Overview

overview

10

Static

static

10

Supernova.zip

windows10-2004-x64

1

Supernova.zip

windows11-ltsc_2024-x64

1

Resubmissions

23/09/2026, 17:04

260923-vledlayx6m

06/09/2026, 10:43

260906-msd3eashke

01/09/2026, 13:41

260901-qzhwqazepg

01/09/2026, 12:58

260901-p7y28szbqc10

18/08/2026, 20:05

260818-yt533azcke10

16/08/2026, 10:12

260816-l8ylbahj9t

15/08/2026, 21:01

260815-ztx8wstdla

15/08/2026, 20:42

260815-zhhdastyfv

14/08/2026, 18:02

260814-wmq98afk91

09/08/2026, 10:50

260809-mxkqrazta1

Sharing

Copy URL Twitter E-mail

General

  • Target
    Supernova.zip
  • Size 504.7MB
  • Sample260628-km4prsgv3q
  • SHA256 75911dc6fa5d482feb87fb96a1e2733395312459aa9096e2e78f54bb1090a7f4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
amadeyasyncratazorultblackguardblankgrabberblihanstealerchromebchromelevatorcosmudarkvisiondiscordratdivulgedorkbotfesbergafgytgravityrathellokittyiris_stealerkalimkpotlittledaemonlockbitmakopmimikatzmirainanocoreneshtanetwirenightspirenjratoctalyn_stealeroctoratorcuspetyaphorphiexponyquasarredlinerunningratrustonottosakulashodisodinokibistealcsvcstealertonnerrevanillaratvertexnetwarmcookiewraithnetxredzetaratzloader$2a$10$prlicdjvilpwha0dxt26coefg3s.lfjg/h9fqsy0uepzhao43cc369c4517defaultlzrdoddsevaluationoffice04лох3665apt37muddywaterprinceofpersiaaptbackdoorbotnetcosturadownloaderhacktoolinfostealerinstallerkeyloggerloaderpackerpersistencepyinstallerransomwareratrevoked_codesignrootkitspywarestealerthemidatrojanupxworm

Malware Config

Extracted

Family

  • quasar

Version

  • 1.4.1

Botnet

  • Office04

C2

  • psp.jpn.com:4782

  • 166bet.com.br:4782

  • goto.psp.jpn.com:4782

  • goto.166bet.com.br:4782

  • www.psp.jpn.com:4782

  • www.166bet.com.br:4782

Mutex

  • 6b272a31-8137-4076-b27d-9b0563ddf269

Attributes
  • encryption_key

    9D3C28E509C420315CFD1EE672665AE9DB4E9483

  • install_name

    android.exe

  • key_salt

    bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    Android Studio

Extracted

Family

  • nanocore

Version

  • 1.2.2.0

C2

  • homevpn.anondns.net:14035

Mutex

  • 3d89217c-ec6f-4091-8c2a-47bee258415d

Attributes
  • activate_away_mode

    true

  • backup_connection_host

    homevpn.anondns.net

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2025-08-09T23:21:58.635125336Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    true

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    14035

  • default_group

    NEW

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    3d89217c-ec6f-4091-8c2a-47bee258415d

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    homevpn.anondns.net

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    true

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Extracted

Family

  • azorult

C2

  • http://dnlgu.ru/1210776429.php

Extracted

Family

  • phorphiex

C2

  • http://178.16.54.109

Extracted

Family

  • divulge

Version

  • v2.0

C2

  • https://discord.com/api/webhooks/1312882330339119204/DThrH97xNlw4juI_9g0e0fzDhrtHNdex_r-KkDBSRTms8TsaDB_AZHbN51MWJHNb9obG

