Overview

overview

7

Static

static

3

c2cf8b0fd5...d4.exe

windows7-x64

7

c2cf8b0fd5...d4.exe

windows10-2004-x64

7

$PLUGINSDI...nu.dll

windows7-x64

3

$PLUGINSDI...nu.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

bitcoin.exe

windows7-x64

7

bitcoin.exe

windows10-2004-x64

7

daemon/bitcoind.exe

windows7-x64

1

daemon/bitcoind.exe

windows10-2004-x64

1

src/cryptopp/misc.js

windows7-x64

1

src/cryptopp/misc.js

windows10-2004-x64

1

src/db.js

windows7-x64

1

src/db.js

windows10-2004-x64

1

src/init.js

windows7-x64

1

src/init.js

windows10-2004-x64

1

src/irc.js

windows7-x64

1

src/irc.js

windows10-2004-x64

1

src/json/j...ate.js

windows7-x64

1

src/json/j...ate.js

windows10-2004-x64

1

src/net.js

windows7-x64

1

src/net.js

windows10-2004-x64

1

src/net.js

windows7-x64

1

src/net.js

windows10-2004-x64

1

src/rpc.js

windows7-x64

1

src/rpc.js

windows10-2004-x64

1

src/script.js

windows7-x64

1

src/script.js

windows10-2004-x64

1

src/util.js

windows7-x64

1

src/util.js

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    c2cf8b0fd50f29442e49870229b219d4

  • Size

    4.3MB

  • MD5

    c2cf8b0fd50f29442e49870229b219d4

  • SHA1

    9c73651398eddf30a7f6b31bb3725426d2a3829e

  • SHA256

    2e0a0f57bbfc85b7b74c6b202fe00c8c2b4e66818b44e439248b4d76da11a5ad

  • SHA512

    72c9aa561e8d80aa0eaf191492a995321150f57871635b561415f056bf7b0a1f9492de1a64ca24e823a947eeee0f0e5272f3f8b062b6b32ebc9b5f4843f74d95

  • SSDEEP

    98304:a7Sr3e59AL8+cBEKVHBnUogQDEWV+9zySDQ7UrQQX4/UyWrS:aQQ9mOVTQXsfl

Score
3/10

Malware Config

Signatures

  • Unsigned PE 7 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs
    installer

Files

  • c2cf8b0fd50f29442e49870229b219d4
    .exe windows:4 windows x86 arch:x86

    28a099a911237a28521d8b7ea250f089


    Headers

    Imports

    Sections

  • $PLUGINSDIR/StartMenu.dll
    .dll windows:4 windows x86 arch:x86

    bdab983d6ad23427df2ffbe18eafb197


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    38e5d87efd24fb4005f186879a64501c


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    4fb4d15e957b6564bf15c23e80f0202a


