@chytrik I took the time to download it for you and run it.

it talks to a command and control server in russia.

@Anonymous I haven't seen that virustotal site before, nice tool.

331k BTC thats just dumb, you'd probably sucker more people in with a modest amount

@chytrik like a lot of tools you have to be careful taking them as absolutes. in general it should be an indicator of maliciousness, NEVER an indication that something is safe to run. I updated the answer with another link to hybrid-analysis which is a little better, but it'll take an hour of so for them to process it.

hybrid-analysis will actually go and run the real malware in a virtual machine, take screenshots of it executing, and record all of the things it attempts to probe or communicate with. it's very handy.

but yeah.

they could have tried harder, but it's always nice to have examples like this to link to.

I think the reason it's such a large amount is that it's supposed to cause people to panic.

"I could live like a king forever if I just download and run this first"

lots of malware infections are based around getting people to do things in haste without thinking.

the ultimate indicator to me was that one of the addresses "in the wallet" is one I know of already.

@Anonymous thats cool, very handy indeed

Panic can help make bad decisions, but I guess its similar to the target of many scams: obviously dumb people, as they're more likely to fall for your shit.

I feel like that amount of BTC is just a sanity check for 'do you have brains at all? is this believable?'

@chytrik perhaps. it's often very difficult to tell what's going on in the minds of the people producing this sort of thing. here we have a really low effort bit of malware as a whole, I started doing actual analysis of the binary but it's not really worth the time spent.

it's created using AutoIt, which is one of these "this isn't a hacking tool nudge nudge it has legitimate uses" sort of things. it's about as close to point and click malware as you can get, from the screenshots on their website you just give it a name, choose an icon, add some behavior of your own maliciousness and off you go.

it's up for debate if this is effective or not. maybe they just don't need to put in any more effort.

maybe this works every time. maybe it's just someone testing the waters.

you wouldn't believe it, but this has worked before. when Mt Gox went down someone appeared on some forums and dumped a huge amount of personal details from the service. it was a giant zipfile which contained all the wallet information and accounts of every single user. inside was something named "MtGoxBackOffice.exe", and people ran that and lost all of their money.

yes. a hacker literally just announced they hacked mt gox. you downloaded the files they released and ran the executables they provided!? but yes, it worked and people did post afterwards saying they lost all their Bitcoin due to it.

which lends to perhaps this sort of thing is all that's needed. which is why I posted a blunt warning about it, added the URLs to safebrowsing so they can't be loaded in a browser, and edited the URL out of the posts. it's not worth the risk that someone will be caught out by it.