#Sy Clops | Explore Tumblr posts and blogs

honestsycrets · 5 years ago

Text

The Milkmaid VII: Bright Lights

❛ pairing | ivar x reader, harald & ivar (friend?ship)

❛ type | multi

❛ summary | reader finds her way while ivar argues with a dog.

❛ tags | pregnancy themes, supernatural intervention, ivar being a bad dog owner, he’s a pet boy okay, just not today, angst, but not dark?, i’m not @lisinfleur 😂

❛ sy’s notes | no really he argues with a dog. i was gonna post a gif of ivar on this but my 5B gifs are real s h i t t y. redo.

He should throw your stupid dog down a well. Maybe, if he were lucky, Mimir would shake the knowledge out of the damn thing. But no, instead, he has no more leads to go on than he originally had. The kings stand considering from which direction the dog came from.

“He came from behind the barn,” says Harald.

“He came from the barn,” Ivar scoffs, jerking his finger in the direction. “You think my slave was hiding away in some barn in the cold of night?”

“Maybe if she were hiding from you.”

“That is so helpful,” Ivar snaps at the other king. His men, deep in the woods, shout: there is nothing here! Ivar then turns to Harald with that knowing, all too cocky scowl. He hates it, when he is right. “Do you know what is back there? Brush. Woods and wolves.”

“I’m sure you know what is back there.”

Ivar leers back to the other king confident of his astringent purpose for saying that. Ivar grips his crutch, hobbling a bit closer. “What are you saying, hm?”

“I am saying these things have a way of recurring.”

These things, Harald suggested, is the death of royal children. His child, Freydis’s child, and now… Ivar holds Harald’s gaze for a stubborn few moments before he hisses, not bearing to waste his time with the old king.

“I don’t know why I brought you Harald,” Ivar walks away from the other kind. Harald, now dressed, follows Ivar toward the line of trees. “You have no faith in the gods, no faith in anything.”

“Here I am,” Harald’s expression smooths over from bunched up wrinkles to a state of relaxation, despite his companion’s jabs. After this many years, he became used to the constant jeer of kinds underestimating him. “Are we checking in the brush?”

“If we have to.”

The woods hold their own secrets. Deep in their hearth, past the arching trees and branches that nipped the sky, there had to be something. At the very least, all it could hold, is a vast amount of nothing. He has nothing to gain from continuing to deny Harald. They find themselves following Vala’s tiny steps that carry them deeper and deeper before they stop. Vala turns in a circle. Then sits.

Stupid dog.

“The dog doesn’t know,” Harald grumbles. “Look at him, he is confused.”

Ivar glares at the dog, wondering why, why hadn’t he picked a grown and well-trained dog. He had to pick this thing. Because you wanted him so much. He shouldn’t have let you pick the dog-- you knew good, domestic things. Things of war, protection, and-- this, not so much.

The pup scratches the grown, sniffing and turning, whining and whimpering. And Ivar wants nothing more than to boot him with the butt of his crutch. The dog yips and Ivar’s about had it. He whirls around-- and finds the dog sitting there looking right back at him.

Pest.

If he had been smart, he would have chosen a well-trained hound. But no-- because his heart is weak when it comes to the complaints of his woman, he chose a creature that was as useless as it was cute.

The sun disappeared behind the fjord. You were left with the chill of night as Kattegat’s temperature plummeted below comfortable levels. Too cold to move but too afraid to let the fire run out, you chucked remnants of wood you gathered into the dismal fire until there was nothing but scraps that the fire would snap apart, cracking into its dying breaths. With nothing else to give to the greedy flames, you fold your hands into your woolen dress and pray tight lipped prayers to Frigg.

A small light, barely a flicker, caught your attention out of your peripheral vision. At first you thought it was nothing, perhaps the flicker of an animal’s eyes. If you stayed very still, the wild beast would leave you be, or you so you hoped. It would be tragic, you thought, for the wolves to have two of Ivar’s children. You your legs in a little tighter and curl into the Asvaldr’s plump belly, even as he whines impatiently for your attention.

“Shh, what if it is a beast?” you smooth your hand over his muscular body. “We shouldn’t worry about it, morning will come soon enough.”

Despite your pleads, Asvaldr’s limbs flailed with his attempt to get up. When he does, he effectively thrusts you to the dirt floor. Your hand snaps to your stomach with precaution, resting on your hip. “Asvaldr what is it?”

It was then you saw it for what it was.

A whimsical bouncy flourish of light between the wall of thick trees over a prominent rock. You swing your legs around, using the ground to shove yourself up. Asvaldr clopped closer so that you might hold his reins to support your stance.

“A wisp?”

Asvaldr clops a closer, dragging you along with. It had been some time since you had seen one of these things. The bouncy lights that dragged you, so you heard, to your fate. You chase the wisps into the untraveled path of the forest that way, hanging onto your master’s horse, and praying to the gods the wisps path is a good one.

Well, chase is being kind, when you walk like that.

Ivar’s eyes chase the edges of old trees. They are tall, well grown, wild. All the good plants are wild and free to hold spirits that are just as wild and free. He moistens his cracked lips for the fifth time, debating--

Perhaps Harald had been right. Perhaps you wanted to run to get away from him. Everyone else shared that sentiment. Margrethe, ran from him. Freydis then-- she tried to run from him.

At least he took care of that one. He made sure she didn’t run.

“Ivar!” Harald paces until he finds something, lackadaisically whistling at Ivar. Ivar takes his crutch and jabs it into the hard dirt, carefully scaling the mountain side to where the other king was. He stood about the crispy remains that weren’t yet cool. “Ashes. She was here.”

The stupid little shit yips at his feet. They scan the surrounding area for clues that you had been there. Moist poignantly, he finds, is an overlooked trail leading away from the campsite. He realizes that there is something there-- better than a burnt out campsite or sweep of luck.

A bouncy red flame.

It held his attention for longer than it should have. “Thank the gods,” he finds himself raising the hammer of Thor to his lips, placing a kiss to it, before setting it back upon his sturdy chest.

In looking at Harald, he realized that the old man did not see what he saw. But it was there, jovial and light. “And where are you going?” Harald called out to him. Harald growls a half hearted response and disappears into the trees behind his so called friend. It had better been a lead.

“Come on, old man. You’re falling behind!”

Ivar believes in the ways of the gods and the norns. There is not a fate that lay before man that was not woven from their fingertips. From the strong standing trees to the ones that have collapsed and bore their craggly roots, the trees have an understanding with the nine worlds that humans did not. Humans unlike Ivar, whose faith was uncrackable.

He pressed down from the rolling hill down toward the fjord, scaling with a curse behind every step, because his crutch was complaining as he moved down the hillside. How he could walk the battlefield freely, like a titan, and now plummet to the ground with sand was beyond him. He breaks his fall on his elbows, and to his surprise, his bones don’t crack. He knows Harald is watching him agape as he hurries on his forearms.

“What are those?” Harald at last sees it with that dumb, lost expression splattered across his face. “Is there a Valkyrie here?”

“Do you see a Valkyrie?” he looks to the sky, then across the streaming waters that washed by, searching for the sight of a swan. There was none. He can’t help tease. “Perhaps its all that ale you’ve been drinking.”

Harald’s face is flat and free from a response, just the small, scoffing laugh as he looks about.

At least, Ivar knows, it isn’t in his head this time. Last time-- as it were -- was Freydis’s lies. At least now, here, he knows that Harald sees exactly what he sees. The wisps, fireballs of the norn’s might, leads down from Norway’s rise and drop to the lapsing waves of the water to the grainy shore.

“Hold this,” he hands the crutch he’s been crawling with to Harald.

The scouts he’s gathered fall in a defensive position around the kings. Harald stuffs the crutch under his arm, following Ivar, who now snakes over the ground toward the rocky bend of the beach like he’s fifteen again and innocent to the world despite the men around him. He can see his brother’s long bodies splashing in the cool water against the warm orange that reflected on the sun. Then Hvitserk and Ubbe would come with their spears and Ubbe would show him a feast of fish while Hvitserk had none. Sigurd would have one.

Nostalgia isn’t a good taste on his tongue. That boy-- the one who dreamed of being able to hunt with his big brothers? He’s not a boy he wants to know. He doesn’t want to know the boy that would have rathered slit his throat if only it wouldn’t destroy his mother. So he turns his head across from the still waters and looks toward the forest. At the banks of the waters, he recognizes a decrepit sight-- not from anything he’s ever seen, but something he’s always felt.

“As much as I hate to break up a good moment,” Harald kneels down, holding the crutch over his trousers, “We were hunting your very pregnant slave.”

“Shht,” Ivar snaps back to Harald. “Look there.”

“Look where?” He lurches then, grasping Harald’s wrinkled face and jerks it into the right direction across the waters. A long, grated sigh breaks free from his lips. The waters do not look deep, no. It strikes Harald as strange, as he knows he’s passed by here with his warships, and they’ve been deeper still than the crystal clear waters before. He turns toward his men to shrill something-- when he finds the only company they have is the cold chill of the sea.

Ivar looks back at him, reclining on the palms of his hands, before his head tilts-- and a shit eating smile makes its way up his face. He clicks his tongue like a man would after a lost animal.

“...I’m the donkey then.”

There is a cabin.

It is a thin looking thing that would make anyone question why it was still standing. It’s heavy brown wood stands, but it has clearly been burned by the crispness of its black edges. Someone did not want it to stand. But there it was, proudly displaying a shield that spun above the top of the double doors. Pure blood red with one lone symbol: a raven soars the expanse of the shield.

“This must be your father’s cabin,” Harald says, verging on a dry laughter. Ten years, and here he was, static in the same position he’s always been-- behind Ragnar’s legacy. He sets his hand over a twig like fence that reflects Ragnar and Lagertha’s condition prior to taking up raiding once again. Ivar cradles the crutch, using it like a horse’s bit, over Harald’s throat.

The farm’s gate is shaky at best. When he looks out to the fencing, he recognizes a wispy figure dashing into the gate. That handsome, cut jawline with curls. Inquisitive eyes free of any exhaustion. If he were asked, he knew it could never be.

But it looks like him. It’s his father’s whimsical young figure that dashes in, kissing the soft cheeks of a girl he’s never known, and a brother he wish he never had. Another figure stands at the gate; his energy wispy and white. Athelstan, he recognizes the name, not the body.

“So it seems. Have you been here before?”

The girl stops from watching her father and her brother. Harald pauses, helping Ivar off his sodden wet back, and onto the ground. Ivar upright, the crutch fit under his arm. He’s taller than he’s ever been. More handsome than he’s ever felt.

She offers her hand, and Ivar can’t help look up to it in question. The girl-- he’s never known her name. Only that she was at the midpoint between girlhood and crossing into womanhood.

“You’re my brother, Ivar. I am Gyda,” her voice, it’s softer than the waves that lapse the shoreline. “Have you come here to look for someone?”

“My w--” Ivar stops himself. “My slave. She’s with child.”

“I see.” She hovers there, transparent, but defined in features that paint her energy a rich gold. She was radiant. “I sent Baldur after you to help you find her.”

His heart catches in his throat. A quick glance around reveals nothing. There is no boy next to Harald and he. Harald, sensing the discomfort, glances around the farm to the cooing animals. To the handsome visage of Ragnar and Bjorn, ducking and weaving. Ivar recognizes a pang of longing across his friend’s face. Harald steps over the wooden gate.

“I don’t understand.”

She smiles. “My nephew.”

Somewhere, through the mist, he spots the fireball of light. Something in the deep of his mind reminds him of that cursed little soul: Baldur.

@tephi101 @alicedopey @supernaturalvikingwhore @tootie-fruity @titty-teetee @queen-see-ya-in-valhalla @ethereallysimple @deathbyarabbit @deathbyarabbit @readsalot73 @natalie-rdr @lol-haha-joke @lisinfleur @hissouthernprincess @marvelousse @dangerous-like-a-loaded-pistol @vikingsmania @wish-i-was-a-mermaid @lif3snotouttogetyou @gruffle1 @cris101071 @gold-dragon-slayer @babypink224221 @wonderwoman292 @naaladareia @beyond-the-ashes @generic-fangirl @chinduda @laketaj24, @peaceisadirtyword, @ly–canthrope @cris101071 @daughterofthenight117 @unassumingviking @ladyofsoa, @inforapound @winchesterwife27 @feyrearcheron44@readsalot73 @squirrelacorngliterfarts @gold-dragon-slayer @medievalfangirl @sallydelys @bluearchersstuff @affectionrabbitt @whatamood13 @notyouraveragegirl17 @igetcarriedawaywithyou @unacceptabletatertots @ivarandersen @stra-vage @tgrrose @cookies186 @learninglemni-blog @theleeshanotlouise @soiproclaim @msmorganforever

#Ivar x Reader #Ivar/Reader #Ivar & Harald #ivar the boneless/reader #ivar the boneless x reader #vikings imagines #vikings imagine #vikings/reader #vikings x reader #honestsycrets fics

292 notes · View notes

boo-cool-robot · 5 years ago

Photo

[Panel from X-Factor #49, David/Landro/Davidson. Dr. Doom works while a figure approaches in the doorway.

Dr. Doom: And you are?

Figure: Cyclops.

Dr. Doom: You wish an audience with me, Mr. Clops?

Cyclops: Don’t call me ‘Mr. Clops.’

Dr. Doom: Well, you are my inferior. Calling you “Sy” would be inappropriately familiar.

Cyclops: No, that’s...

/End ID]

Mr. Clops

#fnfnfnfmm #mr. clops.#fuck peter david tho #to the x men then! who do not die the old fashioned way #scott summers does not have a nice day

245 notes · View notes

terabitweb · 6 years ago

Text

Original Post from McAfee Author: Alexandre Mundo

This new ransomware was discovered by Michael Gillespie on 8 February 2019 and it is still improving over time. This blog will explain the technical details and share information about how this new ransomware family is working. There are some variants of the Clop ransomware but in this report, we will focus on the main version and highlight part of those variations. The main goal of Clop is to encrypt all files in an enterprise and request a payment to receive a decryptor to decrypt all the affected files. To achieve this, we observed some new techniques being used by the author that we have not seen before. Clearly over the last few months we have seen more innovative techniques appearing in ransomware.

Clop Overview

The Clop ransomware is usually packed to hide its inner workings. The sample we analyzed was also signed with the following certificate in the first version (now revoked):

FIGURE 1. Packer signed to avoid av programs and mislead the user

Signing a malicious binary, in this case ransomware, may trick security solutions to trust the binary and let it pass. Although this initial certificate was revoked in a few days, another version appeared soon after with another certificate:

FIGURE 2. New certificate in new version

This sample was discovered by MalwareHunterTeam (https://twitter.com/malwrhunterteam) on the 26 February, 2019.

We discovered the following Clop ransomware samples which were signed with a certificate:

This malware is prepared to avoid running under certain conditions, for example in the first version it requests to be installed as a service; if that will not succeed, it will terminate itself.

The malware’s first action is to compare the keyboard of the victim computer using the function “GetKeyboardLayout” against the hardcoded values.

This function returns the user keyboard input layout at the moment the malware calls the function.

The malware checks that the layout is bigger than the value 0x0437 (Georgian), makes some calculations with the Russian language (0x0419) and with the Azerbaijan language (0x082C). This function will return 1 or 0, 1 if it belongs to Russia or another CIS country, or 0 in every other case.

FIGURE 3. Checking the keyboard layout

If the function returns 0, it will go to the normal flow of the malware, otherwise it will get the device context of the entire screen with the function “GetDC”. Another condition will come from the function “GetTextCharset” that returns the font used in the system if it does not have the value 0xCC (RUSSIAN_CHARSET). If it is the charset used, the malware will delete itself from the disk and terminate itself with “TerminateProcess” but if it is not this charset, it will continue in the normal flow This double check circumvents users with a multisystem language, i.e. they have the Russian language installed but not active in the machine to avoid this type of malware.

FIGURE 4. Check the text charset and compare with Russian charset

The code that is supposed to delete the ransomware from the disk contains an error. It will call directly to the prompt of the system without waiting for the malware to finish. This means that the execution of the command will be correct but, as the malware is still running, it will not delete it from the disk. This happens because the author did not use a “timeout” command.

FIGURE 5. Deletion of the malware itself

The next action of the malware is to create a new thread that will start all processes. With the handle of this thread, it will wait for an infinite amount of time to finish with the “WaitForSingleObject” function and later return to the winMain function and exit.

This thread’s first action is to create a file called “Favorite” in the same folder as the malware. Later, it will check the last error with “GetLastError” and, if the last error was 0, it will wait with the function “Sleep” for 5 seconds.

Later the thread will make a dummy call to the function “EraseTape” with a handle of 0, perhaps to disturb the emulators because the handle is put at 0 in a hardcoded opcode, and later a call to the function “DefineDosDeviceA” with an invalid name that returns another error. These operations will make a loop for 666000 times.

FIGURE 6. Loop to disturb the analysis

The next action is to search for some processes with these names:

SBAMTray.exe (Vipre antivirus product)

SBPIMSvc.exe (Sunbelt AntiMalware antivirus product)

SBAMSvc.exe (GFI AntiMalware antivirus product)

VipreAAPSvc.exe (Vipre antivirus product)

WRSA.exe (WebRoot antivirus product)

If some of these processes are discovered, the malware will wait 5 seconds using “Sleep” and later another 5 seconds. After those “sleep”, the malware will continue with their normal flow. If these processes are not detected, it will access to their own resources and extract it with the name “OFFNESTOP1”. That resource is encrypted but has inside a “.bat” file.

FIGURE 7. Access to the first resource crypted

The decryption is a simple XOR operation with bytes from this string:

“Po39NHfwik237690t34nkjhgbClopfdewquitr362DSRdqpnmbvzjkhgFD231ed76tgfvFAHGVSDqhjwgdyucvsbCdigr1326dvsaghjvehjGJHGHVdbas”.

The next action is to write this batch file in the same folder where the malware stays with the function “CreateFileA”. The file created has the name “clearsystems-11-11.bat”. Later will launch it with “ShellExecuteA”, wait for 5 seconds to finish and delete the file with the function “DeleteFileA”.

It is clear that the authors are not experienced programmers because they are using a .bat file for the next actions:

Delete the shadow volumes with vssadmin (“vssadmin Delete Shadows /all /quiet”).

Resize the shadow storage for all units starting from C to H units’ letters (hardcoded letters) to avoid the shadow volumes being made again.

Using bcedit program to disable the recovery options in the boot of the machine and set to ignore any failure in the boot warning the user.

All these actions could have been performed in the malware code itself, without the need of an external file that can be detected and removed.

FIGURE 8. The BAT file to disable the shadow volumes and more security

The next action is to create a mutex with the name hardcoded “Fany—Fany—6-6-6” and later make a call to the function “WaitForSingleObject” and check the result with 0. If the value is 0 it means that the mutex was created for this instance of the malware but if it gets another value, it means that the mutex was made from another instance or vaccine and, in this case, it will finish the execution of the malware.

After this, it will make 2 threads, one of them to search for processes and the another one to crypt files in the network shares that it has access to.

The first thread enumerates all processes of the system and creates the name of the process in upper case and calculates a hash with the name and compares it with a big list of hashes. This hash algorithm is a custom algorithm. It is typical in malware that tries to hide what processes they are looking for. If it finds one of them it will terminate it with “TerminateProcess” function after opening with the rights to make this action with “OpenProcess” function.

The malware contains 61 hard-coded hashes of programs such as “STEAM.EXE”, database programs, office programs and others.

Below, the first 38 hashes with the associated process names. These 38 processes are the most usual processes to close as we have observed with other ransomwares families such as GandCrab, Cerber, etc.

This thread runs in an infinite loop with a wait using the function “Sleep” per iteration of 30 minutes.

FIGURE 9. Thread to kill critical processes to unlock files

The second thread created has the task of enumerating all network shares and crypts files in them if the malware has access to them.

For executing this task, it uses the typical API functions of the module “MPR.DLL”:

WNetOpenEnumW

WNetEnumResourceW

WNetCloseEnum

This thread starts creating a reserve of memory with “GlobalAlloc” function to keep the information of the “MPR” functions.

For each network share that the malware discovers, it will prepare to enumerate more shares and crypt files.

For each folder discovered, it will enter it and search for more subfolders and files. The first step is to check the name of the folder/file found against a hardcoded list of hashes with the same algorithm used to detect the processes to close.

Below are the results of 12 of the 27 hashes with the correct names:

If it passes, it will check that the file is not a folder, and in this case compare the name with a list of hardcoded names and extensions that are in plain text rather than in hash format:

ClopReadMe.txt

ntldr

NTDLR

boot.ini

BOOT.INI

ntuser.ini

NTUSER.INI

AUTOEXEC.BAT

autoexec.bat

.Clop

NTDETECT.COM

ntdetect.com

.dll

.DLL

.exe

.EXE

.sys

.SYS

.ocx

.OCX

.LNK

.lnk

desktop.ini

autorun.inf

ntuser.dat

iconcache.db

bootsect.bak

ntuser.dat.log

thumbs.db

DESKTOP.INI

AUTORUN.INF

NTUSER.DAT

ICONCACHE.DB

BOOTSECT.BAK

NTUSER.DATA.LOG

THUMBS.DB

This check is done with a custom function that checks character per character against all the list. It is the reason for having the same names in both upper and lower case, instead of using the function “lstrcmpiA,” for example, to avoid some hook in this function preventing the file from being affected. The check of the extension at the same time is to make the process of crypto quicker. Of course, the malware checks that the file does not have the name of the ransom note and the extension that it will put in the crypted file. Those blacklisted extensions will help the system avoid crashing during the encryption compared with other ransomware families.

FIGURE 10. Check of file names and extensions

This behavior is normal in ransomware but the previous check against hardcoded hashes based on the file/folder name is weird because later, as we can see in the above picture, the next check is against plain text strings.

If it passes this check, the malware will make a new thread with a struct prepared with a hardcoded key block, the name of the file, and the path where the file exists. In this thread the first action is to remove the error mode with “SetErrorMode” to 1 to avoid an error dialog being shown to the user if it crashes. Later, it will prepare the path to the file from the struct passed as argument to the thread and change the attributes of the file to ARCHIVE with the function “SetFileAttributesW”, however the malware does not check if it can make this action with success or not.

Later it will generate a random AES key and crypt each byte of the file with this key, next it will put the mark “Clop^_” at the end of the file, after the mark it will put the key used to crypt the file ciphered with the master RSA key that has hardcoded the malware to protect it against third party free decryptors.

The malware can use 2 different public RSA keys: one exported using the crypto api in a public blob or using the embedded in base64 in the malware. The malware will only use the second one if it cannot create the crypto context or has some problem with the crypto api functions.

The malware does not have support for Windows XP in its use with the crypto functions, because the CSP used in Windows XP has another name, but if run in another operating system starting with Windows Vista, it can change the name in the debugger to acquire the context later and will generate a RSA public blob.

Another difference with other ransomware families is that Clop will only cipher the disk that is a physical attached/embedded disk (type 3, FIXED or removable (type 2)). The malware ignores the REMOTE type (4)).

Anyways, the shares can be affected using the “MPR.DLL” functions without any problem.

FIGURE 11. Filemark in the crypted file and key used ciphered

After encrypting, the file will try to open in the same folder the ransom note and, if it exists, it will continue without overwriting it to save time, but if the ransom note does not exist it will access one resource in the malware called “OFFNESTOP”. This resource is crypted with the same XOR operation as the first resource: the .bat file, after decrypting, will write the ransom note in the folder of the file.

FIGURE 12. Creation of the ransom note from a crypted resource

Here is a sample of the ransom note of the first version of this malware:

FIGURE 13. Example of ransom note of the first version of the malware

After this, Clop will continue with the next file with the same process however, the check of the name based with the hash is avoided now.

Second Version of the Malware

The second version found by the end of February has some changes if it is compared with the first one. The hash of this version is: “ed7db8c2256b2d5f36b3d9c349a6ed0b”.

The first change is some changes in the strings in plain text of the code to make the execution in the “EraseTape” call and “FindAtomW” call more slowly. Now the names are for the tape: “” and the atom “”.

The second change is the name of the resources crypted in the binary, the first resource that is a second batch file to delete the shadow volumes and remove the protections in the boot of the machine as the previous one has another name: “RC_HTML1”.

FIGURE 14. New resource name for the batch file

However, the algorithm to decrypt this resource is the same, except that they changed the big string that acts as a key for the bytes. Now the string is: “JLKHFVIjewhyur3ikjfldskfkl23j3iuhdnfklqhrjjio2ljkeosfjh7823763647823hrfuweg56t7r6t73824y78Clop”. It is important to remember that this string remains in plain text in the binary but, as it has changed, it cannot be used for a Yara rule. The same counts for the name of the resources and also for the hash of the resource because the bat changes per line in some cases and in another as it will have more code to stop services of products of security and databases.