    Headers

    Imports

    Exports

    Sections

  • bitcoin.exe
    .exe windows:4 windows x86 arch:x86

    61594542a76c22c011717cc6d5bd6148


    Headers

    Imports

    Sections

  • daemon/bitcoind.exe
    .exe windows:4 windows x86 arch:x86

    b09f88b96c368f70f25048d2597c4c12


    Headers

    Imports

    Sections

  • license.txt
  • locale/cs/LC_MESSAGES/bitcoin.mo
  • locale/cs/LC_MESSAGES/bitcoin.po
  • locale/de/LC_MESSAGES/bitcoin.mo
  • locale/de/LC_MESSAGES/bitcoin.po
  • locale/eo/LC_MESSAGES/bitcoin.mo
  • locale/eo/LC_MESSAGES/bitcoin.po
  • locale/es/LC_MESSAGES/bitcoin.mo
  • locale/es/LC_MESSAGES/bitcoin.po
  • locale/fr/LC_MESSAGES/bitcoin.mo
  • locale/fr/LC_MESSAGES/bitcoin.po
  • locale/it/LC_MESSAGES/bitcoin.mo
  • locale/it/LC_MESSAGES/bitcoin.po
  • locale/lt/LC_MESSAGES/bitcoin.mo
  • locale/lt/LC_MESSAGES/bitcoin.po
  • locale/nl/LC_MESSAGES/bitcoin.mo
  • locale/nl/LC_MESSAGES/bitcoin.po
  • locale/pl/LC_MESSAGES/bitcoin.po
  • locale/pt/LC_MESSAGES/bitcoin.mo
  • locale/pt/LC_MESSAGES/bitcoin.po
  • locale/readme.txt
  • locale/ro/LC_MESSAGES/bitcoin.mo
  • locale/ro/LC_MESSAGES/bitcoin.po
  • locale/ru/LC_MESSAGES/bitcoin.mo
  • locale/ru/LC_MESSAGES/bitcoin.po
  • locale/sv/LC_MESSAGES/bitcoin.mo
  • locale/sv/LC_MESSAGES/bitcoin.po
  • locale/zh_cn/LC_MESSAGES/bitcoin.mo
  • locale/zh_cn/LC_MESSAGES/bitcoin.po
  • readme.txt
  • src/base58.h
  • src/bignum.h
  • src/checkpoints.cpp
  • src/checkpoints.h
  • src/crypter.cpp
  • src/crypter.h
  • src/cryptopp/License.txt
  • src/cryptopp/Readme.txt
  • src/cryptopp/config.h
  • src/cryptopp/cpu.cpp
  • src/cryptopp/cpu.h
  • src/cryptopp/cryptlib.h
  • src/cryptopp/iterhash.h
  • src/cryptopp/misc.h
    .js
  • src/cryptopp/obj/.gitignore
  • src/cryptopp/pch.h
  • src/cryptopp/secblock.h
  • src/cryptopp/sha.cpp
  • src/cryptopp/sha.h
  • src/cryptopp/simple.h
  • src/cryptopp/smartptr.h
  • src/cryptopp/stdcpp.h
  • src/db.cpp
    .js
  • src/db.h
  • src/headers.h
  • src/init.cpp
    .js
  • src/init.h
  • src/irc.cpp
    .js
  • src/irc.h
  • src/json/LICENSE.txt
  • src/json/json_spirit.h
  • src/json/json_spirit_error_position.h
  • src/json/json_spirit_reader.cpp
  • src/json/json_spirit_reader.h
  • src/json/json_spirit_reader_template.h
    .js
  • src/json/json_spirit_stream_reader.h
  • src/json/json_spirit_utils.h
  • src/json/json_spirit_value.cpp
  • src/json/json_spirit_value.h
  • src/json/json_spirit_writer.cpp
  • src/json/json_spirit_writer.h
  • src/json/json_spirit_writer_template.h
  • src/key.h
  • src/keystore.cpp
  • src/keystore.h
  • src/main.cpp
  • src/main.h
  • src/makefile.linux-mingw
  • src/makefile.mingw
  • src/makefile.osx
  • src/makefile.unix
  • src/makefile.vc
  • src/net.cpp
    .js
  • src/net.h
    .js
  • src/noui.h
  • src/obj/.gitignore
  • src/obj/nogui/.gitignore
  • src/obj/test/.gitignore
  • src/protocol.cpp
  • src/protocol.h
  • src/rpc.cpp
    .js
  • src/rpc.h
  • src/script.cpp
    .js
  • src/script.h
  • src/serialize.h
  • src/strlcpy.h
  • src/test/Checkpoints_tests.cpp
  • src/test/README
  • src/test/script_tests.cpp
  • src/test/test_bitcoin.cpp
  • src/test/transaction_tests.cpp
  • src/test/uint160_tests.cpp
  • src/test/uint256_tests.cpp
  • src/ui.cpp
  • src/ui.h
  • src/uibase.cpp
  • src/uibase.h
  • src/uint256.h
  • src/util.cpp
  • src/util.h
    .js
  • src/wallet.cpp
  • src/wallet.h
  • src/xpm/about.xpm
  • src/xpm/addressbook16.xpm
  • src/xpm/addressbook20.xpm
  • src/xpm/bitcoin16.xpm
  • src/xpm/bitcoin20.xpm
  • src/xpm/bitcoin32.xpm
  • src/xpm/bitcoin48.xpm
  • src/xpm/bitcoin80.xpm
  • src/xpm/check.xpm
  • src/xpm/send16.xpm
  • src/xpm/send16noshadow.xpm
  • src/xpm/send20.xpm
  • uninstall.exe
    .exe windows:4 windows x86 arch:x86

    28a099a911237a28521d8b7ea250f089


    Headers

    Imports

    Sections

  • $PLUGINSDIR/modern-header.bmp