RansomCoinPublic is a DFIR tool to extract cryptocoin addresses and other indicators of compromise from binaries. Extracting metadata and hardcoded Indicators of Compromise from ransomware, in a scalable, efficient, way with cuckoo integrations. Ideally, is it run during cuckoo dynamic analysis, but can also be used for static analysis on large collections of ransomware. Designed …
Continue reading “RansomCoinPublic : A DFIR Tool To Extract Cryptocoin Addresses”