General
- Target 260211-d5sxnafx9d_pw_infected.zip
- Size 504.9MB
- Sample260218-prjydads9b
- SHA256 c06f5959cde05e2af57d46214d49e6025582b73498379c162804eba86a2fc368
Malware Config
Extracted
-
quasar
-
1.4.1
-
Office04
-
psp.jpn.com:4782
-
166bet.com.br:4782
-
goto.psp.jpn.com:4782
-
goto.166bet.com.br:4782
-
www.psp.jpn.com:4782
-
www.166bet.com.br:4782
-
6b272a31-8137-4076-b27d-9b0563ddf269
-
encryption_key
9D3C28E509C420315CFD1EE672665AE9DB4E9483
-
install_name
android.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
Android Studio
Extracted
-
nanocore
-
1.2.2.0
-
homevpn.anondns.net:14035
-
3d89217c-ec6f-4091-8c2a-47bee258415d
-
activate_away_mode
true
-
backup_connection_host
homevpn.anondns.net
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2025-08-09T23:21:58.635125336Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
14035
-
default_group
NEW
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
3d89217c-ec6f-4091-8c2a-47bee258415d
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
homevpn.anondns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Extracted
-
azorult
-
http://dnlgu.ru/1210776429.php
Extracted
-
phorphiex
-
http://178.16.54.109
Extracted
-
divulge
-
v2.0
-
https://discord.com/api/webhooks/1312882330339119204/DThrH97xNlw4juI_9g0e0fzDhrtHNdex_r-KkDBSRTms8TsaDB_AZHbN51MWJHNb9obG
-
sW7ROjkdVeQ0ALYye0hE
Extracted
-
stealc
-
default
-
http://198.251.89.171
-
url_path
/7fca4b626244404d.php
Extracted
-
mirai
-
LZRD
Extracted
-
runningrat
Extracted
-
kalim
-
moodleuni.com
Extracted
-
njrat
-
0.7d
-
ЛОХ
-
hakim32.ddns.net:2000
-
ZertSqaure-39469.portmap.host:39469
-
c8f3405c40ef239e221c95e4f96a0e54
-
reg_key
c8f3405c40ef239e221c95e4f96a0e54
-
splitter
|'|'|
Extracted
-
warmcookie
-
38.180.91.117
-
mutex
2dd4aba1-4d43-44ee-9b3f-9f64ff2e468d
-
user_agent
Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0
Extracted
-
pony
-
http://file.filecrate.ru/bussin/gate.php
Extracted
-
sodinokibi
-
$2a$10$PRliCdjvILpWha0dXt26COEfG3S.LFJG/H9fqsY0uepzhaO43cC36
-
3665
-
1kbk.com.ua
-
kalkulator-oszczednosci.pl
-
creative-waves.co.uk
-
mirkoreisser.de
-
fotoideaymedia.es
-
abogados-en-alicante.es
-
liikelataamo.fi
-
klusbeter.nl
-
jameskibbie.com
-
marathonerpaolo.com
-
milestoneshows.com
-
live-con-arte.de
-
tinyagency.com
-
beautychance.se
-
slwgs.org
-
midmohandyman.com
-
herbayupro.com
-
panelsandwichmadrid.es
-
baronloan.org
-
izzi360.com
-
net
false
-
pid
$2a$10$PRliCdjvILpWha0dXt26COEfG3S.LFJG/H9fqsY0uepzhaO43cC36
-
prc
visio
CagService
VeeamTransportSvc
dbsnmp
msaccess
bedbh
DellSystemDetect
encsvc
VeeamDeploymentSvc
steam
mydesktopqos
sqbcoreservice
dbeng50
mydesktopservice
firefox
outlook
tbirdconfig
raw_agent_svc
ocomm
pvlsvr
isqlplussvc
sql
ocautoupds
thunderbird
excel
synctime
EnterpriseClient
wordpad
bengien
vsnapvss
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome Massive Prints. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
3665
-
svc
MSSQL
VeeamTransportSvc
CAARCUpdateSvc
AcrSch2Svc
bedbg
stc_raw_agent
sophos
BackupExecDiveciMediaService
BackupExecVSSProvider
VeeamNFSSvc
CASAD2DWebSvc
BackupExecAgentAccelerator
veeam
vss
MSSQL$
MSExchange
sql
PDVFSService
VSNAPVSS
MVarmor64
AcronisAgent
ARSM
BackupExecRPCService
VeeamDeploymentService
svc$
BackupExecAgentBrowser
MVArmor
MSExchange$
BackupExecJobEngine
mepocs
Extracted
-
blihanstealer
-
pomdfghrt
-
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; CIBA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
Extracted
-
chromeb
-
iloveboats9.vip
Extracted
-
rustonotto
-
http://hnkoaa.co.kr/files/2023/12/01/win.php?U=
Extracted
-
amadey
-
5.73
-
9c4517
-
http://158.94.208.6
-
strings_key
52133829e72800688538466b68b5276c
-
url_paths
/h8jfdmdWS/index.php
Extracted
-
sakula
-
www.polarroute.com
Extracted
-
gravityrat
-
https://ent34ndx3cz8k.x.pipedream.net
-
.b17da333ec194ec4b767.d.requestbin.net
Extracted
-
asyncrat
-
1.0.7
-
OddsEvaluation
-
nmr.uk.com:443
-
nmr.uk.com:80
-
nmr.uk.com:8080
-
nmr.uk.com:4782
-
nmr.uk.com:1604
-
nmr.uk.com:1337
-
www.nmr.uk.com:443
-
www.nmr.uk.com:80
-
www.nmr.uk.com:8080
-
www.nmr.uk.com:4782
-
www.nmr.uk.com:1604
-
www.nmr.uk.com:1337
-
VantaOddsEngine_Main_H6AK
-
delay
1
-
install
true
-
install_file
VantaOddsEngine.exe
-
install_folder
%AppData%
Extracted
-
xred
-
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Extracted
-
orcus
-
6.tcp.ngrok.io:18058
-
1f5ae39956b94bedb3897736c07cbd71
-
autostart_method
Disable
-
enable_keylogger
false
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Extracted
-
darkvision
-
45.153.240.147
Extracted
-
vertexnet
-
www.ljliun.za.com
-
DC_kjdsHsKS_
-
C2Path
/user10/
Extracted
-
discordrat
-
discord_token
MTQyNTYzNjA0NjYwMzAzMDUzMA.GuQt9L.zDQXFQKrxpBryZTK1_0Oc_5Q1QSZ0_jZa2TVx8
-
server_id
1425629411721609269
Extracted
-
gozi
Targets
-
- Target Supernova/155713f28c8ddb04005519f13b11059f6155e3b5052a47d06cc9ac322a83ef9a.exe
- Size 10.2MB
- SHA256 155713f28c8ddb04005519f13b11059f6155e3b5052a47d06cc9ac322a83ef9a
Score10/10-
Gozi
Gozi is a well-known and widely distributed banking trojan.
-
Gozi family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE
-
Themida packer
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled
-
Suspicious use of NtSetInformationThreadHideFromDebugger