Jul 28, 2024 10:35 AM
(This post was last modified: Jul 28, 2024 10:38 AM by Bastille.)
Download:
[deleted]
[deleted]
Bitcoin stealer |
Jul 28, 2024 11:14 AM
(This post was last modified: Jul 28, 2024 11:15 AM by Bastille.)
Well, well, well ....
Bitcoin.exe : https://www.virustotal.com/gui/file/b26c...?nocache=1 ![[Image: gqAMrfY.png]](https://i.imgur.com/gqAMrfY.png) Quite good to be honest, only 9/71 and not detected by most used AV. At this moment Windows Defender was like this : 🧑🦯 Bitcoin.exe dropped many files : ![[Image: ndil0lW.png]](https://i.imgur.com/ndil0lW.png) One of these is : https://www.virustotal.com/gui/file/4e72.../detection ![[Image: 705u1TJ.png]](https://i.imgur.com/705u1TJ.png) This file is present in the Startup folder, here we have our persistant artifact. There is a lot to say on it, I'll continue tomorrow At least OP didn't lied, it's a Bitcoin Stealer, but for him.  (Jul 28, 2024 11:14 AM)Bastille Wrote: Well, well, well .... A 1 poster that immediately posts a download on blackhat software will highly likely be infected during my time on here. It's so obvious sometimes haha. Good stuff though for looking out for the community!!! 👍 Btw anytime you see a caxidl.exe , the malware will install itself in the system32 directory. At least he renamed the main exe bitcoin.exe, looks totally legit never knew bitcoin had an app x'D ![[Image: vGscZ.gif]](https://i.imgur.com/vGscZ.gif)
(Jul 28, 2024 11:37 AM)Skorp Wrote: A 1 poster that immediately posts a download on blackhat software will highly likely be infected during my time on here. It's so obvious sometimes haha. Good stuff though for looking out for the community!!! 👍 Haha yeah really obvious Thanks ! I like conducting those analysis, aside of protecting members, that allows me to practice and learn, and I'm also planning to make a thread with all of them so people who are interested in malware analysis will have a bunch of examples on HF. I didn't know this file, thanks for the headsup :) |
|
|
