mafiaware666 | WannaBitcoin[.]7z

Resubmissions

08/04/2025, 14:01

250408-rb2vcsvpt510

08/04/2025, 09:09

250408-k4fn9ssnv710

08/04/2025, 09:04

250408-k1xhlssnt910

Sharing

Copy URL Twitter E-mail

General

Target
WannaBitcoin.7z
Size 219KB
Sample250408-rb2vcsvpt5
SHA256 5727c532a044cf9fc05d38e0f1f3762b56aa2cc99ed24ad2656245af813f8779
MD5 eb8257d77b5453204b21be2e9e7daf9b
SHA1 2f733cdda1335a370b3ee4119e3f05b9dcc9f089
SHA512 94f5abf1afe3ad7d9040745abc6b9fc5d786fb3f59c1967d780f273b688b5e66940a422b0fb0381b4f75cf383d8369c649112cef1b48b58cb093f43caead78ab
SSDEEP 6144:adbJG1g3XOIidqtdXMtP9Bwc5jtnz8BTrhTUspbF0:adbAQKYbXKDwMjp8BTr5UsP0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

mafiaware666

Malware Config

Signatures

Detect MafiaWare666 ransomware 1 IoCs

resource	yara_rule
static1/unpack001/8CDD2FE5990836816361CE46CCE780A56B70456AE2B4C6595FCB6CC2601C754A.exe	family_mafiaware666

Mafiaware666 family
mafiaware666

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/8CDD2FE5990836816361CE46CCE780A56B70456AE2B4C6595FCB6CC2601C754A.exe

File Explorer

WannaBitcoin.7z

.7z 219KB
8CDD2FE5990836816361CE46CCE780A56B70456AE2B4C6595FCB6CC2601C754A.exe

.exe 12.3MB

WannaBitcoin.7z

SHA256 5727c532a044cf9fc05d38e0f1f3762b56aa2cc99ed24ad2656245af813f8779
MD5 eb8257d77b5453204b21be2e9e7daf9b
SHA1 2f733cdda1335a370b3ee4119e3f05b9dcc9f089
SHA512 94f5abf1afe3ad7d9040745abc6b9fc5d786fb3f59c1967d780f273b688b5e66940a422b0fb0381b4f75cf383d8369c649112cef1b48b58cb093f43caead78ab
SSDEEP 6144:adbJG1g3XOIidqtdXMtP9Bwc5jtnz8BTrhTUspbF0:adbAQKYbXKDwMjp8BTr5UsP0
MD5 SHA1 SHA512 SSDEEP

Password

infected

8CDD2FE5990836816361CE46CCE780A56B70456AE2B4C6595FCB6CC2601C754A.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 8cdd2fe5990836816361ce46cce780a56b70456ae2b4c6595fcb6cc2601c754a
MD5 114edffe6d90393ac464866ddf138f90
SHA1 97ebbf910fd31a626126311453f8ee87171eb92d
SHA512 1197d4e60bfc67d2b2cb13b424394bb8e6d5086514fc9c8965171a5b544b714405dd861bac058cac9c532e6d18b23344c41111dbb9db353a822910cfb40b155c
SSDEEP 6144:l+ECg0N85ETLskwa29UjofIZcVoQ+YnwRuM0IpGktXgXlF:l3ChN85GjRWUjofGciswRuM0IkF
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detect MafiaWare666 ransomware
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

12890578

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Jeff\Apps\WannaBitcoin\obj\Debug\WannaBitcoin.pdb

WannaBitcoin.7z

8CDD2FE5990836816361CE46CCE780A56B70456AE2B4C6595FCB6CC2601C754A.exe

mscoree

dotnet