Overview

overview

10

Static

static

10

Treasure.V...ox.exe

windows10-2004-x64

3

Treasure.V...ox.exe

windows11-21h2-x64

3

Resubmissions

15/08/2026, 21:19

260815-z592tshg57

12/05/2026, 09:30

260512-lghqsah14t

12/05/2026, 09:29

260512-lf4a4ad17m

11/05/2026, 13:07

260511-qcln4aaw4z

09/05/2026, 21:41

260509-1j69gsdv7w10

09/05/2026, 21:41

260509-1jyx4sdv7s

19/04/2026, 22:54

260419-2vxd4aby7r

11/04/2026, 06:46

260411-hjw5eaas2p

25/03/2026, 09:51

260325-lvksascz5w10

22/02/2026, 15:16

260222-snsb5ab16e10

Sharing

Copy URL Twitter E-mail

General

  • Target
    241105-dtxrgatbpg_pw_infected.zip
  • Size 132.7MB
  • Sample260222-snsb5ab16e
  • SHA256 38bc13ef112b2f17d4d1a80243fac6a521b5d58228984aae0752d79487fa3b66
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
cobaltstrikemodiloadernjratrevengeratxredzeppelinzloader07/0409/0425/03305419896hackhackedinsert-coinmainsamaysystemvictimexdsdddyt26.02.2020cryptonediscoveryinstallerpackerstealerupx

Malware Config

Extracted

Family

  • cobaltstrike

Botnet

  • 305419896

C2

  • http://47.91.237.42:8443/__utm.gif

Attributes
  • access_type

    512

  • beacon_type

    2048

  • host

    47.91.237.42,/__utm.gif

  • http_header1

    AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_header2

    AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_method1

    GET

  • http_method2

    POST

  • maxdns

    255

  • polling_time

    60000

  • port_number

    8443

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDS7zRQv7EhhTkbgDrCNBsNay7lzQFmcC/GWwjOq93nKwPSszjIKgtW8nwhtoRhr6MFZx4DSYFdeuJDrtJNcTZz2C/LgZzhSQJmhiEqCkVqPPCfK1C6S4PzDrzy9L794rPLOuoewlGAXgiH5/Ae2aC5k2wedRNfes3DJZDDCaJJYwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /submit.php

  • user_agent

    Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; Trident/4.0)

  • watermark

    305419896

Extracted

Family

  • zloader

Botnet

  • main

Campaign

  • 26.02.2020

C2

  • https://airnaa.org/sound.php

  • https://banog.org/sound.php

  • https://rayonch.org/sound.php

Attributes
  • build_id

    19

rc4.plain

Extracted

Family

  • revengerat

Botnet

  • XDSDDD

C2

  • 84.91.119.105:333

Mutex

  • RV_MUTEX-wtZlNApdygPh

Extracted

Family

  • revengerat

Botnet

  • Victime

C2

  • cocohack.dtdns.net:84

Mutex

  • RV_MUTEX-OKuSAtYBxGgZHx

Extracted

Family

  • zloader

Botnet

  • 25/03

C2

  • https://wgyvjbse.pw/milagrecf.php

  • https://botiq.xyz/milagrecf.php

Attributes
  • build_id

    103

rc4.plain

Extracted

Family

  • revengerat

Botnet

  • samay

C2

  • shnf-47787.portmap.io:47787

Mutex

  • RV_MUTEX

Extracted

Family

  • zloader

Botnet

  • 09/04

C2

  • https://eoieowo.casa/wp-config.php

  • https://dcgljuzrb.pw/wp-config.php

Attributes
  • build_id

    140

rc4.plain

Extracted

Family

  • zloader

Botnet

  • 07/04

C2

  • https://xyajbocpggsr.site/wp-config.php

  • https://ooygvpxrb.pw/wp-config.php

Attributes
  • build_id

    131

rc4.plain

Extracted

Family

  • revengerat

Botnet

  • INSERT-COIN

C2

  • 3.tcp.ngrok.io:24041

Mutex

  • RV_MUTEX

Extracted

Family

  • revengerat

Botnet

  • YT

C2

  • yukselofficial.duckdns.org:5552

Mutex

  • RV_MUTEX-WlgZblRvZwfRtNH

Extracted

Family

  • revengerat

Botnet

  • system

C2

  • yj233.e1.luyouxia.net:20645

Mutex

  • RV_MUTEX-GeVqDyMpzZJHO

Extracted

Family

  • njrat

Version

  • 0.7d

Botnet

  • HacKed

C2

  • srpmx.ddns.net:5552

Mutex

  • c6c84eeabbf10b049aa4efdb90558a88

Attributes
  • reg_key

    c6c84eeabbf10b049aa4efdb90558a88

  • splitter

    |'|'|

Extracted

Family

  • xred

C2

  • xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Extracted

Family

  • njrat

Version

  • 0.7d

Botnet

  • HACK

C2

  • 43.229.151.64:5552

Mutex

  • 6825da1e045502b22d4b02d4028214ab

Attributes
  • reg_key

    6825da1e045502b22d4b02d4028214ab

  • splitter

    Y262SUCZ4UJJ

Targets

    • Target
      Treasure.Vault.3D.Screensaver.keygen.by.Paradox.exe
    • Size 10.5MB
    • SHA256 4a5da8ebf650091c99c7a9d329ecb87533c337ab9e5642ff0355485ed419ec40
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks