Overview

overview

7

Static

static

3

btcgrabber.exe

windows7-x64

7

btcgrabber.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    btcgrabber.exe

  • Size

    55KB

  • Sample

    231009-xysg4afg31

  • MD5

    79052fe9b9e43bdfd8cee873e1c66e43

  • SHA1

    7f3fedf08c2d9d96b2dfee286189f0bbc29cc7c1

  • SHA256

    25280d7ffa3f96617808c9fa344ea6d359472cced5991a744425a216948d8b44

  • SHA512

    c3da11b62d699a98f2b564ff4ac9b5abc38b0c5bd1314fecaeeea873410b8f52199cd64d722db4b197812a8496f4d027ef934afca209e9678dd4c595eea74cf2

  • SSDEEP

    1536:KnI4x+Sgw7U8gHwZfggbX6ZujO0rUrWU:I/gfHwZfnbXXO0r1U

Score
7/10
ransomware

Malware Config

Targets

    • Target

      btcgrabber.exe

    • Size

      55KB

    • MD5

      79052fe9b9e43bdfd8cee873e1c66e43

    • SHA1

      7f3fedf08c2d9d96b2dfee286189f0bbc29cc7c1

    • SHA256

      25280d7ffa3f96617808c9fa344ea6d359472cced5991a744425a216948d8b44

    • SHA512

      c3da11b62d699a98f2b564ff4ac9b5abc38b0c5bd1314fecaeeea873410b8f52199cd64d722db4b197812a8496f4d027ef934afca209e9678dd4c595eea74cf2

    • SSDEEP

      1536:KnI4x+Sgw7U8gHwZfggbX6ZujO0rUrWU:I/gfHwZfnbXXO0r1U

    Score
    7/10
    ransomware

    • Drops startup file

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks