Overview

overview

10

Static

static

10

Toxic/1002.exe

windows10-2004-x64

7

Toxic/1002.exe

windows11-21h2-x64

7

Toxic/1003.exe

windows10-2004-x64

7

Toxic/1003.exe

windows11-21h2-x64

7

Toxic/119.exe

windows10-2004-x64

6

Toxic/119.exe

windows11-21h2-x64

6

Toxic/131.exe

windows10-2004-x64

3

Toxic/131.exe

windows11-21h2-x64

3

Toxic/3_4.exe

windows10-2004-x64

7

Toxic/3_4.exe

windows11-21h2-x64

7

Toxic/753a...9a.exe

windows10-2004-x64

3

Toxic/753a...9a.exe

windows11-21h2-x64

3

Toxic/75db...4b.exe

windows10-2004-x64

10

Toxic/75db...4b.exe

windows11-21h2-x64

10

Toxic/7601...81.exe

windows10-2004-x64

7

Toxic/7601...81.exe

windows11-21h2-x64

7

Toxic/7d91...ea.exe

windows10-2004-x64

10

Toxic/7d91...ea.exe

windows11-21h2-x64

10

Toxic/7dc9...90.exe

windows10-2004-x64

7

Toxic/7dc9...90.exe

windows11-21h2-x64

3

Toxic/7f35...28.exe

windows10-2004-x64

10

Toxic/7f35...28.exe

windows11-21h2-x64

10

Toxic/837f...6d.exe

windows10-2004-x64

1

Toxic/837f...6d.exe

windows11-21h2-x64

1

Toxic/86a8...02.exe

windows10-2004-x64

3

Toxic/86a8...02.exe

windows11-21h2-x64

3

Toxic/AgentTesla.exe

windows10-2004-x64

4

Toxic/AgentTesla.exe

windows11-21h2-x64

4

Toxic/Chil...ws.exe

windows10-2004-x64

6

Toxic/Chil...ws.exe

windows11-21h2-x64

6

Toxic/CrimsonRAT.exe

windows10-2004-x64

10

Toxic/CrimsonRAT.exe

windows11-21h2-x64

10

Resubmissions

16/11/2025, 18:12

251116-wtdmps1nbl

16/11/2025, 18:11

251116-wsllxs1meq

03/10/2025, 22:14

251003-152acsv1fv

30/09/2025, 00:55

250930-a94ceaw1cv10

21/08/2025, 21:48

250821-1ns8esgp7w10

17/08/2025, 17:33

250817-v4xynaxse1

17/08/2025, 17:33

250817-v4tagaxsex

03/08/2025, 17:13

250803-vrvb1abq3z

27/07/2025, 18:57

250727-xmdjss1my3

26/07/2025, 20:10

250726-yx1yhscl2z10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Toxic.zip
  • Size 563.0MB
  • Sample250930-a94ceaw1cv
  • SHA256 cea9019c0b3d7532ed381b59812f730ba06d9bafd493e74a6bd302ef85f8b924
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
acrstealeragentteslaasyncratateraagentaurotunbabylonratblackcatblankgrabbercrimsonratdarkcometdarktrackdeerstealerhermeticwiperlimeratmimikatzmodiloadernanocoreneshtanjratnwormquasarredlineremcosrevengeratsectopratsnakekeyloggerthanosumbralvalleyrat_s2vidarxmrigzebrocybfe4251bf4f41a63c183f3cf7858790cdefaultguestguest1111guest16hackedhostlimoffice04newprokl1506aspackv2defense_evasiondiscoveryinstallermacromacro_on_actionminerpersistencepyinstallerratstealerthemidaupxvmprotectwiper

