malware family

Jigsaw

unknownentity:malware_familyransomware · 1 source

Ransomware Has a GUI

Curated · btcintel

claims we make, each with its source and citation · sources may contradict; we show the set, never a score

Facts

id: jigsaw
kind: malware family
status: unknown
aliases: Cryptohitman · CryptoHitMan · Jigsaw Original
jurisdictions: —
claims naming it: 37 · 0 attributions · 0 relations · 0 events

Identifiers

misp-galaxy 1e3384ae-4b48-4c96-b7c2-bc1cc1eda203via misp-galaxy-ransomware

Relations

computedno relations recorded for this entity

Events

computedno dated events recorded for this entity

Claims naming this entitynewest first · 20 of 37

Jigsawransomwarepayment
subjecttransaction9054e48be4…9e0ff9945c
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1P67AghL2mNLbgxLM19oJYXgsJxyLfcYiz · 32,000,000 sat · time 2017-03-15 21:28 UTC · url https://ransomwhe.re/#address/1P67AghL2mNLbgxLM19oJYXgsJxyLfcYiz
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_25031btcintel:annotations:25031@v3 sha256:1868b17072ec3107
confidencetrusted provider · 50
Jigsawransomwarepayment address
subjectaddress1P67AghL2mNLbgxLM19oJYXgsJxyLfcYiz
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Jigsaw · url https://ransomwhe.re/#address/1P67AghL2mNLbgxLM19oJYXgsJxyLfcYiz
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_25030btcintel:annotations:25030@v2 sha256:03072ced5b90301a
confidencetrusted provider · 50
Cryptohitmanransomwarepayment
subjecttransaction0ad436f188…1137d3e29d
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 19a93M9JGX377yfVzWRBs4abcUpwLfXsvE · 10,294,655 sat · time 2016-04-27 06:26 UTC · url https://ransomwhe.re/#address/19a93M9JGX377yfVzWRBs4abcUpwLfXsvE
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_21689btcintel:annotations:21689@v3 sha256:97b5eac6e8e90ba3
confidencetrusted provider · 50
Cryptohitmanransomwarepayment
subjecttransaction7a99c36a95…f427a96c78
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 19a93M9JGX377yfVzWRBs4abcUpwLfXsvE · 50,000 sat · time 2016-05-01 14:44 UTC · url https://ransomwhe.re/#address/19a93M9JGX377yfVzWRBs4abcUpwLfXsvE
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_21688btcintel:annotations:21688@v3 sha256:7c702acd4bfa78c5
confidencetrusted provider · 50
Cryptohitmanransomwarepayment
subjecttransactione1e143a29c…c06893bc74
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 19a93M9JGX377yfVzWRBs4abcUpwLfXsvE · 263,900 sat · time 2016-05-02 19:52 UTC · url https://ransomwhe.re/#address/19a93M9JGX377yfVzWRBs4abcUpwLfXsvE
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_21687btcintel:annotations:21687@v3 sha256:4c293cc29422c8d4
confidencetrusted provider · 50
Cryptohitmanransomwarepayment
subjecttransactioncc02657db4…e6bf8d2e0a
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 19a93M9JGX377yfVzWRBs4abcUpwLfXsvE · 84,869 sat · time 2016-05-02 20:09 UTC · url https://ransomwhe.re/#address/19a93M9JGX377yfVzWRBs4abcUpwLfXsvE
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_21686btcintel:annotations:21686@v3 sha256:d90cffec956b0062
confidencetrusted provider · 50
Cryptohitmanransomwarepayment
subjecttransactionaa43b03165…08e5e98d61
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 19a93M9JGX377yfVzWRBs4abcUpwLfXsvE · 661,485 sat · time 2018-12-08 16:18 UTC · url https://ransomwhe.re/#address/19a93M9JGX377yfVzWRBs4abcUpwLfXsvE
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_21685btcintel:annotations:21685@v3 sha256:fd551acd999d9ab8
confidencetrusted provider · 50
Cryptohitmanransomwarepayment
subjecttransactionbbcc6dd4d1…58953cb609
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 19a93M9JGX377yfVzWRBs4abcUpwLfXsvE · 1,044,873 sat · time 2019-09-23 01:57 UTC · url https://ransomwhe.re/#address/19a93M9JGX377yfVzWRBs4abcUpwLfXsvE
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_21684btcintel:annotations:21684@v3 sha256:d8c8824ea89ca1df
confidencetrusted provider · 50
Cryptohitmanransomwarepayment address
subjectaddress19a93M9JGX377yfVzWRBs4abcUpwLfXsvE
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Cryptohitman · url https://ransomwhe.re/#address/19a93M9JGX377yfVzWRBs4abcUpwLfXsvE
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_21683btcintel:annotations:21683@v2 sha256:0d3c85d4d3b5a7b7
confidencetrusted provider · 50
JigSawransomwarepayment
subjecttransaction0549dd666f…68f6ba00b1
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 18sn8Q5L1T3LbZuvz5hqHu2aFXgU5T9fu4 · 22,380,000 sat · time 2016-04-30 18:58 UTC · url https://ransomwhe.re/#address/18sn8Q5L1T3LbZuvz5hqHu2aFXgU5T9fu4
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_21485btcintel:annotations:21485@v3 sha256:d18d73247318e194
confidencetrusted provider · 50
JigSawransomwarepayment
