HTTPS to api.ipify.org fails

[josuesouza]

Hello,

I figured the encryptor stopped calling the handshake.php page that inserts the victim details in the database. After investigating, I noticed the TLS handshake between encryptor and api.ipify.org was failing. Looks like the client is using TLS 1.0 and the site does not support it anymore.

I changed the code to use plain HTTP by calling http://api.ipify.org and is working fine now.

[snake9935]

I had the same problem, thanks for the solution :=)

Did you manage to make the decrypter work?

[josuesouza]

Unfortunately not. I gave up after a while as I didn't need the decryption component for my use case (detecting ransomware behavior with threat hunting tools). I did try a few things but couldn't solve the issue. Probably would need someone with real skills on C#, which is not my case :)

[snake9935]

I also want to test my detection tools.

It's a pity not to go through with the test, I tried a lot of solutions but it still doesn't work :=)

I only know the Python language and powershell :=)