hxxps://gofile[.]io/d/48bKeR

Resubmissions

21/02/2026, 20:13

260221-yzpm9sbs6b6

18/02/2026, 15:57

260218-teb48adw2d10

Sharing

Copy URL Twitter E-mail

General

Target
https://gofile.io/d/48bKeR
Sample260218-teb48adw2d

Score

10^/10

Malware Config

Targets

- Target
  https://gofile.io/d/48bKeR
Score

10^/10

romcom storm_0978 apt discovery exploit persistence cve_2025_8088
- Detects RAR archive exploited with CVE-2025-8088 ADS path traversal.
  exploit apt romcom storm_0978 cve_2025_8088
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Detects RAR archive exploited with CVE-2025-8088 ADS path traversal.

Contacts third-party web service commonly abused for C2

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

urlscan1

behavioral1