The contents of the new BAT file are:

@echo off

vssadmin Delete Shadows /all /quiet

vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB

vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded

vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB

vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded

vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB

vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded

vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB

vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded

vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB

vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded

vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB

vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded

bcdedit /set {default} recoveryenabled No

bcdedit /set {default} bootstatuspolicy ignoreallfailures

vssadmin Delete Shadows /all /quiet

net stop SQLAgent$SYSTEM_BGC /y

net stop “Sophos Device Control Service” /y

net stop macmnsvc /y

net stop SQLAgent$ECWDB2 /y

net stop “Zoolz 2 Service” /y

net stop McTaskManager /y

net stop “Sophos AutoUpdate Service” /y

net stop “Sophos System Protection Service” /y

net stop EraserSvc11710 /y

net stop PDVFSService /y

net stop SQLAgent$PROFXENGAGEMENT /y

net stop SAVService /y

net stop MSSQLFDLauncher$TPSAMA /y

net stop EPSecurityService /y

net stop SQLAgent$SOPHOS /y

net stop “Symantec System Recovery” /y

net stop Antivirus /y

net stop SstpSvc /y

net stop MSOLAP$SQL_2008 /y

net stop TrueKeyServiceHelper /y

net stop sacsvr /y

net stop VeeamNFSSvc /y

net stop FA_Scheduler /y

net stop SAVAdminService /y

net stop EPUpdateService /y

net stop VeeamTransportSvc /y

net stop “Sophos Health Service” /y

net stop bedbg /y

net stop MSSQLSERVER /y

net stop KAVFS /y

net stop Smcinst /y

net stop MSSQLServerADHelper100 /y

net stop TmCCSF /y

net stop wbengine /y

net stop SQLWriter /y

net stop MSSQLFDLauncher$TPS /y

net stop SmcService /y

net stop ReportServer$TPSAMA /y

net stop swi_update /y

net stop AcrSch2Svc /y

net stop MSSQL$SYSTEM_BGC /y

net stop VeeamBrokerSvc /y

net stop MSSQLFDLauncher$PROFXENGAGEMENT /y

net stop VeeamDeploymentService /y

net stop SQLAgent$TPS /y

net stop DCAgent /y

net stop “Sophos Message Router” /y

net stop MSSQLFDLauncher$SBSMONITORING /y

net stop wbengine /y

net stop MySQL80 /y

net stop MSOLAP$SYSTEM_BGC /y

net stop ReportServer$TPS /y

net stop MSSQL$ECWDB2 /y

net stop SntpService /y

net stop SQLSERVERAGENT /y

net stop BackupExecManagementService /y

net stop SMTPSvc /y

net stop mfefire /y

net stop BackupExecRPCService /y

net stop MSSQL$VEEAMSQL2008R2 /y

net stop klnagent /y

net stop MSExchangeSA /y

net stop MSSQLServerADHelper /y

net stop SQLTELEMETRY /y

net stop “Sophos Clean Service” /y

net stop swi_update_64 /y

net stop “Sophos Web Control Service” /y

net stop EhttpSrv /y

net stop POP3Svc /y

net stop MSOLAP$TPSAMA /y

net stop McAfeeEngineService /y

net stop “Veeam Backup Catalog Data Service” /

net stop MSSQL$SBSMONITORING /y

net stop ReportServer$SYSTEM_BGC /y

net stop AcronisAgent /y

net stop KAVFSGT /y

net stop BackupExecDeviceMediaService /y

net stop MySQL57 /y

net stop McAfeeFrameworkMcAfeeFramework /y

net stop TrueKey /y

net stop VeeamMountSvc /y

net stop MsDtsServer110 /y

net stop SQLAgent$BKUPEXEC /y

net stop UI0Detect /y

net stop ReportServer /y

net stop SQLTELEMETRY$ECWDB2 /y

net stop MSSQLFDLauncher$SYSTEM_BGC /y

net stop MSSQL$BKUPEXEC /y

net stop SQLAgent$PRACTTICEBGC /y

net stop MSExchangeSRS /y

net stop SQLAgent$VEEAMSQL2008R2 /y

net stop McShield /y

net stop SepMasterService /y

net stop “Sophos MCS Client” /y

net stop VeeamCatalogSvc /y

net stop SQLAgent$SHAREPOINT /y

net stop NetMsmqActivator /y

net stop kavfsslp /y

net stop tmlisten /y

net stop ShMonitor /y

net stop MsDtsServer /y

net stop SQLAgent$SQL_2008 /y

net stop SDRSVC /y

net stop IISAdmin /y

net stop SQLAgent$PRACTTICEMGT /y

net stop BackupExecJobEngine /y

net stop SQLAgent$VEEAMSQL2008R2 /y

net stop BackupExecAgentBrowser /y

net stop VeeamHvIntegrationSvc /y

net stop masvc /y

net stop W3Svc /y

net stop “SQLsafe Backup Service” /y

net stop SQLAgent$CXDB /y

net stop SQLBrowser /y

net stop MSSQLFDLauncher$SQL_2008 /y

net stop VeeamBackupSvc /y

net stop “Sophos Safestore Service” /y

net stop svcGenericHost /y

net stop ntrtscan /y

net stop SQLAgent$VEEAMSQL2012 /y

net stop MSExchangeMGMT /y

net stop SamSs /y

net stop MSExchangeES /y

net stop MBAMService /y

net stop EsgShKernel /y

net stop ESHASRV /y

net stop MSSQL$TPSAMA /y

net stop SQLAgent$CITRIX_METAFRAME /y

net stop VeeamCloudSvc /y

net stop “Sophos File Scanner Service” /y

net stop “Sophos Agent” /y

net stop MBEndpointAgent /y

net stop swi_service /y

net stop MSSQL$PRACTICEMGT /y

net stop SQLAgent$TPSAMA /y

net stop McAfeeFramework /y

net stop “Enterprise Client Service” /y

net stop SQLAgent$SBSMONITORING /y

net stop MSSQL$VEEAMSQL2012 /y

net stop swi_filter /y

net stop SQLSafeOLRService /y

net stop BackupExecVSSProvider /y

net stop VeeamEnterpriseManagerSvc /y

net stop SQLAgent$SQLEXPRESS /y

net stop OracleClientCache80 /y

net stop MSSQL$PROFXENGAGEMENT /y

net stop IMAP4Svc /y

net stop ARSM /y

net stop MSExchangeIS /y

net stop AVP /y

net stop MSSQLFDLauncher /y

net stop MSExchangeMTA /y

net stop TrueKeyScheduler /y

net stop MSSQL$SOPHOS /y

net stop “SQL Backups” /y

net stop MSSQL$TPS /y

net stop mfemms /y

net stop MsDtsServer100 /y

net stop MSSQL$SHAREPOINT /y

net stop WRSVC /y

net stop mfevtp /y

net stop msftesql$PROD /y

net stop mozyprobackup /y

net stop MSSQL$SQL_2008 /y

net stop SNAC /y

net stop ReportServer$SQL_2008 /y

net stop BackupExecAgentAccelerator /y

net stop MSSQL$SQLEXPRESS /y

net stop MSSQL$PRACTTICEBGC /y

net stop VeeamRESTSvc /y

net stop sophossps /y

net stop ekrn /y

net stop MMS /y

net stop “Sophos MCS Agent” /y

net stop RESvc /y

net stop “Acronis VSS Provider” /y

net stop MSSQL$VEEAMSQL2008R2 /y

net stop MSSQLFDLauncher$SHAREPOINT /y

net stop “SQLsafe Filter Service” /y

net stop MSSQL$PROD /y

net stop SQLAgent$PROD /y

net stop MSOLAP$TPS /y

net stop VeeamDeploySvc /y

net stop MSSQLServerOLAPService /y

The next change is the mutex name. In this version it is “HappyLife^_-“, so, can it be complex to make a vaccine based on the mutex name because it can be changed easily in each new sample.

The next change is the hardcoded public key of the malware that is different to the previous version.

Another change is the file created; the first version creates the file with the name “Favourite” but this version creates this file with the name “Comone”.

However, the algorithm of crypto of the files and the mark in the file crypted is the same.

Another difference is in the ransom note that is now clearer with some changes in the text and now has 3 emails instead of one to contact the ransomware developers.

FIGURE 15.Example of the new ransom note

Other Samples of the Malware

Clop is a ransomware family that its authors or affiliates can change in a quick way to make it more complex to track the samples. The code largely remains the same but changing the strings can make it more difficult to detect and/or classify it correctly.

Now we will talk about the changes of some samples to see how prolific the ransomware Clop is.

Sample 0403db9fcb37bd8ceec0afd6c3754314 has a compile date of 12 February, 2019 and has the following changes if compared with other samples:

The file created has the name “you_offer.txt”.

The name of the device in the fake call to “EraseTape” and “DefineDosDeviceA” functions is “..1”.

An atom searched for nothing has the name of “$$$$”.

The mutex name is “MoneyP#666”.

The resources crypted with the ransom note and the bat file are called “SIXSIX1” for the batch file and the another one for the ransom note “SIXSIX”.

The name of the batch file is “clearsystems-10-1.bat”.

