malware family

Black Ruby

unknownentity:malware_familyransomware · 1 source

A new ransomware was discovered this week by MalwareHunterTeam called Black Ruby. This ransomware will encrypt the files on a computer, scramble the file name, and then append the BlackRuby extension. To make matters worse, Black Ruby will also install a Monero miner on the computer that utilizes as much of the CPU as it can. Discovered on February 6, 2018. May have been distributed through unknown vectors. Will not encrypt a machine if its IP address is identified as coming from Iran; this feat

Curated · btcintel

claims we make, each with its source and citation · sources may contradict; we show the set, never a score

Facts

id: black-ruby
kind: malware family
status: unknown
aliases: BlackRuby
jurisdictions: —
claims naming it: 12 · 0 attributions · 0 relations · 0 events

Identifiers

misp-galaxy abf3001c-396c-11e8-8da6-ef501eef12e1via misp-galaxy-ransomware

Relations

computedno relations recorded for this entity

Events

computedno dated events recorded for this entity

Claims naming this entitynewest first · 12 of 12

Black Rubyransomwarepayment
subjecttransactione19be6a2ac…6f268ff3a4
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 19S7k3zHphKiYr85T25FnqdxizHcgmjoj1 · 8,700,000 sat · time 2018-02-05 16:35 UTC · url https://ransomwhe.re/#address/19S7k3zHphKiYr85T25FnqdxizHcgmjoj1
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_25023btcintel:annotations:25023@v3 sha256:2212131c25584c0b
confidencetrusted provider · 50
Black Rubyransomwarepayment
subjecttransactionf62389b1db…78e8371f6e
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 19S7k3zHphKiYr85T25FnqdxizHcgmjoj1 · 4,353,042 sat · time 2018-02-05 16:59 UTC · url https://ransomwhe.re/#address/19S7k3zHphKiYr85T25FnqdxizHcgmjoj1
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_25022btcintel:annotations:25022@v3 sha256:59c3987669485946
confidencetrusted provider · 50
Black Rubyransomwarepayment
subjecttransaction693842b728…20274258c1
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 19S7k3zHphKiYr85T25FnqdxizHcgmjoj1 · 5,009,000 sat · time 2018-02-10 06:07 UTC · url https://ransomwhe.re/#address/19S7k3zHphKiYr85T25FnqdxizHcgmjoj1
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_25021btcintel:annotations:25021@v3 sha256:5899cbd16d4557ac
confidencetrusted provider · 50
Black Rubyransomwarepayment
subjecttransaction793b6b6bbc…03f6c8d0b6
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 19S7k3zHphKiYr85T25FnqdxizHcgmjoj1 · 2,496,812 sat · time 2018-02-10 06:43 UTC · url https://ransomwhe.re/#address/19S7k3zHphKiYr85T25FnqdxizHcgmjoj1
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_25020btcintel:annotations:25020@v3 sha256:b0c7114afceb8be2
confidencetrusted provider · 50
Black Rubyransomwarepayment
subjecttransaction3fee2cc801…d877b71e1b
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 19S7k3zHphKiYr85T25FnqdxizHcgmjoj1 · 5,200,000 sat · time 2018-02-12 09:23 UTC · url https://ransomwhe.re/#address/19S7k3zHphKiYr85T25FnqdxizHcgmjoj1
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_25019btcintel:annotations:25019@v3 sha256:d04e5a17e48af291
confidencetrusted provider · 50
Black Rubyransomwarepayment
subjecttransaction4cb6839787…ce3ebd396d
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 19S7k3zHphKiYr85T25FnqdxizHcgmjoj1 · 2,626,842 sat · time 2018-02-12 09:23 UTC · url https://ransomwhe.re/#address/19S7k3zHphKiYr85T25FnqdxizHcgmjoj1
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_25018btcintel:annotations:25018@v3 sha256:d7bb8f2f5e7148d6
confidencetrusted provider · 50
Black Rubyransomwarepayment
subjecttransaction04a588430b…ced1553909
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 19S7k3zHphKiYr85T25FnqdxizHcgmjoj1 · 5,085,757 sat · time 2018-02-12 10:57 UTC · url https://ransomwhe.re/#address/19S7k3zHphKiYr85T25FnqdxizHcgmjoj1
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_25017btcintel:annotations:25017@v3 sha256:01f8ed1ab061bdd5
confidencetrusted provider · 50
Black Rubyransomwarepayment
subjecttransaction6066969d78…84d144e366
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 19S7k3zHphKiYr85T25FnqdxizHcgmjoj1 · 2,447,551 sat · time 2018-02-12 13:00 UTC · url https://ransomwhe.re/#address/19S7k3zHphKiYr85T25FnqdxizHcgmjoj1
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_25016btcintel:annotations:25016@v3 sha256:73497c2bbc7d8013
confidencetrusted provider · 50
Black Rubyransomwarepayment
subjecttransactionc653d147f8…583bc1d16b
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 19S7k3zHphKiYr85T25FnqdxizHcgmjoj1 · 5,233,191 sat · time 2018-02-12 18:24 UTC · url https://ransomwhe.re/#address/19S7k3zHphKiYr85T25FnqdxizHcgmjoj1
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_25015btcintel:annotations:25015@v3 sha256:fd9cab8b990d9b0e
confidencetrusted provider · 50
Black Rubyransomwarepayment
subjecttransaction88280447f3…dbacb9833a
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 19S7k3zHphKiYr85T25FnqdxizHcgmjoj1 · 7,556,640 sat · time 2018-02-13 09:30 UTC · url https://ransomwhe.re/#address/19S7k3zHphKiYr85T25FnqdxizHcgmjoj1
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_25014btcintel:annotations:25014@v3 sha256:6e2e45249d40c796
confidencetrusted provider · 50
Black Rubyransomwarepayment
subjecttransactiond179ce774c…69407fa887
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 19S7k3zHphKiYr85T25FnqdxizHcgmjoj1 · 3,813,036 sat · time 2018-02-13 09:51 UTC · url https://ransomwhe.re/#address/19S7k3zHphKiYr85T25FnqdxizHcgmjoj1
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_25013btcintel:annotations:25013@v3 sha256:70c587c611a4e190
confidencetrusted provider · 50
Black Rubyransomwarepayment address
subjectaddress19S7k3zHphKiYr85T25FnqdxizHcgmjoj1
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Black Ruby · url https://ransomwhe.re/#address/19S7k3zHphKiYr85T25FnqdxizHcgmjoj1
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_25012btcintel:annotations:25012@v2 sha256:d42d70165ab67aac
confidencetrusted provider · 50

Subjects12 subjects carry a claim naming this entity · a sample

Community

notes from Nostr labelers · never merged with the bands above · not endorsed

Community content is indexed from Nostr and not endorsed by btcintel.

not computed yetNot indexed yet: the community index has not looked at this subject.