Malware Config

Extracted

Family

  • aurotun

Campaign

  • newprokl1506

C2

  • 144.172.117.158:7712

Attributes
  • anti_dbg

    false

  • anti_sandbox

    false

  • aurotun

    false

  • disable_mutex

    false

  • kx_pk

    /cns21hOLKJN9Tr3AbKk+oD8Qh1/PBnTL82QM6X2DwQ=

  • priviledge_escalation

    false

  • seal_pk

    GiYrCgliobgniKoLuL0SoosG8U3FjztMC3R4vzfrCRI=

  • sign_pk

    NGOfYTQ4zNNMwP30y6P2Juyph4suq3YTWBskHzQt+ng=

Extracted

Family

  • nanocore

Version

  • 1.2.2.0

C2

  • computernewb.com:80

  • discord.horse:80

Mutex

  • 4d0a1e0d-08d5-4a14-ba4f-5aa591ac722b

Attributes
  • activate_away_mode

    true

  • backup_connection_host

    discord.horse

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2025-04-03T22:24:52.440913136Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    true

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    80

  • default_group

    Default

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    4d0a1e0d-08d5-4a14-ba4f-5aa591ac722b

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    computernewb.com

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    true

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Extracted

Family

  • darktrack

C2

  • computernewb.com:12345

Extracted

Family

  • darkcomet

Botnet

  • Guest16

C2

  • computernewb.com:80

Mutex

  • DC_MUTEX-F54S21D

Attributes
  • gencode

    j0i6PNNSpxjg

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

rc4.plain

Extracted

Family

  • blackcat

Credentials
  • Username

    CREDITONE\Administrator
  • Password

    K3ny@2009
Credentials
  • Username

    CREDITONE\bexec
  • Password

    CloneD1sk4Song$%
Credentials
  • Username

    CREDITONE\KLarry
  • Password

    Kl..2021
Credentials
  • Username

    CREDITONE\BKuhl
  • Password

    Gromit2021!
Credentials
  • Username

    CREDITONE\rlopez
  • Password

    Victoria7856!
Credentials
  • Username

    CREDITONE\EJaramilla
  • Password

    1LoveVeros4
Credentials
  • Username

    .\Administrator
  • Password

    $fiji12$
Attributes
  • enable_network_discovery

    true

  • enable_self_propagation

    true

  • enable_set_wallpaper

    true

  • extension

    7954i9r

  • note_file_name

    RECOVER-${EXTENSION}-FILES.txt

  • note_full_text

    >> Introduction Important files on your system was ENCRYPTED and now they have have "${EXTENSION}" extension. In order to recover your files you need to follow instructions below. >> Sensitive Data Sensitive data on your system was DOWNLOADED and it will be PUBLISHED if you refuse to cooperate. Data includes: - Employees personal data, CVs, DL, SSN. - Complete network map including credentials for local and remote services. - Financial information including clients data, bills, budgets, annual reports, bank statements. - Complete datagrams/schemas/drawings for manufacturing in solidworks format - And more... Private preview is published here: http://alphvmmm27o3abo3r2mlmjrpdmzle3rykajqc5xsj7j7ejksbpsa36ad.onion/336eb50d-ebf8-436b-937d-ec075de46e7f/419ef3f950d9f346cf86db56db453539dcd51567ea871728e78dbc9918c7efeb >> CAUTION DO NOT MODIFY FILES YOURSELF. DO NOT USE THIRD PARTY SOFTWARE TO RESTORE YOUR DATA. YOU MAY DAMAGE YOUR FILES, IT WILL RESULT IN PERMANENT DATA LOSS. YOUR DATA IS STRONGLY ENCRYPTED, YOU CAN NOT DECRYPT IT WITHOUT CIPHER KEY. >> Recovery procedure Follow these simple steps to get in touch and recover your data: 1) Download and install Tor Browser from: https://torproject.org/ 2) Navigate to: http://sty5r4hhb5oihbq2mwevrofdiqbgesi66rvxr5sr573xgvtuvr4cs5yd.onion/?access-key=${ACCESS_KEY}

