--- title: SpriteCoin is a New Ransomware, Not Cryptocurrency description: The new SpriteCoin ransomware (also known as MoneroPay) leverages a novel social engineering technique – posing as a new cryptocurrency called SpriteCoin. It packs a one-two punch as well, combining a cryptolocker and password stealer in a single application. The link to the SpriteCoin homepage was published on the bitcointalk.org forum and spread among users interested in new cryptocurrencies. The topic was removed when its malicious nature was revealed, but let’s take a look at the details. canonical_url: https://www.acronis.com/en/blog/posts/spritecoin-new-ransomware-not-cryptocurrency/ locale: en last_updated: 2026-10-27 --- [Acronis Blog](https://www.acronis.com/en/blog/) # SpriteCoin is a New Ransomware, Not Cryptocurrency The new SpriteCoin ransomware (also known as MoneroPay) leverages a novel social engineering technique – posing as a new cryptocurrency called SpriteCoin. It packs a one-two punch as well, combining a cryptolocker and password stealer in a single application. The link to the SpriteCoin homepage was published on the bitcointalk.org forum and spread among users interested in new cryptocurrencies. The topic was removed when its malicious nature was revealed, but let’s take a look at the details. [Learn More](https://www.acronis.com/en/products/cyber-protect/) [![Image 2: MSP Threats Security Team](https://staticfiles.acronis.com/images/content/1578b8dff96325855c4525d865e7fc63.png)](https://www.acronis.com/en/blog/authors/acronis-security-team/ "MSP Threats Security Team") [MSP Threats Security Team](https://www.acronis.com/en/blog/authors/acronis-security-team/) 9 min read Last updated 27 November 2019 The new SpriteCoin (also known as MoneroPay) [ransomware](https://www.acronis.com/en-us/ransomware-protection/) leverages a novel social engineering technique – posing as a new cryptocurrency called SpriteCoin – and combines a cryptolocker and password stealer in a single application. The link to the SpriteCoin homepage was published on the bitcointalk.org forum and spread among users interested in new cryptocurrencies. The topic was removed when its malicious nature was revealed. ![Image 3: SpriteCoin tweet](https://staticfiles.acronis.com/images/content/254488156d23e4441fa09cb209720b1f.png) SpriteCoin tweet ![Image 4: SpriteCoin Introduction](https://staticfiles.acronis.com/images/content/7d4c460a941986272efcef6fcb59f363.png) SpriteCoin Introduction Once a user downloads and runs the rouge cryptocurrency application, the cryptolocker encrypts files and demands a ransom via the Monero cryptocurrency to decrypt user’s data. ### Installation The downloaded SpriteCoin package includes: * spritecoind.exe (MD5: 14ea53020b4d0cb5acbea0bf2207f3f6) - a cryptolocker * spritecoinwallet.exe (MD5: c442dd3808dfbd6fa768319f3d0b8deb) - a fake wallet application * boost.dll (MD5: b3d2b7e3f48394691838099f6d539b5e) - the boost library * cryptonight.dll (MD5: 6e2233bfda2e578fd03f2e59001a4544) - the library implementing the CryptoNight algorithm The ‘spritecoinwallet.exe’ application shows the windows with fake wallet operations while connecting to the C&C server. ![Image 5: SpriteCoin Install 1](https://staticfiles.acronis.com/images/content/b5b500da90cbc847c5f8aa2d6a966526.png) SpriteCoin Install 1 ![Image 6: SpriteCoin Install 2](https://staticfiles.acronis.com/images/content/9ae9b41d387cd955425d0ba1902cde64.png) SpriteCoin Install 2 ![Image 7: SpriteCoin Install 3](https://staticfiles.acronis.com/images/content/56f0814bf083dcb93fae1be0710c7309.png) SpriteCoin Install 3 Once the connection has been established, it starts the cryptolocker ‘spritecoind.exe’. The cryptolocker ‘spritecoind.exe’ is 1,228,800 bytes in size and UPX packed. Once executed, the SpriteCoin adds the reference to the copy of ‘spritecoind.exe’ to the Autorun key: _[HKEY\_CURRENT\_USER\Software\Microsoft\Windows\CurrentVersion\Run]_ _‘MoneroPay’ = ‘C:\Users\\AppData\Roaming\MoneroPayAgent.exe’_ ![Image 8: SpriteCoin Install 4](https://staticfiles.acronis.com/images/content/4a6f6ec416e32dbc00370ff8476373be.png) SpriteCoin Install 4 ![Image 9: SpriteCoin Install 5](https://staticfiles.acronis.com/images/content/a62f4208e0d6f10f9e466340b20e950e.png) SpriteCoin Install 5 ### Communication with C&C The cryptolocker connects to the C&C server in the Tor network using the web proxy: _http://jmqapf3nflatei35.onion.link/paid?id=_ __ ![Image 10: SpriteCoin CC 1](https://staticfiles.acronis.com/images/content/d5cf0f6d637aa56b52c29224a0340747.png) SpriteCoin CC 1 ![Image 11: SpriteCoin CC 2](https://staticfiles.acronis.com/images/content/3178c9f60ee4b9cd2f21b25f265d0d47.png) SpriteCoin CC 2 ‘Payment ID’ is the first eight bytes of the hash of the computer name and C&C server address. It is also the first eight bytes of the file encryption key. The MoneroPay strain starts two threads to upload and download information to and from the C&C server. ![Image 12: SpriteCoin CC 3](https://staticfiles.acronis.com/images/content/09c36a9b259ee5b29e524f2f5ca4e2eb.png) SpriteCoin CC 3 * The ‘download’ thread implements downloading and execution of a new piece of malware from the C&C server by the following link: _http://jmqapf3nflatei35.onion.link/static/win_ ![Image 13: SpriteCoin CC 4](https://staticfiles.acronis.com/images/content/2f14af15793266ba69c3d664aa852415.png) SpriteCoin CC 4 * The ‘upload’ thread collects information about an infected computer and dumps logins and passwords stored in Mozilla Firefox and Chrome browsers. ![Image 14: SpriteCoin CC 5](https://staticfiles.acronis.com/images/content/44d47d6f9f23c2b81467004be544dcad.png) SpriteCoin CC 5 The collected data is regularly uploaded to the C&C server using the following link and code: _http://jmqapf3nflatei35.onion.link/log?id=_ ![Image 15: SpriteCoin CC 6](https://staticfiles.acronis.com/images/content/6457a29fe351d81f6fc1bd226a74705c.png) SpriteCoin CC 6 ### Key generation The key is 128 bits in size and generated based on the following strings: * A victim’s computer name (%COMPUTERNAME%) * A user name (%USERNAME%) * A user profile strings (%USERPROFILE%) * C&C address: jmqapf3nflatei35.onion ![Image 16: SpriteCoin Key Generation](https://staticfiles.acronis.com/images/content/275bb6f70f643472ca7e4c4f565156ac.png) SpriteCoin Key Generation ### File encryption The MoneroPay ransomware encrypts the files that contain the strings below in the file name, adding ‘.encrypted’ to the original file name. _c txt py doc rtf cpp cc go tcl html ppt docx xls xlsx pptx key pem psd mkv mp4 ogv zip jpg jpeg work pyw h hpp cgi pl rar lua img iso webm jar java class one htm js css vbs 7z eps psf png apk ps1 gz wallet.dat id\_rsa_ For example: ![Image 17: SpriteCoin Encrypt 1](https://staticfiles.acronis.com/images/content/de6e078dc7ee41290184e58fdf3e65d8.png) SpriteCoin Encrypt 1 For debugging purposes, the author used the %TESTME% environment variable disabled in the release version that turns off file encryption. ![Image 18: SpriteCoin Encrypt 2](https://staticfiles.acronis.com/images/content/230cb461d38e7600a7d8bd98e3972f03.png) SpriteCoin Encrypt 2 The MoneroPay uses the Salsa20 algorithm for files encryption. The same key is used for all files encrypted from a hijacked computer. File encryption: ![Image 19: SpriteCoin Encrypt 3](https://staticfiles.acronis.com/images/content/5603a23e2b82fdf41f831d6dfb133966.png) SpriteCoin Encrypt 3 The Salsa20 call: ![Image 20: SpriteCoin Encrypt 4](https://staticfiles.acronis.com/images/content/691155d5dde07eb8e2f06967c9d0c5bc.png) SpriteCoin Encrypt 4 ### Ransom note Once the MoneroPay ransomware successfully registers a new victim at C&C (jmqapf3nflatei35.onion), it shows the ransom note in the specially created window titled ‘MoneroPay’ that emulates the Internet browser. The ransom payment is 0.3 Monero (less than $100 by current rate). ![Image 21: SpriteCoin Ransom 1](https://staticfiles.acronis.com/images/content/d42ccedcf8e31996ce90e80414172a8e.png) SpriteCoin Ransom 1 ![Image 22: SpriteCoin Ransom 2](https://staticfiles.acronis.com/images/content/7eb626791321af5e650695f669065815.png) SpriteCoin Ransom 2 ![Image 23: SpriteCoin Ransom 3](https://staticfiles.acronis.com/images/content/7a62e24c454a88d4ba0dedde6181b628.png) SpriteCoin Ransom 3 ![Image 24: SpriteCoin Ransom 4](https://staticfiles.acronis.com/images/content/4cab212d3c1cb5f162f4c617190af825.png) SpriteCoin Ransom 4 ### Stealing login data from Chrome and Mozilla Firefox browsers The MoneroPay tries to retrieve login data stored in Mozilla Firefox and Chrome browsers, which it later sends to the C&C server using the code similar to https://github.com/wekillpeople/browser-dumpwd. ![Image 25: SpriteCoin password stealer 1](https://staticfiles.acronis.com/images/content/a5aa18bca4dab6f4f9db2a5b00d0835a.png) SpriteCoin password stealer 1 ![Image 26: SpriteCoin password stealer 2](https://staticfiles.acronis.com/images/content/d952b9570fbcc758db869ce78947d0c1.png) SpriteCoin password stealer 2 ### Conclusion The decryption of files can be challenging without assistance of cyber security experts. Moreover, as stated by Fortinet, a victim can get one more malware under the guise of a decryptor in case of paying a ransom. It is recommended not to pay the ransom and restore the files from backups. You can use [Acronis True Image 2018](https://www.acronis.com/en-us/personal/computer-backup/) and our other products with [Acronis Active Protection](https://www.acronis.com/en-us/active-protection/) enabled to detect and stop MoneroPay (SpriteCoin) ransomware. You’ll also be able to restore any affected files in matter of seconds. ![Image 27: SpriteCoin Detected 1](https://staticfiles.acronis.com/images/content/16faa7d601351a382089930238cb34ff.png) SpriteCoin Detected 1 ![Image 28: SpriteCoin Detected 2](https://staticfiles.acronis.com/images/content/c75e83f0e3fe30deaf3879a330538214.png) SpriteCoin Detected 2 [Cybersecurity](https://www.acronis.com/en/blog/tags/cybersecurity/) [Cyber protection](https://www.acronis.com/en/blog/tags/cyber-protection/) ## Written by ![Image 29: MSP Threats Security Team](https://staticfiles.acronis.com/images/content/1578b8dff96325855c4525d865e7fc63.png) MSP Threats Security Team [Previous post](https://www.acronis.com/en/blog/posts/fighting-good-fight-acronis-launches-free-ransomware-protection/) [Fighting the Good Fight: Acronis Launches Free Ransomware Protection](https://www.acronis.com/en/blog/posts/fighting-good-fight-acronis-launches-free-ransomware-protection/) [Next post](https://www.acronis.com/en/blog/posts/connecting-to-nas-over-afp/) [Connecting to NAS over AFP](https://www.acronis.com/en/blog/posts/connecting-to-nas-over-afp/) About Acronis Acronis is a leader in AI-native cyber protection, unifying data protection, cybersecurity, IT operations and hybrid infrastructure to deliver business continuity, security and compliance with less cost and complexity. More than 21,000 service providers trust Acronis to protect over 750,000 businesses in 150 countries. Acronis is headquartered in Schaffhausen, Switzerland. [Add as a preferred source on Google](https://google.com/preferences/source?q=acronis.com) ## Related stories Want to learn more? Read the latest stories featuring this solution on our blog. [Acronis Blog](https://www.acronis.com/en/blog/) ![Image 30: stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://staticfiles.acronis.com/images/blog-card/9600f3eea83b8f4e168ea6c1409c8c26.png) [stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://www.acronis.com/en/blog/posts/stc-bahrain-and-acronis-partner-to-bring-endpoint-security-to-businesses/) We are proud to announce a strategic partnership with stc Bahrain, expanding access to advanced cybersecurity services for businesses across Bahrain. **October 26, 2026**3 min read ![Image 31: Introducing New Acronis CEO: Prakash Panjwani](https://staticfiles.acronis.com/images/blog-card/30cb571f6f1aaa131733e5727a4a250c.png) [Introducing New Acronis CEO: Prakash Panjwani](https://www.acronis.com/en/blog/posts/introducing-new-acronis-ceo-prakash-panjwani/) We are pleased to announce the appointment of our new Chief Executive Officer, Prakash Panjwani. A veteran cybersecurity CEO, Panjwani previously served as CEO of WatchGuard Technologies and SafeNet. **October 15, 2026**2 min read ![Image 32: Acronis expands MDR toward broader workspace protection](https://staticfiles.acronis.com/images/blog-card/18e90e89f5ec4ef0901f19008d4ccbf2.png) [Acronis expands MDR toward broader workspace protection](https://www.acronis.com/en/blog/posts/acronis-expands-mdr-toward-broader-workspace-protection/) Acronis is expanding the MDR service with capabilities that make this expertise easier to deliver and help partners address more risks. The developments build on a broader commitment to managed security: helping service providers protect the connected workspace while giving customers access to the expertise needed to investigate threats, respond effectively and maintain business continuity. **October 13, 2026**6 min read