⚠⚠️⚠~Beware on active phishing Electrum websites~⚠⚠️⚠ (Collection list updated)

[IeSua]

IOCs

Malicious Electrum wallet binaries

Code:

137e8925667ff75b1c516a97b5d2d3dd205f9302cdeb190fc68855aee2942c22
1900f4d0a13486f90ff5f82e02d210b8a9db27bca24b88f5de849ef124212f09
1ef6c9d9d3519769749498631532063967fc7d5e8f0fc75e8a3ff66f57dfab22
2747c4e43d2652f3ad039e0dc1bf28f5b136a9ac76a4f57320b08b5905e7c4cd
2cd180e61e36de1be904a02591485ef3321b539cdccca1fd7f1f001770652b14
307d97a38c6bf21903057eec48c4d3957e10c0097fe05d5a203101d22cd79cc3
3610c86975ed943b5065bdc65bfcb4035e58a863cd3192865401bc6a70b023ba
367b620a0a332f693a68230bf21f7036983b7b9e0dee946af5338ed168c16318
36c3140d73fbfb5710438d7c218013bf6fb8736a98dfe002b0d711fbb39aad41
41ff4f112d0a8c4bb20a49f7beb5f36c28455a9cebafa8db75277f54f597d6d4
57f6ef3ea9e497592bdbe9dda201105e0faea8f6668b5701b6b91fbc9e94cd43
634287c65f018e71ed7bebfb5b21e33bcedf08139e3d924178b4cdfaa12d8b34
74c2dcf751796cd209755b4e828b6686b2fb38587163b1cbff1295da2d3f0a8c
87aa1fdf00db2ed94464c2687a0e1011a80af576267c0f88d1216c0cb4d2e310
9a5b1ffbeb562d772dfa2d49e59e0f72557f6111a5e24d6498f88b77a5d8f10a
a080444918844e27ff2079b71f20ebd2d1f1836907c854671daa3548dc809e7c
b20778f69cc959a16c612e75d21a3668aab11f47f2659c3175da5bd80665e225
c48b7ba2531e4954881388aceb00a2ec36488f1cf70eeb873a97b7cfa32362cb
c5afedd8a03d2f49e25fb2c568ede20b0e43a4eeebebd202c98324ead9b82732
df154484a90321407c0e8115df7bf6f598adb6a50255cc58b723db7cc5d3729f
e8ef9cbeec7cdc7f58e28274c417457c5c8dcf47f4e8409cb2befe9450d3868b
f736c8fa4a21755020ecfce60a53d0a1cfdaa7061fd7be6efd49d74af9b13e02

Fake domains​

Code:

btc-electrum[.]com
btcelectrum[.]org
downloadelectrum[.]com
downloadelectrum[.]org
eiectrum[.]net
electrum[.]bz
electrumapp[.]org
electrumapps[.]com
electrumbase[.]com
electrumbase[.]net
electrumbase[.]org
electrumbitcoin[.]org
electrumbtc[.]org
electrumbuild[.]com
electrumcircle[.]com
electrumclient[.]org
electrumcore[.]com
electrumcore[.]net
electrumdownload[.]com
electrumdownload[.]org
electrume[.]com
electrume[.]org
electrumfix[.]com
electrumget[.]com
electrumget[.]com
electrumhub[.]com
electrumnet[.]com
electrumofficial[.]com
electrumopen[.]org
electrumpgrade[.]com
electrumsafe[.]org
electrumsite[.]com
electrumsource[.]org
electrumstart[.]org
electrumtxn[.]com
electrumupdate[.]com
electrumupgrade[.]com
electrumupgrade[.]org
electrumware[.]com
electrumware[.]org
electrumweb[.]net
getelectrum[.]com
getelectrum[.]live
getelectrum[.]org
goelectrum[.]com
myelectrum[.]org

Attacker Bitcoin addresses

Code:

bc1qhsrl6ywvwx44zycz2tylpexza4xvtqkv6d903q
bc1q92md7868uun8vplp9te0vaecmxyc5rrphdyvxg
bc1q7hsnpd794pap2hd3htn8hszdfk5hzgsj5md9lz
bc1ql0p2lrnnxkxnw52phyq8tjr7elsqtnncad6mfv
bc1qyjkcthq9whn3e8h9dd26gjr9kd8pxmqdgvajwv
bc1q9h36cyfnqcxjeuw629kwmnp5a7k5pky8l2kzww
bc1qvr93mxj5ep58wlchdducthe89hcmk3a4uqpw3c
bc1qcla39fm0q8ka8th8ttpq0yxla30r430m4hgu3x
14MVEf1X4Qmrpxx6oASqzYzJQZUwwG7Fb5
3CrC4UitJqNqdkXY5XbJfCaGnbxHkKNqzL
31rTt8GePHv8LceXnujWqerUd81U29m857
1FmxAHft8trWjhRNvDsbjD8JNoSzDX8pfD

Fraudulent/malicious digital certificates (Windows only)

Code:

Name: PRO SOFTS

Serial Number: 15 8F D7 D2 FB 6E 69 E7 75 AB EE 6E
Name: EIZ Ltd

Serial Number: 06 6A F7 6B 79 4F 63 79 3C C0 CA 33 78 6F 07 47

RIG EK payload

Code:

9296b210b782faecca8394b2bd7bf720ffa5c122b83c4ed462ba25d3e1b8ce9a

transactionservices.exe (Electrum wallet)

Code:

c3a7cf30428689a44328090b994ce593bbf2a68141fcbefb899dee4fec336198

IPs (Electrum wallet host and configs)

Code:

178.159.37[.]113  
194.63.143[.]226  
217.147.169[.]179
188.214.135[.]174

https://blog.malwarebytes.com/cybercrime/2019/04/electrum-bitcoin-wallets-under-siege/

==

Phishing with Unicode



https://twitter.com/ElectrumWallet/status/1144678604523147265?s=20