General
- Target Malwares.7z
- Size 148.0MB
- Sample250618-ehc4csaj2t
- SHA256 ef1b6659c135d37a9e43aeafc5e5df5d78320cf1630d3121028df2ea48befb0d
Score
10/10
Malware Config
Extracted
Family
-
darkcomet
Botnet
-
Guest1111
C2
-
193.242.166.48:1605
Mutex
-
DC_MUTEX-2QRLPN3
Attributes
-
InstallPath
Windupdt\winupdate.exe
-
gencode
Rb5l52XcV9no
-
install
true
-
offline_keylogger
false
-
password
313131
-
persistence
true
-
reg_key
winupdater
rc4.plain
Extracted
Family
-
njrat
Version
-
0.7d
Botnet
-
Geforce
C2
-
startitit2-23969.portmap.host:1604
Mutex
-
b9584a316aeb9ca9b31edd4db18381f5
Attributes
-
reg_key
b9584a316aeb9ca9b31edd4db18381f5
-
splitter
Y262SUCZ4UJJ
Extracted
Family
-
remcos
Version
-
1.7 Pro
Botnet
-
Host
C2
-
nickman12-46565.portmap.io:46565
-
nickman12-46565.portmap.io:1735
Attributes
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
Userdata.exe
-
copy_folder
Userdata
-
delete_file
true
-
hide_file
true
-
hide_keylog_file
true
-
install_flag
true
-
install_path
%WinDir%\System32
-
keylog_crypt
true
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%WinDir%\System32
-
mouse_option
false
-
mutex
remcos_vcexssuhap
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screens
-
screenshot_path
%AppData%
-
screenshot_time
1
-
startup_value
remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Extracted
Family
-
revengerat
Botnet
-
Guest
C2
-
0.tcp.ngrok.io:19521
Mutex
-
RV_MUTEX
Targets
-
- Target Malwares/ClientUpdate.exe (x64).bin
- Size 308KB
- SHA256 becb74a8a71a324c78625aa589e77631633d0f15af1473dfe34eca06e7ec6b86
Score1/10 -
- Target Malwares/ClientUpdate.exe (x86).bin
- Size 324KB
- SHA256 2fc39463b6db44873c9c07724ac28b63cdd72f5863a4a7064883e3afdd141f8d
Score8/10-
Creates new service(s)