From 406dfdb45b789a60787c8811a88d5d5aea98a1d3 Mon Sep 17 00:00:00 2001
From: Delta-Sierra <deborah.servili@gmail.com>
Date: Thu, 25 Feb 2021 09:52:52 +0100
Subject: [PATCH] add Sekhmet ransomware

---
 clusters/ransomware.json | 25 +++++++++++++++++++++++--
 1 file changed, 23 insertions(+), 2 deletions(-)

diff --git a/clusters/ransomware.json b/clusters/ransomware.json
index b5786b0..90020a3 100644
--- a/clusters/ransomware.json
+++ b/clusters/ransomware.json
@@ -13909,12 +13909,14 @@
           "RECOVER-FILES.txt"
         ],
         "ransomnotes-refs": [
-          "https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2020/september/25/egregor.jpg"
+          "https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2020/september/25/egregor.jpg",
+          "https://2kjpox12cnap3zv36440iue7-wpengine.netdna-ssl.com/wp-content/uploads/2020/10/egregor-ransom-demanding-message.png"
         ],
         "refs": [
           "https://www.appgate.com/news-press/appgate-labs-analyzes-new-family-of-ransomware-egregor",
           "https://www.bleepingcomputer.com/news/security/crytek-hit-by-egregor-ransomware-ubisoft-data-leaked/",
-          "https://cybersecuritynews.com/egregor-ransomware/"
+          "https://cybersecuritynews.com/egregor-ransomware/",
+          "https://securityboulevard.com/2020/10/egregor-sekhmets-cousin/"
         ]
       },
       "uuid": "8bd094a7-103f-465f-8640-18dcc53042e5",
@@ -14081,6 +14083,25 @@
       ],
       "uuid": "e69f9836-873a-43d3-92a8-97ab783a4171",
       "value": "Ragnar Locker"
+    },
+    {
+      "description": "Ransom.Sekhmet not only encrypts a victims files, but also threatens to publish them.",
+      "meta": {
+        "refs": [
+          "https://www.bleepingcomputer.com/news/security/maze-ransomware-is-shutting-down-its-cybercrime-operation/",
+          "https://www.zdnet.com/article/as-maze-ransomware-group-retires-clients-turn-to-sekhmet-ransomware-spin-off-egregor/",
+          "https://blog.malwarebytes.com/detections/ransom-sekhmet/",
+          "https://securityboulevard.com/2020/10/egregor-sekhmets-cousin/"
+        ]
+      },
+      "ransomnotes-filenames": [
+        "RECOVER-FILES.txt"
+      ],
+      "ransomnotes-refs": [
+        "https://blog.malwarebytes.com/wp-content/uploads/2020/11/Sekhmet_ransom_note.png"
+      ],
+      "uuid": "6fb1ea9e-5389-4932-8b22-c691b74b75a8",
+      "value": "Sekhmet"
     }
   ],
   "version": 93