rsa_pubkey.plain

Extracted

Family

  • acrstealer

C2

  • 104.21.80.1

Attributes
  • ddrs

    overplanteasiest.top

Extracted

Family

  • limerat

Attributes
  • aes_key

    1

  • antivm

    false

  • c2_url

    https://computernewb.com/

  • delay

    3

  • download_payload

    false

  • install

    false

  • install_name

    Wservices.exe

  • main_folder

    Temp

  • pin_spread

    false

  • sub_folder

    \

  • usb_spread

    false

Extracted

Family

  • revengerat

Botnet

  • Guest

C2

  • computernewb.com:80

  • 0.tcp.ngrok.io:19521

Mutex

  • RV_MUTEX

Extracted

Family

  • njrat

Version

  • v2.0

Botnet

  • HacKed

C2

  • computernewb.com:80

Mutex

  • Windows

Attributes
  • reg_key

    Windows

  • splitter

    |-F-|

Extracted

Family

  • darkcomet

Botnet

  • Guest1111

C2

  • 193.242.166.48:1605

Mutex

  • DC_MUTEX-2QRLPN3

Attributes
  • InstallPath

    Windupdt\winupdate.exe

  • gencode

    Rb5l52XcV9no

  • install

    true

  • offline_keylogger

    false

  • password

    313131

  • persistence

    true

  • reg_key

    winupdater

rc4.plain

Extracted

Family

  • redline

Botnet

  • LIM

C2

  • 195.3.223.120:25539

Extracted

Family

  • remcos

Version

  • 1.7 Pro

Botnet

  • Host

C2

  • nickman12-46565.portmap.io:46565

  • nickman12-46565.portmap.io:1735

Attributes
  • audio_folder

    audio

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    5

  • copy_file

    Userdata.exe

  • copy_folder

    Userdata

  • delete_file

    true

  • hide_file

    true

  • hide_keylog_file

    true

  • install_flag

    true

  • install_path

    %WinDir%\System32

  • keylog_crypt

    true

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %WinDir%\System32

  • mouse_option

    false

  • mutex

    remcos_vcexssuhap

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screens

  • screenshot_path

    %AppData%

  • screenshot_time

    1

  • startup_value

    remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Extracted

Family

  • agenttesla

C2

  • http://193.56.29.110/divine/inc/4e9eb8fc30c033.php

Extracted

Family

  • quasar

Version

  • 1.4.0.0

Botnet

  • Office04

C2

  • computernewb.com:80

Mutex

  • RmMDZslEU2vJ6scHMI

Attributes
  • encryption_key

    9qdVQOhogsWLDddebAqR

  • install_name

    Client.exe

  • key_salt

    bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Extracted

Family

  • asyncrat

Version

  • 0.5.8

Botnet

  • Default

C2

  • computernewb.com:80

Mutex

  • FC1i2ZobIm7R

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Extracted

Family

  • valleyrat_s2

Version

  • 2025. 2. 5

C2

  • 43.250.174.49:8848

  • 127.0.0.1:8080

Attributes
  • campaign_date

    2025. 2. 5

Extracted

Family

  • snakekeylogger

Credentials

Extracted

Family

  • asyncrat

Version

  • Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

  • Default

Mutex

  • atbmbvaoawiij

Attributes
  • c2_url_file

    https://computernewb.com

  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Extracted

Family

  • nworm

Version

  • v0.3.8

C2

  • computernewb.com:80

  • discord.horse:80

Mutex

  • 35f629a5

Extracted

Family

  • vidar

Version

  • 14.3

Botnet

  • bfe4251bf4f41a63c183f3cf7858790c

C2

  • https://t.me/l07tp

  • https://steamcommunity.com/profiles/76561199869630181

Attributes
  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/137.0.0.0 Safari/537.36 OPR/122.0.0.0

