Samples for Ransomware Actors

UnderMarket - Available On [ iOS - Android ]
un62d2ywi33bho53.onion

Archive7 - Darkrai P2P Botnet
hxxp://archive7bgastbl4.onion/en/botnets/
hxxps://keybase.pub/horsecock/Net%20Files/Botnet /P2P/~B1NARY~%20Darkrai

Loki Bot - C&C
hxxp://216.170.114.116/free/Panel/PvqDq929BSx_A_D_M1n_a.php
hxxp://216.170.114.116/test/Panel/PvqDq929BSx_A_D_M1n_a.php
hxxp://216.170.114.116/papa/Panel/PvqDq929BSx_A_D_M1n_a.php
hxxp://216.170.114.116/rumuokoro/Panel/PvqDq929BSx_A_D_M1n_a.php

hxxp://185.24.233[.]139/dom/
hxxp://185.24.233[.]139/hmt/

JackPOS - Control Panel
hxxp://mdksimon[.]su/jack/admin.php

Russian Email Scheme APT actors
hxxp://kvhmod3vuhc6yrkv[.]onion

AZORult Stealer - Source Code
hxxp://www74.zippyshare[.]com/v/SDznjGAy/file.html

Alcatraz Locker Admin Panel - Ransomware Source Code
http://185.62.189.221/admin/login.php

GandCrab Ransomware
nomoreransom[.]bit

Zyklon HTTP - Source Code
hxxp://www59.zippyshare[.]com/v/kugrSYDt/file.html

Alcatraz Locker Admin Panel - Ransomware
Delete Bot
http://185.62.189.221/admin/login.php
http://185.62.189.221/Ransomware.exe

Loki and Pony - Control Panels
hxxp://svit-zer[.]com

Mining in a botnet - 1ms0rry MINERPANEL - Control Panel
hxxp://www.iplaymobporn[.]com/index.php

Tor Network - BlaCk Market - Bad Boys, Bad Boys Everywhere!!
hxxp://darknetncj7k6wzk[.]onion/ads/oc-admin/index.php?page=logi

Bankbot - Android
hxxp://bot.mymaster-rem.ru

Pony - Control Panels
hxxp://zh-op.ml/reef/town/admin.php
hxxp://busgrab.ml/open/flex/admin.php
hxxp://densed.ml/fade/make/admin.php
hxxp://aframe.ga/anti/fran/admin.php
hxxp://mobview.ml/kame/rash/admin.php

http://oceauma.com/sitemap/togo7/admin.php --> Pony
http://oceauma.com/sitemap/togo6/admin.php --> Pony
http://oceauma.com/sitemap/togo5/admin.php --> Pony
http://oceauma.com/sitemap/togo4/admin.php --> Pony
http://oceauma.com/sitemap/togo3/admin.php --> Pony
http://oceauma.com/sitemap/togo2/admin.php --> Pony
http://oceauma.com/sitemap/panel/admin.php --> Pony
http://oceauma.com/sitedata/chile/admin.php --> Pony
http://darkbastard.com.de/aguta/panel/admin.php
http://darkbastard.com.de/chimela/panel/admin.php
http://darkbastard.com.de/david/panel/admin.php
http://darkbastard.com.de/isdore/panel/admin.php
http://darkbastard.com.de/iyke/panel/admin.php
http://darkbastard.com.de/jay/panel/admin.php
http://darkbastard.com.de/jaysman/panel/admin.php
http://darkbastard.com.de/krosko/panel/admin.php
http://darkbastard.com.de/oscar/panel/admin.php
http://darkbastard.com.de/teddy/panel/admin.php
http://patogroup.cf/pato5/admin.php
http://patogroup.cf/pato3/admin.php
http://patogroup.cf/pato2/admin.php
http://patogroup.cf/pato1/admin.php
http://favourofgod.cf/panel/admin.php
http://juliedclient.org.in/wzlog/foursell31july-31aug/admin.php
http://juliedclient.org.in/wzlog/sellythree-31july-31aug/admin.php
http://juliedclient.org.in/wzlog/foursell31july-31aug/admin.php
http://ho7rcj6wucosa5bu.onion.link/login.php

Unknown Miner Panel - Control Panel
hxxp://109.234.36.233/

Adoble Flash Player
http://kovabe.pornogirl4u.ru/
http://sctidxj.pornogirl4u.ru
http://retro.pornogirl4u.ru/

Mosad - Build by Redo
hxxp://www.x1i9v5[.]net/awzu/
hxxp://servicioylogistica[.]com/tes/
hxxp://cul8er[.]net/test/
hxxp://k5v30x[.]net/axyo/

Bilal Ghouri
http://darkbastard.com.de/rolex/PHP/
http://darkbastard.com.de/kenedy/PHP/

MegalodonHTTP
hxxp:timaya[.]ru/Panel/login.php

Android Banking Trojan - FlexNet - From Russia with Love - Control Panel - Source Code
hxxp://getmygoodideas[.]win

MazAr Botnet - Android Botnet - Commands
http://antisec-security.blogspot.kr/2016/11/mazar-botnet-source-code-android-botnet.html

Russian Ransomware with Love -
unlckr@protonmail.com
hxxp://n3r2kuzhw2h7x6j5[.]onion

Linken Sphere - The most safety and user friendly antidetect in the world .. 🧐🧐  .. We are pleased to bring to your attention the most convenient and  safe tool for working in the Internet ..
hxxps://ls.tenebris.cc

AZORult : hxxp://iddqdp.pw/
Lite HTTP : hxxp://185.170.43.187/wjsjltaipbnypilx/
Kronos : hxxp://casaroyai.com/op-kron/login.php
Safe Loader : hxxp://user72247.7ci.ru/

Dark_VNC - Control Panel
hxxp://37.48.125.112/login.php
hxxp://95.211.100.137/login.php
hxxp://144.217.139.136/login.php
hxxp://81.171.14.130/login.php

iSpy Premium
http://www.shipment.org.uk/panel/login
admin:chima12
http://ud1.minervamarines.com/panel/login
admin:admin


Plasma HTTP :
http://pn8.pw/p/login.php
Blue Botnet :
http://kingstress.net/login.php
Diamond Fox Botnet v2 :
http://grenmill.com/diamond/
Citadel Botnet :
http://nolimitme.com/999/cp.php?m=login
Pony Botnet v2.2 :
http://telecomtrust.in/p/admin.php
ZeuS Botnet :
http://telecomtrust.in/z/cp.php?m=login
Chrome Form Grabber :
http://telecomtrust.in/grab/index.php?p=login
iSpy Premium :
http://www.thebrandsanctuary.com/panel/login
Bilal Ghouri - Stealer :
http://ajr-insuranceintl.com/js/

Pony + Anonymous
http://eternity-hacks.ru/admin.php
http://stealermi.mcdir.ru/admin.php

ZeuS Botnet.
http://diagnosticdubai.com/uzoma/cp.php?m=login
http://diagnosticdubai.com/Cabin/cp.php?m=login
http://diagnosticdubai.com/David/cp.php?m=login
http://diagnosticdubai.com/UCHE/cp.php?m=login
http://diagnosticdubai.com/meadmin/cp.php?m=login
http://diagnosticdubai.com/oc/cp.php?m=login
http://diagnosticdubai.com/otunne/cp.php?m=login

AB Stealer
hxxp://hfw-server.xyz/stee/
hxxp://verifydox.life/Ab/

Pony Botnet
http://eternity-hacks.ru/admin.php
http://stealermi.mcdir.ru/admin.php
http://private1.mcdir.ru/admin.php

Dark_VNC - Control Panel - From Russia  - Source Code
hxxp://37.48.125.112/login.php

LiteHTTP - Process : stdafx.exe => "NVDisplay.exe" --api --server
http://zec.suprnova.cc  --user badgateway.1 --pass x --port 2142

Brazilian Banking Trojan - Control Panel
hxxp://multimarcas2017.web6203.kinghost[.]net/lor/

Threat Actors for Ransomware
------------------
Nemesis Ransomware - ALL YOUR WORK AND PERSONAL FILES HAVE BEEN ENCRYPTED - You can find out the details / buy decryptor + key / ask questions by email: MerlinGudvadlon@protonmail.com - hxxp://jz3sncvmveprhihk.onion
------------------
All your files have been encrypted! All your files have been encrypted  due to a security problem with your PC. If you want to restore them,  write us to the e-mail decrypt.guarantee@aol.com
------------------
All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail rememberggg@tutanota.com.You have to pay for decryption in Bitcoins
------------------
Ransomware - Your network has been penetrated. Backups were either encrypted or deleted or backup disks were formatted - Victim : 124 - Contact email: 1173022@protonmail.com
------------------