General
- Target Virus-Database-Reupload-main.zip
- Size 128.7MB
- Sample260606-slphfshy7p
- SHA256 7f391ba28ef7e543bd9c78680f6be819d648e4a1ab4d8d3a0b148342756229ce
Score
10/10
Malware Config
Extracted
Family
-
darkcomet
Botnet
-
Guest1111
C2
-
193.242.166.48:1605
Mutex
-
DC_MUTEX-2QRLPN3
Attributes
-
InstallPath
Windupdt\winupdate.exe
-
gencode
Rb5l52XcV9no
-
install
true
-
offline_keylogger
false
-
password
313131
-
persistence
true
-
reg_key
winupdater
rc4.plain
Extracted
Family
-
njrat
Version
-
0.7d
Botnet
-
Geforce
C2
-
startitit2-23969.portmap.host:1604
Mutex
-
b9584a316aeb9ca9b31edd4db18381f5
Attributes
-
reg_key
b9584a316aeb9ca9b31edd4db18381f5
-
splitter
Y262SUCZ4UJJ
Extracted
Family
-
remcos
Version
-
1.7 Pro
Botnet
-
Host
C2
-
nickman12-46565.portmap.io:46565
-
nickman12-46565.portmap.io:1735
Attributes
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
Userdata.exe
-
copy_folder
Userdata
-
delete_file
true
-
hide_file
true
-
hide_keylog_file
true
-
install_flag
true
-
install_path
%WinDir%\System32
-
keylog_crypt
true
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%WinDir%\System32
-
mouse_option
false
-
mutex
remcos_vcexssuhap
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screens
-
screenshot_path
%AppData%
-
screenshot_time
1
-
startup_value
remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Extracted
Family
-
revengerat
Botnet
-
Guest
C2
-
0.tcp.ngrok.io:19521
Mutex
-
RV_MUTEX
Targets
-
- Target Virus-Database-Reupload-main.zip
- Size 128.7MB
- SHA256 7f391ba28ef7e543bd9c78680f6be819d648e4a1ab4d8d3a0b148342756229ce
Score10/10-
Detects HiddenTear Ransomware
-
Family: HiddenTear, Cryptear
HiddenTear aka Cryptear is an open-source ransomware available on Github since 2015, with many versions in the wild.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.