Resubmissions
23/09/2026, 17:04
260923-vledlayx6m06/09/2026, 10:43
260906-msd3eashke01/09/2026, 13:41
260901-qzhwqazepg01/09/2026, 12:58
260901-p7y28szbqc1018/08/2026, 20:05
260818-yt533azcke1016/08/2026, 10:12
260816-l8ylbahj9t15/08/2026, 21:01
260815-ztx8wstdla15/08/2026, 20:42
260815-zhhdastyfv14/08/2026, 18:02
260814-wmq98afk9109/08/2026, 10:50
260809-mxkqrazta1General
- Target Supernova.zip
- Size 504.7MB
- Sample260203-v5pnnsbs2c
- SHA256 75911dc6fa5d482feb87fb96a1e2733395312459aa9096e2e78f54bb1090a7f4
Malware Config
Extracted
-
quasar
-
1.4.1
-
Office04
-
psp.jpn.com:4782
-
166bet.com.br:4782
-
goto.psp.jpn.com:4782
-
goto.166bet.com.br:4782
-
www.psp.jpn.com:4782
-
www.166bet.com.br:4782
-
6b272a31-8137-4076-b27d-9b0563ddf269
-
encryption_key
9D3C28E509C420315CFD1EE672665AE9DB4E9483
-
install_name
android.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
Android Studio
Extracted
-
nanocore
-
1.2.2.0
-
homevpn.anondns.net:14035
-
3d89217c-ec6f-4091-8c2a-47bee258415d
-
activate_away_mode
true
-
backup_connection_host
homevpn.anondns.net
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2025-08-09T23:21:58.635125336Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
14035
-
default_group
NEW
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
3d89217c-ec6f-4091-8c2a-47bee258415d
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
homevpn.anondns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Extracted
-
azorult
-
http://dnlgu.ru/1210776429.php
Extracted
-
phorphiex
-
http://178.16.54.109
Extracted
-
divulge
-
v2.0
-
https://discord.com/api/webhooks/1312882330339119204/DThrH97xNlw4juI_9g0e0fzDhrtHNdex_r-KkDBSRTms8TsaDB_AZHbN51MWJHNb9obG
-
sW7ROjkdVeQ0ALYye0hE
Extracted
-
stealc
-
default
-
http://198.251.89.171
-
url_path
/7fca4b626244404d.php
Extracted
-
mirai
-
LZRD
Extracted
-
runningrat
Extracted
-
kalim
-
moodleuni.com
Extracted
-
njrat
-
0.7d
-
ЛОХ
-
hakim32.ddns.net:2000
-
ZertSqaure-39469.portmap.host:39469
-
c8f3405c40ef239e221c95e4f96a0e54
-
reg_key
c8f3405c40ef239e221c95e4f96a0e54
-
splitter
|'|'|
Extracted
-
warmcookie
-
38.180.91.117
-
mutex
2dd4aba1-4d43-44ee-9b3f-9f64ff2e468d
-
user_agent
Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0
Extracted
-
pony
-
http://file.filecrate.ru/bussin/gate.php
Extracted
-
sodinokibi
-
$2a$10$PRliCdjvILpWha0dXt26COEfG3S.LFJG/H9fqsY0uepzhaO43cC36
-
3665
-
1kbk.com.ua
-
kalkulator-oszczednosci.pl
-
creative-waves.co.uk
-
mirkoreisser.de
-
fotoideaymedia.es
-
abogados-en-alicante.es
-
liikelataamo.fi
-
klusbeter.nl
-
jameskibbie.com
-
marathonerpaolo.com
-
milestoneshows.com
-
live-con-arte.de
-
tinyagency.com
-
beautychance.se
-
slwgs.org
-
midmohandyman.com
-
herbayupro.com
-
panelsandwichmadrid.es
-
baronloan.org
-
izzi360.com
-
net
false
-
pid
$2a$10$PRliCdjvILpWha0dXt26COEfG3S.LFJG/H9fqsY0uepzhaO43cC36
-
prc
visio
CagService
VeeamTransportSvc
dbsnmp
msaccess
bedbh
DellSystemDetect
encsvc
VeeamDeploymentSvc
steam
mydesktopqos
sqbcoreservice
dbeng50
mydesktopservice
firefox
outlook
tbirdconfig
raw_agent_svc
ocomm
pvlsvr
isqlplussvc
sql
ocautoupds
thunderbird
excel
synctime
EnterpriseClient
wordpad
bengien
vsnapvss
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome Massive Prints. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
3665
-
svc
MSSQL
VeeamTransportSvc
CAARCUpdateSvc