subjecttransaction389ec397c1…fb013fed49
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 18sn8Q5L1T3LbZuvz5hqHu2aFXgU5T9fu4 · 151,238,100 sat · time 2016-07-08 00:27 UTC · url https://ransomwhe.re/#address/18sn8Q5L1T3LbZuvz5hqHu2aFXgU5T9fu4
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_21484btcintel:annotations:21484@v3 sha256:04dfc6bf03039d77
confidencetrusted provider · 50
JigSawransomwarepayment
subjecttransaction62d003e337…13e2a2cfac
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 18sn8Q5L1T3LbZuvz5hqHu2aFXgU5T9fu4 · 33,000,000 sat · time 2016-11-16 04:58 UTC · url https://ransomwhe.re/#address/18sn8Q5L1T3LbZuvz5hqHu2aFXgU5T9fu4
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_21483btcintel:annotations:21483@v3 sha256:f8ad0ec25767d40f
confidencetrusted provider · 50
JigSawransomwarepayment address
subjectaddress18sn8Q5L1T3LbZuvz5hqHu2aFXgU5T9fu4
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw JigSaw · url https://ransomwhe.re/#address/18sn8Q5L1T3LbZuvz5hqHu2aFXgU5T9fu4
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_21482btcintel:annotations:21482@v2 sha256:e1946dfe98e17606
confidencetrusted provider · 50
JigSawransomwarepayment
subjecttransactionbb72ccc46f…830987b36d
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1L9GdBW65Rt6e8UY69bnWNWomsppFFFR2X · 10,138,741 sat · time 2016-03-29 06:46 UTC · url https://ransomwhe.re/#address/1L9GdBW65Rt6e8UY69bnWNWomsppFFFR2X
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_21481btcintel:annotations:21481@v3 sha256:ab9c83f656389050
confidencetrusted provider · 50
JigSawransomwarepayment
subjecttransactiona7f9717318…c456c0b0e6
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1L9GdBW65Rt6e8UY69bnWNWomsppFFFR2X · 1,908,741 sat · time 2016-03-29 14:39 UTC · url https://ransomwhe.re/#address/1L9GdBW65Rt6e8UY69bnWNWomsppFFFR2X
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_21480btcintel:annotations:21480@v3 sha256:73fe3845ab8f23d4
confidencetrusted provider · 50
JigSawransomwarepayment
subjecttransactionac253edb43…dfa39d57ee
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1L9GdBW65Rt6e8UY69bnWNWomsppFFFR2X · 1,864,212 sat · time 2016-03-29 21:04 UTC · url https://ransomwhe.re/#address/1L9GdBW65Rt6e8UY69bnWNWomsppFFFR2X
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_21479btcintel:annotations:21479@v3 sha256:cbf14957d3a9c1fa
confidencetrusted provider · 50
JigSawransomwarepayment
subjecttransaction6cb909c82f…5349dbe333
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1L9GdBW65Rt6e8UY69bnWNWomsppFFFR2X · 1,149,707 sat · time 2016-03-31 18:42 UTC · url https://ransomwhe.re/#address/1L9GdBW65Rt6e8UY69bnWNWomsppFFFR2X
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_21478btcintel:annotations:21478@v3 sha256:9c3514c9b42284be
confidencetrusted provider · 50
JigSawransomwarepayment
subjecttransaction5a7516dbce…bfbcb0b9de
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1L9GdBW65Rt6e8UY69bnWNWomsppFFFR2X · 139,707 sat · time 2016-04-07 03:00 UTC · url https://ransomwhe.re/#address/1L9GdBW65Rt6e8UY69bnWNWomsppFFFR2X
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_21477btcintel:annotations:21477@v3 sha256:36a805efe892bfe8
confidencetrusted provider · 50
JigSawransomwarepayment
subjecttransaction0c4daeebba…139e94260c
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1L9GdBW65Rt6e8UY69bnWNWomsppFFFR2X · 61,249 sat · time 2016-04-07 05:03 UTC · url https://ransomwhe.re/#address/1L9GdBW65Rt6e8UY69bnWNWomsppFFFR2X
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_21476btcintel:annotations:21476@v3 sha256:7c88cc3b6950f93f
confidencetrusted provider · 50
JigSawransomwarepayment
subjecttransaction443fcfc325…5a03f7b48e
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1L9GdBW65Rt6e8UY69bnWNWomsppFFFR2X · 118,000 sat · time 2016-04-08 18:37 UTC · url https://ransomwhe.re/#address/1L9GdBW65Rt6e8UY69bnWNWomsppFFFR2X
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_21475btcintel:annotations:21475@v3 sha256:5ded724ed620e99e
confidencetrusted provider · 50

Subjects37 subjects carry a claim naming this entity · a sample

12YHmaLEAbWx3o3p6BvegG9WH47EYs8t1Vaddress
15fbyNgDnqYQR5vSHJ8PTAEJbKy4dwNBCZaddress
18Rvo1q63i7tmwBxaBXZ7iQtFRdHiNiJFFaddress
18sn8Q5L1T3LbZuvz5hqHu2aFXgU5T9fu4address
18zvwScQrbRH4Uh3C2zSzTmciMe7HYjvXaddress
19a93M9JGX377yfVzWRBs4abcUpwLfXsvEaddress
1Cf55htjGATCj3U97EfwjLc39YG36anMujaddress
1FLjcTFpz9MhwLdZ4xm9onpAnUGfRbGdXgaddress
1FNiZfWYQPEcZFL8i5bwvMC75RuB78LwaBaddress
1L9GdBW65Rt6e8UY69bnWNWomsppFFFR2Xaddress

Community

notes from Nostr labelers · never merged with the bands above · not endorsed

Community content is indexed from Nostr and not endorsed by btcintel.

not computed yetNot indexed yet: the community index has not looked at this subject.