RansomCoin DB

Analyse ransomware from the safety of your spreadsheet!

Bitcoin's blockchain stores valuable information about ransomware and APTs. RansomCoin DB gives you access to over 26,000 Bitcoin wallet addresses used in ransomware along with their associated transactions and file hashes in SHA1, SHA256, and MD5.

RansomCoin DB includes data from the following ransomware families

  • NotPetya
  • Wannacry
  • Ryuk
  • Conti
  • DarkSide
  • CryptoWall
  • CryptoLocker
  • Cerber
  • Jigsaw

... and more!


Sample API Data

A sample of Ransomcoin DB API format

Example WannaCry Transactions
Timestamp From_BTC To_BTC BTC EUR USD
2017-05-16 05:22:30 +02 12HpYVeK52F5r9Y6BX5mSzLRLrG8jtgHX9 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 0.11256128 €180.57 $194.66
2017-05-16 05:22:30 +02 12HpYVeK52F5r9Y6BX5mSzLRLrG8jtgHX9 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 0.01916789 30.75 33.15
2017-05-16 05:50:18 +02 196B5HC1f8318grWVhUhoPnzd5fnkk43eK 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 1.008 1617.03 1743.17
2017-05-16 07:18:50 +02 1LP3TEnCAmzntMACk75jkx3kfKFYB7QrT4 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 1.41265284 2266.18 2442.96
2017-05-16 09:21:37 +02 1H5Wx73GVjx3Q3nJPtsVypKy3WPsGXaAdt 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 79.54397919 127604.45 137558.58

Sample Bin to BTC data

A sample of our binary to Bitcoin API data.

Example WannaCry Binaries to Bitcoin
BTC Corpus_ID TLSH MD5 SHA1 SHA256
13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 VirusShare_5502c48fb20814b45f55690a800da0ec 010633A4A22CF6FCF1151DF04453891BA7B73C6567BA4A1F8B8046A60D43F6FAFC0951 5502c48fb20814b45f55690a800da0ec fc8d7e084eb5aa0750e120192ee882ce46c47343 6115cf8f3370f735af41567269e7acc856d2900e19a4982c06cec976c49ca553
13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 VirusShare_bd8efe2edb22caf61c8122e6574049c8 02363394652CB1BCF0450EB404638A5BB7B73C6967BB4E1F9BC086670D53F9BABC0A41 bd8efe2edb22caf61c8122e6574049c8 53322527d97992654990815581841ca57b80583d b0f860c937e232a175aaf28d95d6b1fe5f81acef406718ab4be64997173db209
13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 VirusShare_34157dcaa41fbde5d70300ad7bdf6d2f 03363394626CB2BCF1550EB444738D1BB7B73C2577BE4A1F8B80876A0C53B5BABD0A41 34157dcaa41fbde5d70300ad7bdf6d2f 5a73b6f20d189964eeafa3174bc9bb5a0e551bc9 1fdb9f7dc8af9d71b8ce306ab01a36839f79969e9e4680dfdbeec94705a1070d
13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 VirusShare_bf8c32afc2a6180aec24492449147b68 03F5E611B8470C9CCABF23704C277F65CA56E558023966B783B25B1FAFE435EE2B4894 bf8c32afc2a6180aec24492449147b68 6cddc47e29ee84f68bf35801af8d7f8a30e6d8c4 24aa72f614fcf3ad78e108cde2e43f1486168f1c2fdd9d7584443573521644fe