The key for the XOR operation to decrypt the ransom note and the batch file is:

“Clopfdwsjkjr23LKhuifdhwui73826ygGKUJFHGdwsieflkdsj324765tZPKQWLjwNVBFHewiuhryui32JKG”

The batch file is different to the other versions, in this case not changing the boot config of the target victim.

FIGURE 16. Another version of the batch file

The email addresses to contact are: [email protected] and [email protected] .

As a curiosity, this ransom note has a line that another does not have: “Every day of delay will cost you additional +0.5 BTC” (about 1500-1700 $).

The 3ea56f82b66b26dc66ee5382d2b6f05d sample has the following points of difference:

The name of the file created is “popup.txt”.

The DefineDosDeviceA name is “1234567890”

The mutex is “CLOP#666”.

The date of compiled this sample is 7 of February.

The name of the bat file is “resort0-0-0-1-1-0-bat”.

This sample does not have support for Windows XP because a API that does not exist in Windows XP.

The Atom string is “27”.

Sample 846f93fcb65c9e01d99b867fea384edc , has these differences:

The name of the file created is “HotGIrls”.

The DosDevice name is “GVSDFDS”.

Atom name: KLHJGWSEUiokgvs.

Batch file name “clearnetworksdns-11-22-33.bat”.

The email address to contact: [email protected], [email protected] and [email protected].

The ransom note does not have the previous string of increasing the price, but the maximum number of files that can be decrypted is 7 instead of 6..

As the reader can understand, Clop changes very quickly in strings and name of resources to make it more complex to detect the malware.

We also observed that the .BAT files were not present in earlier Clop ransomware versions.

Global Spread

Based on the versions of Clop we discovered we detected telemetry hits in the following countries:

Switzerland

Great Britain

Belgium

United States

The Netherlands

Croatia

Porto Rico

Germany

Turkey

Russia

Denmark

Mexico

Canada

Dominican Republic

Vaccine

The function to check a file or a folder name using the custom hash algorithm can be a problem for the malware execution due if one of them is found in execution, the malware will avoid it. If this happens with a folder, all the files inside that folder will be skipped as well.

As the algorithm and the hash is based on 32bits and only in upper case characters, it is very easy to create a collision as we know the target hashes and the algorithm

It cannot be used as vaccine on itself, but it can be useful to protect against the malware if the most critical files are inside of a collision folder name.

FIGURE 17. Collision of hashes

In the screenshot “BOOT” is a correct name for the hash, but the others are collisions.

This malware has a lot of changes per version that avoid making a normal vaccine using mutex, etc.

The Odd One in the Family

That not all ransomware is created equally, especially goes for Clop. Earlier in this blog we have highlighted some interesting choices the developers made when it came to detecting language settings, processes and the use of batch files to delete the shadow volume copies. We found in the analysis some unique functions compared with other ransomware families.

However, Clop does embrace some of the procedures we have seen with other ransomware families by not listing the ransom amount or mentioning a bitcoin address.

Victims must communicate via email instead of with a central command and control server hosting decryption keys. In the newer versions of Clop, victims are required to state their company name and site in the email communications. We are not absolutely sure why this is, but it might be an effort to improve victim tracking.

Looking at the Clop ransom note, it shares TTPs with other ransomware families; e.g. it mimics the Ryuk ransomware and contains similarities with BitPaymer, however the code and functions are quite different between them.

Coverage

Customers of McAfee gateway and endpoint products are protected against this version.

GenericRXHA-RK!3FE02FDD2439

GenericRXHA-RK!160FD326A825

Trojan-Ransom

Ransom-Clop!73FBFBB0FB34

Ransom-Clop!0403DB9FCB37

Ransom-Clop!227A9F493134

Ransom-Clop!A93B3DAA9460

GenericRXHA-RK!35792C550176

GenericRXHA-RK!738314AA6E07

RDN/Generic.dx

bub

BAT/Ransom-Clob

BAT/Ransom-Blob

McAfee ENS customers can create expert rules to prevent batch command execution by the ransomware. A few examples are given below for reference.

The following expert rule can be used to prevent the malware from deleting the shadow volumes with vssadmin (“vssadmin Delete Shadows /all /quiet”).

When the expert rule is applied at the endpoint, deletion of shadow volume fails with the following error message:

The malware also tries to stop McAfee services using command “net stop McShield /y”. The following expert rule can be used to prevent the malware from stopping McAfee Services:

When the expert rule is applied at the endpoint, the attempt to stop McAfee service using net command fails with the following error message:

Indicators of Compromise

The samples use the following MITRE ATT&CK techniques:

Execution through API (Batch file for example).

Application processes discovery with some procedures as the hashes of the name, and directly for the name of the process.

File and directory discovery: to search files to encrypt.

Encrypt files.

Process discovery: enumerating all processes on the endpoint to kill some special ones.

Create files.

Create mutants.

Conclusion

Clop ransomware shows some characteristics that enterprises are its intended targets instead of end consumers. The authors displayed some creative technical solutions, to detect the victim’s language settings and installed programs. On the other hand, we also noticed some weird decisions when it came to coding certain functionalities in the ransomware. Unfortunately, it is not the first time that criminals will make money with badly programmed malware.

Clop is constantly evolving and even though we do not know what new changes will be implemented in the future, McAfee ATR will keep a close watch.

IOCs

bc59ff12f71e9c8234c5e335d48f308207f6accfad3e953f447e7de1504e57af

31829479fa5b094ca3cfd0222e61295fff4821b778e5a7bd228b0c31f8a3cc44

35b0b54d13f50571239732421818c682fbe83075a4a961b20a7570610348aecc

e48900dc697582db4655569bb844602ced3ad2b10b507223912048f1f3039ac6

00e815ade8f3ad89a7726da8edd168df13f96ccb6c3daaf995aa9428bfb9ecf1

2f29950640d024779134334cad79e2013871afa08c7be94356694db12ee437e2

c150954e5fdfc100fbb74258cad6ef2595c239c105ff216b1d9a759c0104be04

408af0af7419f67d396f754f01d4757ea89355ad19f71942f8d44c0d5515eec8

0d19f60423cb2128555e831dc340152f9588c99f3e47d64f0bb4206a6213d579

7ada1228c791de703e2a51b1498bc955f14433f65d33342753fdb81bb35e5886

8e1bbe4cedeb7c334fe780ab3fb589fe30ed976153618ac3402a5edff1b17d64

d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9

cff818453138dcd8238f87b33a84e1bc1d560dea80c8d2412e1eb3f7242b27da

929b7bf174638ff8cb158f4e00bc41ed69f1d2afd41ea3c9ee3b0c7dacdfa238

102010727c6fbcd9da02d04ede1a8521ba2355d32da849226e96ef052c080b56

7e91ff12d3f26982473c38a3ae99bfaf0b2966e85046ebed09709b6af797ef66

e19d8919f4cb6c1ef8c7f3929d41e8a1a780132cb10f8b80698c8498028d16eb

3ee9b22827cb259f3d69ab974c632cefde71c61b4a9505cec06823076a2f898e

The post Clop Ransomware appeared first on McAfee Blogs.

#gallery-0-6 { margin: auto; } #gallery-0-6 .gallery-item { float: left; margin-top: 10px; text-align: center; width: 33%; } #gallery-0-6 img { border: 2px solid #cfcfcf; } #gallery-0-6 .gallery-caption { margin-left: 0; } /* see gallery_shortcode() in wp-includes/media.php */

Go to Source Author: Alexandre Mundo Clop Ransomware Original Post from McAfee Author: Alexandre Mundo This new ransomware was discovered by Michael Gillespie on 8 February 2019 and it is still improving over time.

#McAfee Security

0 notes

honestsycrets · 5 years ago

Text

65 Shillings | [King Alfred x Slave!Reader]

❛ pairing | alfred x slave!reader

❛ type | very soft oneshot

❛ summary | queen Judith has a slave to watch over alfred when she can’t-- and things happen.

❛ warnings | slavery, referenced prostitution (as concept), referenced sexual assault (as concept), alfred’s sickness, gentle love story, light jealousy, Bjorn being bjorn.

❛ sy’s notes | this is a very slow and soft story. i’m sorry if there’s some discrepancies also, i started using ‘her’ and switched to ‘you’.

His sickness happens again.

Alfred spreads his bleary eyes open, past the water that runs by a cool damp towel. He hears you wipe his pale skin clean and turns over. The room is silent all but for the occasional clink of his guards outside the heavy wooden door. His eyelids feel like gates of steel as they pull apart. He pulls himself up to sit all at once and all at once his world spins.

“Wait-- m’king,” ah, so there it is. The slave girl who mother purchased. Alfred tilts his head toward you, falling more than tilting really. You secure his head against your breast. “You’re not well.”