AcrSch2Svc
bedbg
stc_raw_agent
sophos
BackupExecDiveciMediaService
BackupExecVSSProvider
VeeamNFSSvc
CASAD2DWebSvc
BackupExecAgentAccelerator
veeam
vss
MSSQL$
MSExchange
sql
PDVFSService
VSNAPVSS
MVarmor64
AcronisAgent
ARSM
BackupExecRPCService
VeeamDeploymentService
svc$
BackupExecAgentBrowser
MVArmor
MSExchange$
BackupExecJobEngine
mepocs
Extracted
-
blihanstealer
-
pomdfghrt
-
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; CIBA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
Extracted
-
chromeb
-
iloveboats9.vip
Extracted
-
rustonotto
-
http://hnkoaa.co.kr/files/2023/12/01/win.php?U=
Extracted
-
amadey
-
5.73
-
9c4517
-
http://158.94.208.6
-
strings_key
52133829e72800688538466b68b5276c
-
url_paths
/h8jfdmdWS/index.php
Extracted
-
sakula
-
www.polarroute.com
Extracted
-
gravityrat
-
https://ent34ndx3cz8k.x.pipedream.net
-
.b17da333ec194ec4b767.d.requestbin.net
Extracted
-
asyncrat
-
1.0.7
-
OddsEvaluation
-
nmr.uk.com:443
-
nmr.uk.com:80
-
nmr.uk.com:8080
-
nmr.uk.com:4782
-
nmr.uk.com:1604
-
nmr.uk.com:1337
-
www.nmr.uk.com:443
-
www.nmr.uk.com:80
-
www.nmr.uk.com:8080
-
www.nmr.uk.com:4782
-
www.nmr.uk.com:1604
-
www.nmr.uk.com:1337
-
VantaOddsEngine_Main_H6AK
-
delay
1
-
install
true
-
install_file
VantaOddsEngine.exe
-
install_folder
%AppData%
Extracted
-
xred
-
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Extracted
-
orcus
-
6.tcp.ngrok.io:18058
-
1f5ae39956b94bedb3897736c07cbd71
-
autostart_method
Disable
-
enable_keylogger
false
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Extracted
-
darkvision
-
45.153.240.147
Extracted
-
discordrat
-
discord_token
MTQyNTYzNjA0NjYwMzAzMDUzMA.GuQt9L.zDQXFQKrxpBryZTK1_0Oc_5Q1QSZ0_jZa2TVx8
-
server_id
1425629411721609269
Extracted
-
lumma
-
https://t.me/dcsgegtvrgrgeg252sv
-
https://seismrzw.top/toox
-
https://mastwin.in/qsaz
-
https://ordinarniyvrach.ru/xiur
-
https://yamakrug.ru/lzka
-
https://vishneviyjazz.ru/neco
-
https://yrokistorii.ru/uqya
-
https://stolewnica.ru/xjuf
-
https://visokiywkaf.ru/mmtn
-
https://kletkamozga.ru/iwyq
-
build_id
09d9f2449a642943d38a9a3ebddcde2724642f120ace6593
Extracted
-
vipkeylogger
-
Protocol
smtp
-
Host
Server.lurstan.host
-
Port
25
-
Username
-
Password
WHHT}?V;Zu]W
-
Email to
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
mail.ozkocrulman.com
-
Port
587
-
Username
-
Password
12Ersan34
-
Email to
Extracted
-
icedid
-
wloppyload.top
Targets
-
- Target Supernova/Cassetto_Previdenziale-DE_JESUS_MILAGROS-BEROYA-FILIPPINE_RP-DJSMGR73S51Z216Z.pdf.exe
- Size 490KB
- SHA256 4ce67fdd6929d296988354eacc1d6db5516b97782993047196cebe772c10d2d5
Score8/10-
Sets file to hidden
Modifies file attributes to stop it showing in Explorer etc.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
- Target Supernova/Lihat file.exe
- Size 99KB
- SHA256 3a9837bf4b44b3475c4d2a8d6503a396d36da48a11c6b1a5726bab1ed9f4a4a6
Score5/10-
Drops file in System32 directory
-
- Target Supernova/a0941495981a46a188bd85dcb4c46da8.exe
- Size 3.3MB
- SHA256 9b3936346e58343112974184c2a8e2aa09d1c550acb9ddf2ec8014acb39ab0e9
Score1/10 -
- Target Supernova/a103d477621b4e43d13e601ba6a0390b9d95671c792f981c32b0cfffec39d878.exe
- Size 8.7MB
- SHA256 a103d477621b4e43d13e601ba6a0390b9d95671c792f981c32b0cfffec39d878
Score10/10-
Detects ZetaRAT
-
ZetaRAT
ZetaRAT is a remote access trojan written in Go.
