Overview

overview

10

Static

static

10

The-MALWAR...er.zip

windows11-21h2-x64

Resubmissions

24/02/2026, 08:31

260224-kev3naf12h10

24/02/2026, 07:52

260224-jqcvsae18f10

23/02/2026, 12:37

260223-ptpxeabx6c10

22/02/2026, 03:23

260222-dxq34adz2b

22/02/2026, 03:12

260222-dqndmadx9f10

22/02/2026, 02:57

260222-df242adv7h10

22/02/2026, 02:41

260222-c6zadsds3f10

Sharing

Copy URL Twitter E-mail

General

  • Target
    The-MALWARE-Repo-master.zip
  • Size 198.8MB
  • Sample260222-df242adv7h
  • SHA256 b7dd3bce3ebfbc2d5e3a9f00d47f27cb6a5895c4618c878e314e573a7c216df1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
darkcometkillmbrmodiloadermydoomnjratremcosrevengeratsasserwipelockgeforceguestguest1111hostaspackv2defense_evasiondiscoveryinstallermacromacro_on_actionpersistenceprivilege_escalationstealerupx

Malware Config

Extracted

Family

  • darkcomet

Botnet

  • Guest1111

C2

  • 193.242.166.48:1605

Mutex

  • DC_MUTEX-2QRLPN3

Attributes
  • InstallPath

    Windupdt\winupdate.exe

  • gencode

    Rb5l52XcV9no

  • install

    true

  • offline_keylogger

    false

  • password

    313131

  • persistence

    true

  • reg_key

    winupdater

rc4.plain

Extracted

Family

  • njrat

Version

  • 0.7d

Botnet

  • Geforce

C2

  • startitit2-23969.portmap.host:1604

Mutex

  • b9584a316aeb9ca9b31edd4db18381f5

Attributes
  • reg_key

    b9584a316aeb9ca9b31edd4db18381f5

  • splitter

    Y262SUCZ4UJJ

Extracted

Family

  • remcos

Version

  • 1.7 Pro

Botnet

  • Host

C2

  • nickman12-46565.portmap.io:46565

  • nickman12-46565.portmap.io:1735

Attributes
  • audio_folder

    audio

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    5

  • copy_file

    Userdata.exe

  • copy_folder

    Userdata

  • delete_file

    true

  • hide_file

    true

  • hide_keylog_file

    true

  • install_flag

    true

  • install_path

    %WinDir%\System32

  • keylog_crypt

    true

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %WinDir%\System32

  • mouse_option

    false

  • mutex

    remcos_vcexssuhap

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screens

  • screenshot_path

    %AppData%

  • screenshot_time

    1

  • startup_value

    remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Extracted

Family

  • revengerat

Botnet

  • Guest

C2

  • 0.tcp.ngrok.io:19521

Mutex

  • RV_MUTEX

Targets

    • Target
      The-MALWARE-Repo-master.zip
    • Size 198.8MB
    • SHA256 b7dd3bce3ebfbc2d5e3a9f00d47f27cb6a5895c4618c878e314e573a7c216df1
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    defense_evasiondiscoverypersistenceprivilege_escalation

    • Modifies file permissions

      discovery

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1

MITRE ATT&CK Enterprise v16

Tasks