Extracted

Family

  • crimsonrat

C2

  • 185.136.161.124

Targets

    • Target
      Toxic/1002.exe
    • Size 251KB
    • SHA256 5291232b297dfcb56f88b020ec7b896728f139b98cef7ab33d4f84c85a06d553
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    defense_evasionpersistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2
    • Target
      Toxic/1003.exe
    • Size 255KB
    • SHA256 8cf50ae247445de2e570f19705236ed4b1e19f75ca15345e5f00857243bc0e9b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    defense_evasionpersistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral3behavioral4
    • Target
      Toxic/119.exe
    • Size 24KB
    • SHA256 431111e367629bea37db016682c6354303360cd1419c033a22a26115121ccfe9
    • MD5 SHA1 SHA512 SSDEEP
    Score
    6/10
    discoverypersistenceupx

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral5behavioral6
    • Target
      Toxic/131.exe
    • Size 2.3MB
    • SHA256 2ecc525177ed52c74ddaaacd47ad513450e85c01f2616bf179be5b576164bf63
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral7behavioral8
    • Target
      Toxic/3_4.exe
    • Size 59KB
    • SHA256 036e4f452041f9d573f851d48d92092060107d9ea32e0c532849d61a598b8a71
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discoverypersistenceupx

    • Deletes itself

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral10behavioral9
    • Target
      Toxic/753ae5ce266745069670ae578e22c6385cc560bdaeb3b88486f4e3be62309c9a.exe
    • Size 139KB
    • SHA256 753ae5ce266745069670ae578e22c6385cc560bdaeb3b88486f4e3be62309c9a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral11behavioral12
    • Target
      Toxic/75dbc4c64f1cd618f52cc02ecf802f7e68adf01cd21ccca4246d63a98b68e74b.exe
    • Size 496KB
    • SHA256 75dbc4c64f1cd618f52cc02ecf802f7e68adf01cd21ccca4246d63a98b68e74b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    bfe4251bf4f41a63c183f3cf7858790cdiscoveryvidarstealer
    behavioral13behavioral14
    • Target
      Toxic/7601bb7c75658a2e6d3ea40258d34f70c26351a99c8730f37220286d7fd48e81.exe
    • Size 3.6MB
    • SHA256 7601bb7c75658a2e6d3ea40258d34f70c26351a99c8730f37220286d7fd48e81
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discovery

    • Executes dropped EXE

    behavioral15behavioral16
    • Target
      Toxic/7d91a585583f4aa1a3ab3cb808d7bc351d6140b3ae1deeef9d51c6414c11baea.exe
    • Size 80KB
    • SHA256 7d91a585583f4aa1a3ab3cb808d7bc351d6140b3ae1deeef9d51c6414c11baea
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    discoveryacrstealerstealer
    behavioral17behavioral18
    • Target
      Toxic/7dc94f5a019c17c3f0447b642b70c0c724a2a7f53b6fbcd206866b67cca20f90.exe
    • Size 1.0MB
    • SHA256 7dc94f5a019c17c3f0447b642b70c0c724a2a7f53b6fbcd206866b67cca20f90
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discoverypersistenceupx

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral19behavioral20
    • Target
      Toxic/7f35d5d9a5221faf280ff0864a499091fa6d1164f8af343f9482b39d930ff128.exe
    • Size 151KB
    • SHA256 7f35d5d9a5221faf280ff0864a499091fa6d1164f8af343f9482b39d930ff128
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    defense_evasiondiscoverypersistence

    • Modifies WinLogon for persistence

      persistence

    • Modifies visibility of hidden/system files in Explorer

      defense_evasion

    • Event Triggered Execution: Image File Execution Options Injection

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Indicator Removal: Clear Persistence

      remove IFEO.