-
Zetarat family
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target Supernova/a8d84d05f3786c88e3dd93db7024ad4804848054ccb86b2b09f542d4029b7078.exe
- Size 1.9MB
- SHA256 a8d84d05f3786c88e3dd93db7024ad4804848054ccb86b2b09f542d4029b7078
Score10/10-
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
-
Lumma family
-
Suspicious use of SetThreadContext
-
- Target Supernova/a905521e788bdd8627b2bbdf1ec33f8952fd0924f07180e8b8be6f319aa5e0e8.exe
- Size 4.7MB
- SHA256 a905521e788bdd8627b2bbdf1ec33f8952fd0924f07180e8b8be6f319aa5e0e8
Score10/10-
Detects Fesber payload
-
Fesber
Fesber is a Windows worm written in Delphi.
-
Fesber family
-
Modifies WinLogon for persistence
-
Contacts a large (1282) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE
-
Drops file in System32 directory
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target Supernova/a940014a730129f95371c84c982bcbf378586e7afd6eb2f3d0acaf0d15a8ded4.exe
- Size 1022KB
- SHA256 a940014a730129f95371c84c982bcbf378586e7afd6eb2f3d0acaf0d15a8ded4
Score10/10-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Drops startup file
-
Executes dropped EXE
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Suspicious use of SetThreadContext
-
- Target Supernova/acee1954a28c44d1353b5d05026d0de8bfc32e8b76c0a0ed1a057e9f6490e779.exe
- Size 114KB
- SHA256 acee1954a28c44d1353b5d05026d0de8bfc32e8b76c0a0ed1a057e9f6490e779
Score10/10-
VanillaRat
VanillaRat is an advanced remote administration tool coded in C#.
-
Vanillarat family
-
Vanilla Rat payload
-
- Target Supernova/ae1ad1ee347d6b057bafc3636c4bcf705c76126b0358c56b3e6dae6cf3be1533.exe
- Size 1.5MB
- SHA256 ae1ad1ee347d6b057bafc3636c4bcf705c76126b0358c56b3e6dae6cf3be1533
Score3/10 -
- Target Supernova/ae78caabec6a4241c64357ca5ca05de2e181fe253963de528807bf051fc3608e.exe
- Size 3.1MB
- SHA256 ae78caabec6a4241c64357ca5ca05de2e181fe253963de528807bf051fc3608e
Score10/10-
Darktortilla
DarkTortilla is a highly configurable .NET based crypter that delivers a wide range of information stealers.
-
Darktortilla family
-
Detects Darktortilla crypter.
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
- Target Supernova/b0ccad563c89aeb1319e33e712f447750767e7ededec5c403df7215fdac60b3c.exe
- Size 15.9MB
- SHA256 b0ccad563c89aeb1319e33e712f447750767e7ededec5c403df7215fdac60b3c
Score10/10-
Iris Stealer
Iris Stealer is an infostealer written in Python and packaged with PyInstaller.
-
Iris_stealer family
-
Loads dropped DLL
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target Supernova/b0fa29feb4da48f088d9e383d10ad8aef023efa91f6501142bb1f20749fd23d2.exe
- Size 1.0MB
- SHA256 b0fa29feb4da48f088d9e383d10ad8aef023efa91f6501142bb1f20749fd23d2
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook family
-
Formbook payload
-
Suspicious use of SetThreadContext
-
- Target Supernova/b2c55968ebfa683dde47a788acb0cea62d164be955460d11c8fb2bfa21004311.exe
- Size 966KB
- SHA256 b2c55968ebfa683dde47a788acb0cea62d164be955460d11c8fb2bfa21004311
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Reads WinSCP keys stored on the system
Tries to access WinSCP stored sessions.
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
SmartAssembly .NET packer
Detects SmartAssembly .NET packer.
-
Suspicious use of SetThreadContext
-
- Target Supernova/b49077822987a1a0cea869ed27e93f9f5d4d2be77d076dbe3ff51586511f29ab.exe
- Size 6.8MB
- SHA256 b49077822987a1a0cea869ed27e93f9f5d4d2be77d076dbe3ff51586511f29ab
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Loads dropped DLL
-
- Target Supernova/b64d2d8af29d85f7d379f8face0483badd39a9428d87495295bd3160879bae58.exe
- Size 3.1MB
- SHA256 b64d2d8af29d85f7d379f8face0483badd39a9428d87495295bd3160879bae58
Score10/10-
Detect SalatStealer payload
-
Salatstealer family
-
salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target Supernova/b9ce680718abab18162d7358dd9717276d4d77674f699aac9f7dfc3dc2e9115b.exe
- Size 382KB
- SHA256 b9ce680718abab18162d7358dd9717276d4d77674f699aac9f7dfc3dc2e9115b
Score10/10-
IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
-
Icedid family
-
IcedID First Stage Loader
MITRE ATT&CK Enterprise v16
Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1