216.73.217.24

Indicator (IOC)

stix Revoked AlienVault · Published 20/12/2025 19:32 · Modified 20/12/2025 19:39

Essential information

Value / Name
861e2544ddb9739d79b265aab1e327d11617bc9d9c94bc5b35282c33fcb419bc
Confidence
100/100
Revoked
Yes
Valid from
11/05/2022 12:19
Valid until
14/08/2023 12:19
Pattern type
stix
Published
20/12/2025 19:32
Modified
20/12/2025 19:39
Author / Source
AlienVault

Description

Ransom:Win32/Revil.D!MTB SHA256 of 6620f5647a14e543d14d447ee2bd7fecc03be882

Pattern

[file:hashes.'SHA-256' = '861e2544ddb9739d79b265aab1e327d11617bc9d9c94bc5b35282c33fcb419bc']

Labels / Tags

Labels: gold southfield ransomware revil

Marking (TLP)

TLP:CLEAR

Related entities

Reports and intrusion sets linked to this IOC.

Intrusion sets (1)

  • GOLD SOUTHFIELD Pinchy Spider
    The MITRE Corporation Confidence 100

    [GOLD SOUTHFIELD](https://attack.mitre.org/groups/G0115) is a financially motivated threat group active since at least 2018 that operates the [REvil](https://attack.mitre.org/software/S0496) Ransomware-as-a Service (RaaS). [GOLD SOUTHFIELD](https://attack.mitre.org/groups/G0115) provides backend infrastructure for affiliates recruited…

    First seen 01/01/1970 · Last seen 16/11/5138 ·