You smell clean. Not of flowers or of dirt. He notes that it’s mother’s preference to have a clean slave to promote his own healing. He smells the distant scent of blessed holy oil when your fingers shakily cover over his head. “I should…” you speak small. So small and soft and warm. Alfred closes his eyes. “Not yet.”

“O-oh,” you say softly. His heavy hand supports his weight on your waist, equally small under his hands. His body sags in the comfort, barely managing his words. “Get into my bed.”

“I-- I’ve never been leant out.” No doubt your mind fell like a fallen angel because he feels you quiver in what he deems is fear. A slave woman cost a man 30 shillings if prostituted out. Although Alfred had no such interests.

“It’s none of that,” he clarifies. “I’ve the mind to think this position is uncomfortable for you.”

You nod, removing your shoes and dare you say, climb into the bed with the king. You reach for the damp cloth when you suddenly realize that the king is shivering. Your hand settles on top of his head. “I have a salve that can--”

“It’s nothing.”

Your hands palm the lavish sheets. Perhaps you feel wrong to be here, in a king’s bed, without serving him his pleasure or caring for him in other manners. Alfred rests his head upon downy pillows, an even but rough breathing causing his chest to rise and fall.

“What is your name?” he asks.

You give him your name. It rolls off his tongue and past hazy eyes, he’s somewhat aware of the damp cloth over his forehead. The cool water dribbles over his forehead, relieving the fire that settled over his damp skin.

Usually, he would never have been so brazen. But today he seeks the warmth and comfort from someone other than his doting mother. He dares to reach out, clutching your shoulder and brings you flush against his side. His chest flutters when your hand comes upon his chest: small and secure. He doesn’t correct you that night.

Alfred feels manageable a few days after; he manages to dress with his new slave’s aid, dragging a belt across his luscious dark red tunic. He draws up his drawers and seals them shut, saving your beautiful cheeks from lighting on hot fire. You kneel before him to lace up his shoes. The door whirls open, clacking boots draw his attention up. Standing there he finds Bjorn. His ocean blue eyes look uncharacteristically subdued, only brightening up when you stand up, sparing you a long look over.

Longer than it needs to be. Alfred feels the pressing need to clarify something as it eats upon his mind for longer than it should. Your level of discomfort is palpable. Your head lowers, fingers running over the wonderfully long strands of hair down your breast. “She is not for sale.”

Bjorn’s lips spread out into a forced smile. “Are you ready?”

He has a mind to think that was not what he had in mind in the first place. Alfred familiarizes himself with the common people of his plaza as well as the Vikings. Judith is at his side as the Vikings pick and tease, going as far as to throw jeers after you. He knows as much based upon two such men trailing behind Bjorn, Ubbe, Torvi, Judith, and yourself. Of them all, Ubbe is the one to call out after them.

“Protect your skirt,” Judith tells you. “Or these men will take it from you.”

Clearly, Ubbe would not always be there to protect you. Nor Alfred, whose eyes last upon you as you rush to keep up, effectively brushing the king’s sleeve. You acknowledge his mother with a nod and keep quiet. Alfred reaches over, squeezing your bare-knuckled hand with his, crusted in rings of a king.

“I will do something of it.”

Out of the corner of his eye, he’s almost sure that was a smile that squirmed its way up to your lips. He releases your hand just as quickly as he took it. Judith fails to realize what her son is meant until the week passes.

“The attention you give her is unwarranted.”

At the beginning of the next week, Judith has her concerns on the back of what Alfred has ordered of the witan. Aethelred sits on one side of him, his mother on the other. Aethelred reaches for his goblet as he speaks.

“And now kings are not allowed concubines?”

“If anyone rapes the slave of a commoner, he shall pay five shillings to the commoner, and a fine of sixty shillings. The slave is not recompensed, only the owner.” His mother recites it as if it had been pressing her mind for such a time, that it ate her inside. “Is that not the law you’ve instated for her?”

His cheeks flare. Alfred reaches for his drink uncomfortably. He takes a drink. “I like her. What does our relationship harm?”

“If like turns to love. Alfred,” she reaches out. “Do not be misled by a slave.”

“I am not,” he reasons it off, despite knowing that you stand in the background. “The laws I’ve instated ensure the safety of all of our women.”

She’s suspicious of his intentions. He should have known she would be. Judith swirls her cup and drinks of it, washing down her dinner. “Then you’ll be glad to know I’ve arranged it.”

Alfred nods-- and sees your crestfallen smile.

You imagine his wife is beautiful.

She probably is born in fair skin and deep hair as deep as the night sky. It likely touches her knees in its beauty. After all-- she is a princess. And he is a king. It’s a fair agreement. It’s that thought that he knows you carry when you slip behind the dividing wall to undress into your plain white nightgown.

Except this time, his hands curl around your shoulders as you pull it on, realizing that the king had been watching all along. It is his right to; as king, as your owner. “You’re upset,” he says pointedly.

“I’m fine,” you whisper, tugging the dress down lower. “It is nothing, I am tired.”

“Don’t lie to me,” he says sharply, remembering his tone. “Please… not to me. What do you need?”

You loosen your hair, letting it down from its bound state, and turn to face him. This is his favourite time. A time when his mother, his brother, his state all melted away. He could have no other worries than the woman before him. Your eyes soften. You want to tell him, he knows, but he only feels you turn away. Whatever it was-- you wouldn’t tell him.

His temper flares then. He lurches out for your elbow, tugging you back to face him. Despite the growth of splotchy bruising on your arm, he holds you in place with cool emotion. “What is it?” he tempers out his hiss to an even tone. “What have I not done for you?”

“I am on borrowed time.”

“What do you mean?” Alfred asks.

“When you marry, I will be sent away.”

“You would never--” he begins to reason with something he knows he could not hold true. A wife would do as a wife wanted to do. If that meant sending you away, what sort of fool would he be not to? “I will work and then I will be forced to serve men on Ember weeks to earn something for myself.”

“You are not a prostitute,” Alfred says, clopping his other foot behind him for emphasis. He leans forward, yet still holding your arms, bowing his head. “I have done all that I can to assure that.”

“I know. I know you have. It-- I… it’s just it’s inevitable.”

Inevitable things were practical things such as the sun rising and falling. Church on Sundays. The need to see the Witan. Not this-- not the possibility of being raped by men or serving like a harlot. Alfred stands upright and draws you in, and this time it’s you that shivers in his arms.

He doesn’t have time for this new woman.

Mother brings her anyway, his cousin-- one who would be his newfound wife. You’ve become still and quiet, as if the distance of a door had slammed between you and him. It burns him to know this was the reason of such things. But, you should have known it was inevitable. He always did.

“Princess Aelswith.” His lips moved over her knuckles. You mutter something that he half-listens to. His disinterest was palpable. It doesn’t escape him that you look away, even as he sweeps away in a heavy sweep of cloth.

She sleeps with Bjorn. He’s not so unattached to the Vikings that he doesn’t know this. His intended princess has lain with him but he doesn’t care much for that knowledge so much as he cares about what it could do for him. He could send her away.

“Marriage?”

Alfred stood in front of his desk with his arms drawn over his chest. Aelswith was not a woman he thought he could force into any sort of marriage. Much less to a

Viking-- but she is torn between damningly enthralled by Bjorn and repulsed. Bjorn stands there like a great bear, unmoved by the push into this marriage, but enthralled as well.

“I expect it isn’t an issue.” He leers, setting his hand to the desk. “I’ve heard you’ve helped yourself to my cousin as it is.”

Bjorn’s expression curls. Surprise? Perhaps. Disgust? No.

“We should join with one another in an alliance.” He pauses. “Like family.”

Bjorn doesn’t object.

He’s secured loose ends. Loyalty through Bjorn and Ubbe, who muses when he hears the news but isn’t surprised. Aelswith welcomes an opportunity to become something more than what she is expected to be and admits her failings to him. He doesn’t smear her looseness. Bjorn is worse. Nothing more could be expected of her-- or Gunnhild who follows Bjorn after his battle against King Harald’s forces. He’s heard a great deal of polygyny.

“Are you feeling well?”

His mind has wandered off again. He holds the reins to the horse tight in his fist, glancing over only momentarily to you at his side. He’s had the luxury of riding in on a horse while you, for much of this time, have walked beside him through the entirety of this village. Undoubtedly you must be exhausted. And yet-- you ask him how he fairs? Alfred scoffs so lightly.