Mutex

  • sW7ROjkdVeQ0ALYye0hE

Extracted

Family

  • stealc

Botnet

  • default

C2

  • http://198.251.89.171

Attributes
  • url_path

    /7fca4b626244404d.php

rc4.traffic_key
rc4.C2

Extracted

Family

  • mirai

Botnet

  • LZRD

Extracted

Family

  • runningrat

Extracted

Family

  • kalim

C2

  • moodleuni.com

Extracted

Family

  • njrat

Version

  • 0.7d

Botnet

  • ЛОХ

C2

  • hakim32.ddns.net:2000

  • ZertSqaure-39469.portmap.host:39469

Mutex

  • c8f3405c40ef239e221c95e4f96a0e54

Attributes
  • reg_key

    c8f3405c40ef239e221c95e4f96a0e54

  • splitter

    |'|'|

Extracted

Family

  • warmcookie

C2

  • 38.180.91.117

Attributes
  • mutex

    2dd4aba1-4d43-44ee-9b3f-9f64ff2e468d

  • user_agent

    Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0

Extracted

Family

  • pony

C2

  • http://file.filecrate.ru/bussin/gate.php

Extracted

Family

  • sodinokibi

Botnet

  • $2a$10$PRliCdjvILpWha0dXt26COEfG3S.LFJG/H9fqsY0uepzhaO43cC36

Campaign

  • 3665

Decoy

  • 1kbk.com.ua

  • kalkulator-oszczednosci.pl

  • creative-waves.co.uk

  • mirkoreisser.de

  • fotoideaymedia.es

  • abogados-en-alicante.es

  • liikelataamo.fi

  • klusbeter.nl

  • jameskibbie.com

  • marathonerpaolo.com

  • milestoneshows.com

  • live-con-arte.de

  • tinyagency.com

  • beautychance.se

  • slwgs.org

  • midmohandyman.com

  • herbayupro.com

  • panelsandwichmadrid.es

  • baronloan.org

  • izzi360.com

Attributes
  • net

    false

  • pid

    $2a$10$PRliCdjvILpWha0dXt26COEfG3S.LFJG/H9fqsY0uepzhaO43cC36

  • prc

    visio

    CagService

    VeeamTransportSvc

    dbsnmp

    msaccess

    bedbh

    DellSystemDetect

    encsvc

    VeeamDeploymentSvc

    steam

    mydesktopqos

    sqbcoreservice

    dbeng50

    mydesktopservice

    firefox

    outlook

    tbirdconfig

    raw_agent_svc

    ocomm

    pvlsvr

    isqlplussvc

    sql

    ocautoupds

    thunderbird

    excel

    synctime

    EnterpriseClient

    wordpad

    bengien

    vsnapvss

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome Massive Prints. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    3665

  • svc

    MSSQL

    VeeamTransportSvc

    CAARCUpdateSvc

    AcrSch2Svc

    bedbg

    stc_raw_agent

    sophos

    BackupExecDiveciMediaService

    BackupExecVSSProvider

    VeeamNFSSvc

    CASAD2DWebSvc

    BackupExecAgentAccelerator

    veeam

    vss

    MSSQL$

    MSExchange

    sql

    PDVFSService

    VSNAPVSS

    MVarmor64

    AcronisAgent

    ARSM

    BackupExecRPCService

    VeeamDeploymentService

    svc$

    BackupExecAgentBrowser

    MVArmor

    MSExchange$

    BackupExecJobEngine

    mepocs

Extracted

Family

  • blihanstealer

Mutex

  • pomdfghrt

Attributes
  • user_agent

    Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; CIBA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Extracted

Family

  • chromeb

C2

  • iloveboats9.vip

Extracted

Family

  • rustonotto

C2

  • http://hnkoaa.co.kr/files/2023/12/01/win.php?U=

Extracted

Family

  • amadey

Version

  • 5.73

Botnet

  • 9c4517

C2

  • http://158.94.208.6

Attributes
  • strings_key

    52133829e72800688538466b68b5276c

  • url_paths

    /h8jfdmdWS/index.php

rc4.hex

Extracted

Family

  • sakula

C2

  • www.polarroute.com

Extracted

Family

  • gravityrat

C2

  • https://ent34ndx3cz8k.x.pipedream.net

  • .b17da333ec194ec4b767.d.requestbin.net

Extracted

Family

  • asyncrat

Version

  • 1.0.7

Botnet

  • OddsEvaluation

C2

  • nmr.uk.com:443

  • nmr.uk.com:80

  • nmr.uk.com:8080

  • nmr.uk.com:4782

  • nmr.uk.com:1604

  • nmr.uk.com:1337

  • www.nmr.uk.com:443

  • www.nmr.uk.com:80

  • www.nmr.uk.com:8080

  • www.nmr.uk.com:4782

  • www.nmr.uk.com:1604

  • www.nmr.uk.com:1337

Mutex

  • VantaOddsEngine_Main_H6AK

Attributes
  • delay

    1

  • install

    true

  • install_file

    VantaOddsEngine.exe

  • install_folder

    %AppData%

aes.plain

Extracted

Family

  • vanillarat

C2

  • f8bet.gr.com:1604

Attributes
  • client_tag

    RAT

  • install

    False

  • startup

    False

  • update_interval

    1

Extracted

Family

  • xred

C2

  • xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Extracted

Family

  • orcus

C2

  • 6.tcp.ngrok.io:18058

Mutex

  • 1f5ae39956b94bedb3897736c07cbd71

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    false

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Extracted

Family

  • darkvision

C2

  • 45.153.240.147

Extracted

Family

  • vertexnet

C2

  • www.ljliun.za.com

Mutex

  • DC_kjdsHsKS_

Attributes
  • C2Path

    /user10/

Extracted

Family

  • discordrat

Attributes
  • discord_token

    MTQyNTYzNjA0NjYwMzAzMDUzMA.GuQt9L.zDQXFQKrxpBryZTK1_0Oc_5Q1QSZ0_jZa2TVx8

  • server_id

    1425629411721609269

Targets

    • Target
      Supernova.zip
    • Size 504.7MB
    • SHA256 75911dc6fa5d482feb87fb96a1e2733395312459aa9096e2e78f54bb1090a7f4
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks

static1

revoked_codesignoffice04upxthemidadefaultransomwarelzrdinstallerratmuddywaterлохbackdoorcosturapacker$2a$10$prlicdjvilpwha0dxt26coefg3s.lfjg/h9fqsy0uepzhao43cc363665aptapt37pyinstaller9c4517oddsevaluationprinceofpersiastealerchromebhacktoolchromelevatorasyncrathellokittydarkvisiontrojanspywarequasarwormloaderphorphiexoctoratblackguardmakopshodirootkitpersistencediscordratbotnetzloaderdorkbotkpotdownloaderlittledaemoninfostealerredlinestealcpetyamiraiblankgrabberiris_stealerxredkeyloggernanocoreazorultkalimsodinokibisvcstealerblihanstealeroctalyn_stealerrustonottozetaratcosmugafgytorcusnightspirelockbitamadeywraithnettonnerrenetwirevertexnetdivulgerunningratponysakulagravityratfesbervanillaratneshtamimikatznjratwarmcookie
Score
10/10

behavioral1

Score
1/10

behavioral2

Score
1/10