      defense_evasion

    • Drops file in System32 directory

    behavioral21behavioral22
    • Target
      Toxic/837f60772b83b9aed7304d8e56f4aa8a49f7b79122e6d394447e9225105d6b6d.exe
    • Size 16KB
    • SHA256 837f60772b83b9aed7304d8e56f4aa8a49f7b79122e6d394447e9225105d6b6d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral23behavioral24
    • Target
      Toxic/86a8a49b1ef99c116aa66d5cf16ffead675d4e488b2924b417bfb84a6a162902.exe
    • Size 6KB
    • SHA256 86a8a49b1ef99c116aa66d5cf16ffead675d4e488b2924b417bfb84a6a162902
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral25behavioral26
    • Target
      Toxic/AgentTesla.exe
    • Size 2.8MB
    • SHA256 18aab0e981eee9e4ef8e15d4b003b14b3a1b0bfb7233fade8ee4b6a22a5abbb9
    • MD5 SHA1 SHA512 SSDEEP
    Score
    4/10
    discovery
    behavioral27behavioral28
    • Target
      Toxic/ChilledWindows.exe
    • Size 4.4MB
    • SHA256 ccb9502bf8ba5becf8b758ca04a5625c30b79e2d10d2677cc43ae4253e1288ec
    • MD5 SHA1 SHA512 SSDEEP
    Score
    6/10

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral29behavioral30
    • Target
      Toxic/CrimsonRAT.exe
    • Size 84KB
    • SHA256 dc31e710277eac1b125de6f4626765a2684d992147691a33964e368e5f269cba
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    crimsonratrat

    • CrimsonRAT main payload

    • CrimsonRat

      Crimson RAT is a malware linked to a Pakistani-linked threat actor.

      ratcrimsonrat

    • Crimsonrat family

      crimsonrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral31behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Event Triggered Execution

1
T1546

Image File Execution Options Injection

1
T1546.012

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Event Triggered Execution

1
T1546

Image File Execution Options Injection

1
T1546.012

Defense Evasion

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Indicator Removal

1
T1070

Clear Persistence

1
T1070.009

Modify Registry

3
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

3
T1012

System Information Discovery

4
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

newprokl1506upxthemidaguest16pyinstallerstealerinstallerguesthackedaspackv2guest1111wiperlimmacromacro_on_actionhostoffice04ratdefaultminervmprotectaurotunneshtababylonratnanocoredarktrackdarkcometthanosdeerstealerblackcatblankgrabberacrstealerlimeratrevengeratnjrathermeticwiperredlinesectopratmodiloaderremcoszebrocyagentteslaquasarateraagentasyncratvalleyrat_s2umbralsnakekeyloggernwormmimikatzxmrig
Score
10/10

behavioral1

defense_evasionpersistence
Score
7/10

behavioral2

defense_evasionpersistence
Score
7/10

behavioral3

defense_evasionpersistence
Score
7/10

behavioral4

defense_evasionpersistence
Score
7/10

behavioral5

discoverypersistenceupx
Score
6/10

behavioral6

discoverypersistenceupx
Score
6/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discoverypersistenceupx
Score
7/10

behavioral10

discoverypersistenceupx
Score
7/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

bfe4251bf4f41a63c183f3cf7858790cdiscoveryvidarstealer
Score
10/10

behavioral14

bfe4251bf4f41a63c183f3cf7858790cdiscoveryvidarstealer
Score
10/10

behavioral15

discovery
Score
7/10

behavioral16

discovery
Score
7/10

behavioral17

discoveryacrstealerstealer
Score
10/10

behavioral18

discoveryacrstealerstealer
Score
10/10

behavioral19

discoverypersistenceupx
Score
7/10

behavioral20

discovery
Score
3/10

behavioral21

defense_evasiondiscoverypersistence
Score
10/10

behavioral22

defense_evasiondiscoverypersistence
Score
10/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

discovery
Score
3/10

behavioral26

discovery
Score
3/10

behavioral27

discovery
Score
4/10

behavioral28

discovery
Score
4/10

behavioral29

Score
6/10

behavioral30

Score
6/10

behavioral31

crimsonratrat
Score
10/10

behavioral32

crimsonratrat
Score
10/10