“I want to offer you freedom,” Alfred says, bringing a hand away from his chest, and offering out what he had in his hand. As he unfolds it he offers a lilac-blue flower, bouncy and strong. A crowd has gathered in the afternoon, where the sun has begun to set, and church will soon be held. You stare at the flower in his fingertips but do not take it until he urges you to do so. He dismounts. “And ask you to marry me tonight.”

“...oh.”

The crowd has gotten murky and loud. Over their whispers, you can hear what they’re saying. A slave? They say. You shirk from their whispers even as Alfred jerks his hands up, turning around to look at them as if appalled by their words. “Hush. If you don’t want to…”

“I do!” you shout. “It is just… it is…”

There’s a genuine fear in your eyes. Perhaps it’s too much all at once. Alfred reaches out, cradling your head against his chest. He grips your fingers in his hand, setting a kiss upon the knuckle, and carrying on with a soft smile.

“Not today then,” Alfred says. “We have the time.”

@tephi101 @alicedopey @supernaturalvikingwhore @tootie-fruity @titty-teetee @queen-see-ya-in-valhalla @ethereallysimple @deathbyarabbit @deathbyarabbit @readsalot73 @natalie-rdr @lol-haha-joke @lisinfleur @hissouthernprincess @marvelousse @dangerous-like-a-loaded-pistol @vikingsmania @wish-i-was-a-mermaid @lif3snotouttogetyou @gruffle1 @cris101071 @gold-dragon-slayer @babypink224221 @wonderwoman292 @naaladareia @beyond-the-ashes @generic-fangirl @chinduda @laketaj24, @peaceisadirtyword, @ly–canthrope @cris101071 @daughterofthenight117 @unassumingviking @ladyofsoa, @inforapound @winchesterwife27 @feyrearcheron44@readsalot73 @squirrelacorngliterfarts @gold-dragon-slayer @medievalfangirl @sallydelys @bluearchersstuff @affectionrabbitt @therealcalicali @whatamood13 @notyouraveragegirl17 @igetcarriedawaywithyou @unacceptabletatertots @ivarandersen @stra-vage @tgrrose @cookies186 @learninglemni-blog @theleeshanotlouise @soiproclaim @msmorganforever

#Alfred the Great x Reader #Alfred x Reader #Alfred/Reader #Alfred the Great/Reader #Vikings imagines #vikings imagine #vikings x reader #vikings/reader

201 notes · View notes

honestsycrets · 5 years ago

Text

Alfred the Great | Love Alphabet

❛ sy’s notes | This one includes a lot of life scenarios of Alfred and his wife. I enjoy how it came out-- and I hope you do too.

A = Affection (PDA, what sort of affection they give)

“Not here,” he bends his head. You stand behind his throne chair, settling your hand on his shoulder. You press a kiss to his rosy cheek, in the presence of the others, as he waves you off.

Alfred has never been someone who was particularly touchy due to the way he was brought up. While small touches were always common, the way you stroke him-- touch him, caress him, out in the open gives him both a sense of delight and shyness when he realizes that others are watching.

B = Babies (Anything you want about babies)

“Perhaps you should show me.”

“Hold him here,” you guide Alfred’s hands. As he kneels beside your bed, a king on his knees, Alfred feels like any other man-- not a king, fumbling for the right hold.

Has no idea what to do with a baby of his own. He has no experience with holding a child and has no idea what to do when you place his in his arms, only finding himself staring down upon the thing, utterly lost.

C = Cuddles (How they cuddle or are cuddled)

His days are long. As a king, Alfred very rarely spends time in your rooms. He’s busy with putting all his energy into England for England. So, at the end of a long night, when he crawls in beside you, his hand might drape over your waist. He’d set an apologetic kiss to your head and fall asleep.

D = Darling (Pet names)

Small ones. He prefers to call you more proper names while in public; his wife, his queen, being the chief of them. Behind closed doors then, he might be more lazy with his pet names.

E = Enamored (how hard do they fall when in love)

“Who was that girl there--” he points through the crowd. You pick your skirts up, then disappear from where you came, weaving through the crowd here to see the king.

“Where m’lord?”

“She was just there.”

Admittedly, he has no time to fall in love. His interaction with women outside of his family is limited to chamber maids and the occasional woman during feasts. That is why his marriage was arranged. But if by happenstance he does meet a woman, it’s just that: a sudden pang of surprise.

F = Firsts (A first on anything you pick)

“She won’t know,” you swish around the horse, mounting first, then extending your hand toward him. He takes your hand, despite everything in him saying he shouldn’t, not that day. “Come! Live a little, prince-boy.”

First fling-- Taking him away from Judith and Aethelwulf is too easy. With everyone’s eye on Aethelred, all you have to do is fool Judith to slip her precious boy away. Alfred is unsure of it-- his mother’s voice beating in his head, where were you! He falls ill when you bring him back.

G = Good Morning (How do they wake you up)

Do forgive me, the parchment reads the day after your wedding. A small golden and pearl necklace sits on top of the crisp paper. I’ve too much to do. I will see you as god allows.

H = Hugs (Do they like hugs?)

He does. They’re a small comfort to him when he’s going off to war, but even more so when they are followed up with a kiss, and the command for him to come back safely.

I = In Labor (Labour and Delivery)

“Women have been doing this since the dawn of time, Alfred.” His knuckle taps repeatedly over the parchment. Yes, women have been doing this since the dawn of time-- but not his woman.

He can’t get a lick of work done. He’s too busy thinking of his wife, who labors alone, in her modesty has sent him out. Get something done, he isn’t here yet, you told him. Strong woman. And still he gets nothing done, leaves his chambers, and seeks you out.

J = Jealousy (Are they jealous? How do they handle it?)

“Do you think the blonde one or the brown one is the bigger brother?” your chamber maids say, giggly amongst the quietly gathered. Before him, the Northman stood.

“The blond,” you speak up, rarely. You never spoke. “What? He’s a big man.”

Your chambermaids gasp, looking up. “Ooh,” they squeak-- and regretfully, Alfred’s head snaps over too.

Watchfully. He’s not admittedly jealous-- but quietly and privately so. He asks many questions, rather than interrogate you about your interests in another, to make sense of what happened earlier. You aren’t jealous, are you? you hush him with a kiss. Of course not, he was simply-- concerned.

K = Kisses (How do they kiss? How often?)

Gently-- at any point that he can. Leaving or coming, he doesn’t spare any kisses. He’s often gentle, and so you might have to push him to be a little more passionate. Shyness won’t get him everything after all.

L = Loyal (How loyal are they?)

Absolutely.

M = Memory (Their favourite memory about you?)

His grandfather’s bath was a tranquil place. You come here, every moment that you can spare apart from seeing the people, caring for the settlement, and doing your duties as queen. You strip away your clothes and fold them, not hearing the door squeak open, nor Alfred come in. The water plips as you shift into it. At the sound of boots you whirl about, holding your chest.

“Please.” Alfred stands there. His favourite moments of you are your most private moments. The moments when you think you’re all alone, but aren’t. “Go on-- clean yourself.”

N = Never! (Dealbreakers)

He can’t deal with someone who might whine about his time. His first concern is England and everything else is secondary to the fact. In his mind, his partner must understand where his allegiance must be.

O = On the Rocks (How do they make up?)

“Why are you here?” you unclipped the earring from the back of your ear, turning to find Alfred waiting by your table where you kept your jewelry box. “Does England not need its king today?”

“Not if you are still angry,” he raps his knuckles over the table. “I am sorry.”

With his time. It’s so important, and so scarce, that if he knows you are disappointed with him, it’s the one thing he can do to get back into both your good graces and show he’s apologetic about what happened. Or at the least, wants to make amends.

P = Playtime (Any headcanons on sex)

“Alfred what are you doing?”

He’ll try almost anything once. At the start of the relationship, you would take the more dominant role by inciting sex. But, after Ubbe came, Alfred seemed to change, putting more effort into chasing you with a strange confidence. The dominance is strange-- but welcome. You wonder how much he told Ubbe about your sex life.

Q = Quiet Time (How do they wind down?)

After his day, if he can sneak away, he likes to cuddle in bed. It’s better than sex to him because he can lace his fingers through yours, and carry off all thoughts of the long day away.

R = Rapture (What makes them happy?)

He took you that morning to watch him spar with Ubbe. Ubbe was fantastic, you’d admit. A true Northman, strong, witty, quick. But your eye was on Alfred alone, following the way he dodged, the way he moved. You held a cup ready for him when he collapsed beside you.

“What... do you think?” he heaved between heavy breaths. He could fall into illness, but he didn’t. He was strong, and as he chugged his drink, your hand caressed his chest, coming up behind his neck, kissing him hard and strong.

“You were perfect.” He admits-- he likes to impress you.

S = Soulmate (What do they think of soulmates?)

