Overview

overview

10

Static

static

10

Toxic/Hitler.exe

windows10-2004-x64

1

Toxic/ShellLocker.exe

windows10-2004-x64

3

Resubmissions

22/07/2025, 18:32

250722-w6yhmseq41

24/06/2025, 09:27

250624-let12a1sbz

24/06/2025, 09:26

250624-lep23s1sbw

22/06/2025, 19:13

250622-xw6lyacj5110

19/06/2025, 04:32

250619-e53yasbk2110

19/06/2025, 03:50

250619-eed69agm4v10

18/06/2025, 14:07

250618-rfbhzael31

18/06/2025, 13:13

250618-qf8m2aam4y10

18/06/2025, 12:23

250618-pkfx5sgp4s10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Toxic.7z
  • Size 301.4MB
  • Sample250619-e53yasbk21
  • SHA256 0245cdb76d5aad7c457fa837b65262ab63fd2c1bd9ab885497166d3f378013f2
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
agentteslaaurorablackcatdarkcomethermeticwipermimikatzmodiloaderneshtanjratredlineremcosrevengeratsectopratthanosxmrigzebrocygeforceguestguest1111hostlimaspackv2discoverymacromacro_on_actionminerstealerthemidaupxvmprotectwiper

Malware Config

Extracted

Family

  • blackcat

Credentials
  • Username

    CREDITONE\Administrator
  • Password

    K3ny@2009
Credentials
  • Username

    CREDITONE\bexec
  • Password

    CloneD1sk4Song$%
Credentials
  • Username

    CREDITONE\KLarry
  • Password

    Kl..2021
Credentials
  • Username

    CREDITONE\BKuhl
  • Password

    Gromit2021!
Credentials
  • Username

    CREDITONE\rlopez
  • Password

    Victoria7856!
Credentials
  • Username

    CREDITONE\EJaramilla
  • Password

    1LoveVeros4
Credentials
  • Username

    .\Administrator
  • Password

    $fiji12$
Attributes
  • enable_network_discovery

    true

  • enable_self_propagation

    true

  • enable_set_wallpaper

    true

  • extension

    7954i9r

  • note_file_name

    RECOVER-${EXTENSION}-FILES.txt

  • note_full_text

    >> Introduction Important files on your system was ENCRYPTED and now they have have "${EXTENSION}" extension. In order to recover your files you need to follow instructions below. >> Sensitive Data Sensitive data on your system was DOWNLOADED and it will be PUBLISHED if you refuse to cooperate. Data includes: - Employees personal data, CVs, DL, SSN. - Complete network map including credentials for local and remote services. - Financial information including clients data, bills, budgets, annual reports, bank statements. - Complete datagrams/schemas/drawings for manufacturing in solidworks format - And more... Private preview is published here: http://alphvmmm27o3abo3r2mlmjrpdmzle3rykajqc5xsj7j7ejksbpsa36ad.onion/336eb50d-ebf8-436b-937d-ec075de46e7f/419ef3f950d9f346cf86db56db453539dcd51567ea871728e78dbc9918c7efeb >> CAUTION DO NOT MODIFY FILES YOURSELF. DO NOT USE THIRD PARTY SOFTWARE TO RESTORE YOUR DATA. YOU MAY DAMAGE YOUR FILES, IT WILL RESULT IN PERMANENT DATA LOSS. YOUR DATA IS STRONGLY ENCRYPTED, YOU CAN NOT DECRYPT IT WITHOUT CIPHER KEY. >> Recovery procedure Follow these simple steps to get in touch and recover your data: 1) Download and install Tor Browser from: https://torproject.org/ 2) Navigate to: http://sty5r4hhb5oihbq2mwevrofdiqbgesi66rvxr5sr573xgvtuvr4cs5yd.onion/?access-key=${ACCESS_KEY}

rsa_pubkey.plain

Extracted

Family

  • darkcomet

Botnet

  • Guest1111

C2

  • 193.242.166.48:1605

Mutex

  • DC_MUTEX-2QRLPN3

Attributes
  • InstallPath

    Windupdt\winupdate.exe

  • gencode

    Rb5l52XcV9no

  • install

    true

  • offline_keylogger

    false

  • password

    313131

  • persistence

    true

  • reg_key

    winupdater

rc4.plain

Extracted

Family

  • redline

Botnet

  • LIM

C2

  • 195.3.223.120:25539

Extracted

Family

  • njrat

Version

  • 0.7d

Botnet

  • Geforce

C2

  • startitit2-23969.portmap.host:1604

Mutex

  • b9584a316aeb9ca9b31edd4db18381f5

Attributes
  • reg_key

    b9584a316aeb9ca9b31edd4db18381f5

  • splitter

    Y262SUCZ4UJJ

Extracted

Family

  • remcos

Version

  • 1.7 Pro

Botnet

  • Host

C2

  • nickman12-46565.portmap.io:46565

  • nickman12-46565.portmap.io:1735

Attributes
  • audio_folder

    audio

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    5

  • copy_file

    Userdata.exe

  • copy_folder

    Userdata

  • delete_file

    true

  • hide_file

    true

  • hide_keylog_file

    true

  • install_flag

    true

  • install_path

    %WinDir%\System32

  • keylog_crypt

    true

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %WinDir%\System32

  • mouse_option

    false

  • mutex

    remcos_vcexssuhap

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screens

  • screenshot_path

    %AppData%

  • screenshot_time

    1

  • startup_value

    remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Extracted

Family

  • revengerat

Botnet

  • Guest

C2

  • 0.tcp.ngrok.io:19521

Mutex

  • RV_MUTEX

Extracted

Family

  • agenttesla

C2

  • http://193.56.29.110/divine/inc/4e9eb8fc30c033.php

Extracted

Family

  • aurora

C2

  • 94.142.138.22:8081

Targets

    • Target
      Toxic/Hitler.exe
    • Size 83KB
    • SHA256 cc19c3241f7e32532218b47a621622c832ba4cb34006a3729c76fc3d45a3de3d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral1
    • Target
      Toxic/ShellLocker.exe
    • Size 679KB
    • SHA256 c9661b2f5274b1835d64e6d58ea5a8ff58ffa8d9d19a9a31bd43f074c6e2eb69
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral2

MITRE ATT&CK Enterprise v16

Tasks