The intention may well be to download a cocktail of malware. The executable file also attempts to download other files, although currently only two files are downloaded. The Kpot Trojan steals information such as banking credentials that have been saved in browsers and can also steal cryptowallets. The Kpot Trojan is an information stealer that steals a variety of credentials, including Skype, Steam, Discord, VPN, email, and FTP passwords from a variety of different applications. Executing this file will download two malicious payloads: CoronaVirus ransomware and the Kpot Trojan. If a website visitor tries to download WiseCleaner from the malicious website (The genuine website is ), a file named WSHSetup.exe will be downloaded.

These adverts are displayed on many legitimate websites that use third party ad networks to generate extra revenue. Campaigns such as this typically use malvertising for traffic – Malicious adverts on ad networks that direct users to malicious websites. It is currently unclear how traffic to the website is being generated. WiseCleaner is legitimate software tool, but the website used in this campaign is fake.

CoronaVirus ransomware is being distributed through a malicious website masquerading as software called WiseCleaner, a tool that can be used to clean up the registry and remove duplicate files and junk files from computers. Many phishing campaigns have been detected that use the novel coronavirus as a lure and now a new ransomware variant called CoronaVirus has been detected and analyzed by MalwareHunterTeam.

Wise registry cleaner safe