“A soulmate?” he asks you about the concept. He’s not heard of such things-- but it sounds... fitting, he’d say.

T = Together (What do you like to do together?)

Off of the carriage, you walked in the dust. Your maids said you would dirty your dress and yet, you didn’t care, you wanted to be among the children. After his duties, Alfred clopped by on his horse, leaning down in his saddle to hand something toward you. You pluck it from his fingers and realize-- it’s a sweet smelling flower.

Secretly, Alfred enjoys it when you accompany him on his trips. He often does get sick, so if it has to happen, he would prefer that it happen when you are by his side.

U = Unyielding (How do they handle interlopers on the relationship?)

The queen’s hands had been over him. Not the queen-- not his queen-- but the queen from another place. You had seen the way he pushed her hands down, cupping them together with a shake of his head. “I have a wife,” he stressed. “And no interests in another.”

Alfred doesn’t tolerate it. He makes sure to snuff out the concerns of women coming after him where they stand. Similarly, he expects you to do the same, although it he must, he will.

V = Vulnerable (Are they vulnerable often? How do they handle it?)

Not often. Apart from his family, he might be vulnerable with you. Romance and family life is the one place where he might be vulnerable-- and hopes that you’ll protect that vulnerability.

W = Wedding (Wedding headcanons)

“I’ll make it up to you,” Alfred says once the doors are finally shut. You roll on your side, over the small stain of blood dribbled over the sheets, yet still sore. He takes initiative to shift on top of you, his forearm balancing himself.

“That is not the way you wanted to...” he drops off, knowing that it was foolish and silly when you cup his soft cheek. It’s okay, you have to tell him, over and over again.

Being a king, it’s all done according to how it has to be done. While the wedding is luxurious, it could be better. He knows that-- you deserve his affections in private.

X = (E)x (How do they handle exes? What do they do if they see them)

With a semblance of longing but also of respect. If he’s moved on, he’ll gingerly nod his head, go on his way. If he hasn’t, he might wonder to himself-- perhaps he could have done this, or that, better.

Y = Yearning (What do they do when they miss you?)

Alfred held the end of the table, chewing his cheek, the paper was still not done. He has work to do-- but he can’t help wonder, where were you? Were you well? He turns to one of his guards, “Call the queen,” Alfred stands upright, throwing his hand out lightly. “Tell her I want to eat with her.”

He can’t get any work done. So, he does the only thing he can think to do-- he calls you into his quarters and hopes that this blaring need will quell. Or, if his body is so weak, he has to... eat first.

Z = Zzz… (Sleeping headcanons)

When he’s exhausted, he collapses into bed beside you. He doesn’t remember when he falls asleep, only that you’re there beside him.

#Alfred x Reader #Alfred/Reader #Alfred the Great x Reader #Alfred the Great/Reader #Vikings imagines #Vikings imagine #vikings/reader #vikings x reader #honestsycrets #TV: Vikings imagines #saxon imagine #saxon imagines

197 notes · View notes

honestsycrets · 5 years ago

Text

Hi, Soldier | [ Alfred x Reader ]

❛ pairing | soldier!alfred x librarian!reader

❛ type | oneshot

❛ summary | waiting for alfred to come home, the reader fixes the books in the library.

❛ tags | library au, wwii soldier!alfred, implied war time violence, loss of vision.

❛ sy’s notes | i wrote this fic for @maggiescarborough ‘s birthday. she asked me for a library alfred au a while ago and i just couldn’t get it to what i liked until now. happy birthday baby!

It was too high, you thought as you reached up on your toes. The cart squeaked outrageously as you got to the final books to stock that day. Your boss and husband’s cousin-in-law, Mr. Sigurd Ragnarsson, gave you leave after you would finish stocking this.

You never knew when there might be another.

When another air raid would come down upon your head, that was. It was war. Life was forced to consider to the best of its ability and still, you might wake up in the morning in a large bed, where he was meant to be, and feel the cold space beside you growing in its intensity.

When you received post, it was with that fleeting hope that another might join your growing bucket of letters from war. The ladder had fallen off the track again. This time, your brother-in-law wasn’t here to fix it. Nor your husband-- who always had an answer.

“I can fix it,” you’re favourite spunky niece-in-law would say. You glanced off to her, holding books between her legs. When her mother was off working as a receptionist, you would often watch her until Sigurd had the opportunity to get off of managing his many companies to get her. Today was nothing short of the same.

“After we finish with these books,” you gesture toward your hand when you see it. The edition from 1926, The Private Life of Helen of Troy, which you had not read. It throws you back to the first moment you met your soldier.

He came in a hurry, dabbling his fingers through books, before he’d have to return to base. While all the other men were in the pubs, he found himself here, leafing through books hoping for one to read. You hadn’t noticed him as you squeaked along the aisles-- until coming upon his aisle, you suddenly became aware of the tall soldier who took up most of the room.

Your lips were suddenly chapped and dry. Your knowledge of soldiers was limited to the men your sister brought home and to be fair, they were not the reading type. He pulled a book free, pulling it into his open hand, and you found yourself looking down to your own. The Private Life of Helen of Troy-- it went there.

You left your useless clump of a cart, stuffing the books related to this section in your arms, and clopped over his way. It was then that the soldier glanced at you with curious, glittery eyes that contrasted against to his finely combed black hair on his head and lip. You tugged the ladder just to side of him, squeaking as your mary janes took the first step, smoothing out your skirt with emphasis on not flashing him with your undergarments and reached-- that was were problem brewed, because you couldn’t quite reach the area you needed to be.

Where your soldier stood.

“Let me help you,” he spoke, his voice low and smooth, like the honey in your tea. You drew your hand back when you felt him push the ladder on its wheels toward the section of historical period books. Then with a clop, clop, clop, the soldier climbed with his black boots up behind you. He was close enough to feel this thick, ironed uniform pressing up against your yellow dress.

“Oh--”

“Right behind you,” he muttered as he slipped his hand over yours. “You’re alright?”

“Yes, I mean--” you gave pause. “Yes.”

“The Roman non-fiction is right there, then.” He muttered softly and you could feel the fibers of his moustache against the shell of your ear as a hand, crisp with a playfulness in slipping the book into its hole with a small push.

You were somewhat disappointed when he slipped off from behind you, allowing you to set the last of the books in their place before turning down the ladder. The soldier held out his hand to help you down even-- and despite uncertainty, you took his hand to the safe ground.

“Thank you,” you said. “The cart-- and the ladder aren’t the best tools. They’re broke half the time anyway.”

“I can fix that for you.” The soldier blurted out before he seemed to register what he said or the limitations of it. Maybe Mr. Ragnarsson didn’t want you to-- but you had the sudden feeling-- he wouldn’t care.

“I didn’t catch your name, soldier.”

“Alfred.”

You nibbled on your lip as you came to, your little niece squeaking something about being hungry. “There’s some bread in my bag,” you gestured. “I’ll be out in just a second. This is the last section.”

The top bookshelf was just barely out of reach. You flexed your mary janes, hopping to work every last inch out of your body on the first wrung of the ladder when a hand came up behind you, snatching the book and easing it into its proper placement.

“Broken it already?” you heard, and as you whipped around, you recognized your soldier standing there. He was wrapped tight in his slim fitting military attire, his other hand supporting his weight on a cane he really had little use for.

“Alfred!”

You slapped his chest repeatedly. “You’re here! You’re here!”

He paused for a moment, looking at you, with one eye covered by the darkness of an eyepatch. “I am, did you miss me?” he pressed. “Or were you--”

“Your eye!” you noticed at last, bringing your hands to his smooth cheek, turning over his cheek to inspect him. You would have brought your hands up to it, but decided rather against it, smoothing your hands past the side of his neck to rest upon his shoulders.

“Yes well,” Alfred looks down, then up again, fixing a cigarette to the side of his mouth. “Ubbe said I looked older this way. We had better fetch Áslaug-- she was in your bag. I might be too, if I don’t each something other than war provisions soon.”

He does. Not in the sense of his age, but the tiredness that carries in his eyes as he glazes them to your squeaking cart, dragging over the ground. You stuff the books into places they don’t belong, whirling the half broken cart to the end of the aisle before your hand would find his thick armcoat.

“I hardly care about how you look,” you admit, knowing you would likely rush him home, make him something that your meager budget as a librarian couldn’t afford. It would be worth it. You tugged him out of the aisle, your fingers laced in his larger hand. “Only that you’re home safe.”

#Alfred x Reader #Alfred the Great/Reader #Vikings x reader #Vikings/Reader #honestsycrets #vikings imagines #vikings imagine #another one coming today too!

90 notes · View notes