]218[.]114[.]11
91[.]218[.]114[.]25
91[.]218[.]114[.]26
91[.]218[.]114[.]31
91[.]218[.]114[.]32
91[.]218[.]114[.]37
91[.]218[.]114[.]38
91[.]218[.]114[.]4
91[.]218[.]114[.]77
91[.]218[.]114[.]79
92[.]63[.]11[.]151
92[.]63[.]15[.]6
92[.]63[.]15[.]8
92[.]63[.]17[.]245
92[.]63[.]194[.]20
92[.]63[.]194[.]3
92[.]63[.]29[.]137
92[.]63[.]32[.]2
92[.]63[.]32[.]52
92[.]63[.]32[.]55
92[.]63[.]32[.]57
92[.]63[.]37[.]100
92[.]63[.]8[.]47
Related C&Cs:
hxxp://104[.]168[.]174[.]32/wordupd_3[.]0[.]1[.]tmp
hxxp://104[.]168[.]198[.]208/wordupd[.]tmp
hxxp://104[.]168[.]201[.]35/dospizdos[.]tmp
hxxp://104[.]168[.]201[.]47/wordupd[.]tmp
hxxp://104[.]168[.]215[.]54/wordupd[.]tmp
hxxp://149[.]56[.]245[.]196/wordupd[.]tmp
hxxp://192[.]119[.]106[.]235/mswordupd[.]tmp
hxxp://192[.]119[.]106[.]235/officeupd[.]tmp
hxxp://192[.]99[.]172[.]143/winupd[.]tmp
hxxp://54[.]39[.]233[.]188/win163[.]65[.]tmp
hxxp://91[.]208[.]184[.]174:8079/windef[.]exe
hxxp://agenziainformazioni[.]icu/wordupd[.]tmp
hxxp://www[.]download-invoice[.]site/Invoice_29557473[.]exe
Related C&Cs known to be part of Maze Ransomware Group’s Internet-connected infrastructure include:
173[.]209[.]43[.]61
193[.]36[.]237[.]173
37[.]1[.]213[.]9
37[.]252[.]7[.]142
5[.]199[.]167[.]188
hxxp://checksoffice[.]me
hxxp://drivers[.]updatecenter[.]icu
hxxp://plaintsotherest[.]net
hxxp://thesawmeinrew[.]net
hxxp://updates[.]updatecenter[.]icu
hxxp://att-customer[.]com
hxxp://att-information[.]com
hxxp://att-newsroom[.]com
hxxp://att-plans[.]com
hxxp://bezahlen-1und1[.]icu
hxxp://bzst-info[.]icu
hxxp://bzst-inform[.]icu
hxxp://bzstinfo[.]icu
hxxp://bzstinform[.]icu
hxxp://canada-post[.]icu
hxxp://canadapost-delivery[.]icu
hxxp://canadapost-tracking[.]icu
hxxp://hilfe-center-1und1[.]icu
hxxp://hilfe-center-internetag[.]icu
hxxp://trackweb-canadapost[.]icu
Related personally identifiable email address accounts known to have been involved in the campaign include:
abusereceive[.]hitler.rocks
gladkoff1991[.]yandex.ru
Related C&Cs known to be part of Maze Ransomware Group’s Internet-connected infrastructure include:
hxxp://91[.]218[.]114[.]4
hxxp://91[.]218[.]114[.]11
hxxp://91[.]218[.]114[.]25
hxxp://91[.]218[.]114[.]26
hxxp://91[.]218[.]114[.]31
hxxp://91[.]218[.]114[.]32
hxxp://91[.]218[.]114[.]37
hxxp://91[.]218[.]114[.]38
hxxp://91[.]218[.]114[.]77
hxxp://91[.]218[.]114[.]79
hxxp://globalsign[.]icu
hxxp://ocspverisign[.]pw
hxxp://officecloud[.]top
92[.]63[.]8[.]47
92[.]63[.]3[.]2
92[.]63[.]37[.]100
92[.]63[.]194[.]20
92[.]63[.]17[.]245
92[.]63[.]32[.]55
92[.]63[.]11[.]151
92[.]63[.]194[.]3
92[.]63[.]15[.]8
92[.]63[.]29[.]137
92[.]63[.]32[.]57
92[.]63[.]15[.]56
92[.]63[.]11[.]151
92[.]63[.]32[.]52
92[.]63[.]15[.]6
91[.]218[.]114[.]11
91[.]218[.]114[.]25
91[.]218[.]114[.]26
91[.]218[.]114[.]31
91[.]218[.]114[.]32
91[.]218[.]114[.]37
91[.]218[.]114[.]38
91[.]218[.]114[.]4
91[.]218[.]114[.]77
91[.]218[.]114[.]79
Sample screenshots:
About The Author
