Resubmissions
06/09/2026, 10:43
260906-msd3eashke01/09/2026, 13:41
260901-qzhwqazepg01/09/2026, 12:58
260901-p7y28szbqc1018/08/2026, 20:05
260818-yt533azcke1016/08/2026, 10:12
260816-l8ylbahj9t15/08/2026, 21:01
260815-ztx8wstdla15/08/2026, 20:42
260815-zhhdastyfv14/08/2026, 18:02
260814-wmq98afk9109/08/2026, 10:50
260809-mxkqrazta109/08/2026, 02:48
260809-damr6agd86General
- Target Supernova.zip
- Size 504.7MB
- Sample260808-vszm4see89
- SHA256 75911dc6fa5d482feb87fb96a1e2733395312459aa9096e2e78f54bb1090a7f4
Malware Config
Extracted
-
quasar
-
1.4.1
-
Office04
-
psp.jpn.com:4782
-
166bet.com.br:4782
-
goto.psp.jpn.com:4782
-
goto.166bet.com.br:4782
-
www.psp.jpn.com:4782
-
www.166bet.com.br:4782
-
6b272a31-8137-4076-b27d-9b0563ddf269
-
encryption_key
9D3C28E509C420315CFD1EE672665AE9DB4E9483
-
install_name
android.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
Android Studio
Extracted
-
nanocore
-
1.2.2.0
-
homevpn.anondns.net:14035
-
3d89217c-ec6f-4091-8c2a-47bee258415d
-
activate_away_mode
true
-
backup_connection_host
homevpn.anondns.net
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2025-08-09T23:21:58.635125336Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
14035
-
default_group
NEW
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
3d89217c-ec6f-4091-8c2a-47bee258415d
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
homevpn.anondns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Extracted
-
azorult
-
http://dnlgu.ru/1210776429.php
Extracted
-
phorphiex
-
http://178.16.54.109
Extracted
-
divulge
-
v2.0
-
https://discord.com/api/webhooks/1312882330339119204/DThrH97xNlw4juI_9g0e0fzDhrtHNdex_r-KkDBSRTms8TsaDB_AZHbN51MWJHNb9obG
-
sW7ROjkdVeQ0ALYye0hE
Extracted
-
stealc
-
default
-
http://198.251.89.171
-
url_path
/7fca4b626244404d.php
Extracted
-
mirai
-
LZRD
-
144.31.215.26
Extracted
-
runningrat
Extracted
-
kalim
-
moodleuni.com
Extracted
-
njrat
-
0.7d
-
ЛОХ
-
hakim32.ddns.net:2000
-
ZertSqaure-39469.portmap.host:39469
-
c8f3405c40ef239e221c95e4f96a0e54
-
reg_key
c8f3405c40ef239e221c95e4f96a0e54
-
splitter
|'|'|
Extracted
-
warmcookie
-
38.180.91.117
-
mutex
2dd4aba1-4d43-44ee-9b3f-9f64ff2e468d
-
user_agent
Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0
Extracted
-
pony
-
http://file.filecrate.ru/bussin/gate.php
Extracted
-
sodinokibi
-
$2a$10$PRliCdjvILpWha0dXt26COEfG3S.LFJG/H9fqsY0uepzhaO43cC36
-
3665
-
1kbk.com.ua
-
kalkulator-oszczednosci.pl
-
creative-waves.co.uk
-
mirkoreisser.de
-
fotoideaymedia.es
-
abogados-en-alicante.es
-
liikelataamo.fi
-
klusbeter.nl
-
jameskibbie.com
-
marathonerpaolo.com
-
milestoneshows.com
-
live-con-arte.de
-
tinyagency.com
-
beautychance.se
-
slwgs.org
-
midmohandyman.com
-
herbayupro.com
-
panelsandwichmadrid.es
-
baronloan.org
-
izzi360.com
-
net
false
-
pid
$2a$10$PRliCdjvILpWha0dXt26COEfG3S.LFJG/H9fqsY0uepzhaO43cC36
-
prc
visio
CagService
VeeamTransportSvc
dbsnmp
msaccess
bedbh
DellSystemDetect
encsvc
VeeamDeploymentSvc
steam
mydesktopqos
sqbcoreservice
dbeng50
mydesktopservice
firefox
outlook
tbirdconfig
raw_agent_svc
ocomm
pvlsvr
isqlplussvc
sql
ocautoupds
thunderbird
excel
synctime
EnterpriseClient
wordpad
bengien
vsnapvss
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome Massive Prints. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
3665
-
svc
MSSQL
VeeamTransportSvc
CAARCUpdateSvc
AcrSch2Svc
bedbg
stc_raw_agent
sophos
BackupExecDiveciMediaService
BackupExecVSSProvider
VeeamNFSSvc
CASAD2DWebSvc
BackupExecAgentAccelerator
veeam
vss
MSSQL$
MSExchange
sql
PDVFSService
VSNAPVSS
MVarmor64
AcronisAgent
ARSM
BackupExecRPCService
VeeamDeploymentService
svc$
BackupExecAgentBrowser
MVArmor
MSExchange$
BackupExecJobEngine
mepocs
Extracted
-
blihanstealer
-
pomdfghrt
-
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; CIBA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
Extracted
-
chromeb
-
iloveboats9.vip
Extracted
-
rustonotto
-
http://hnkoaa.co.kr/files/2023/12/01/win.php?U=
Extracted
-
amadey
-
5.73
-
9c4517
-
http://158.94.208.6
-
strings_key
52133829e72800688538466b68b5276c
-
url_paths
/h8jfdmdWS/index.php
Extracted
-
sakula
-
www.polarroute.com
Extracted
-
gravityrat
-
https://ent34ndx3cz8k.x.pipedream.net
-
.b17da333ec194ec4b767.d.requestbin.net
Extracted
-
asyncrat
-
1.0.7
-
OddsEvaluation
-
nmr.uk.com:443
-
nmr.uk.com:80
-
nmr.uk.com:8080
-
nmr.uk.com:4782
-
nmr.uk.com:1604
-
nmr.uk.com:1337
-
www.nmr.uk.com:443
-
www.nmr.uk.com:80
-
www.nmr.uk.com:8080
-
www.nmr.uk.com:4782
-
www.nmr.uk.com:1604
-
www.nmr.uk.com:1337
-
VantaOddsEngine_Main_H6AK
-
delay
1
-
install
true
-
install_file
VantaOddsEngine.exe
-
install_folder
%AppData%
Extracted
-
vanillarat
-
f8bet.gr.com:1604
-
client_tag
RAT
-
install
False
-
startup
False
-
update_interval
1
Extracted
-
xred
-
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Extracted
-
orcus
-
6.tcp.ngrok.io:18058
-
1f5ae39956b94bedb3897736c07cbd71
-
autostart_method
Disable
-
enable_keylogger
false
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Extracted
-
darkvision
-
45.153.240.147
Extracted
-
vertexnet
-
www.ljliun.za.com
-
DC_kjdsHsKS_
-
C2Path
/user10/
Extracted
-
discordrat
-
discord_token
MTQyNTYzNjA0NjYwMzAzMDUzMA.GuQt9L.zDQXFQKrxpBryZTK1_0Oc_5Q1QSZ0_jZa2TVx8
-
server_id
1425629411721609269
Extracted
-
redline
-
Bartho
-
45.67.35.151:20686
-
auth_value
a33b211fae3d9b87a1d711957edd752e
Extracted
-
asyncrat
-
0.5.7B
-
WinX
-
severdops.ddns.net:6204
-
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Extracted
-
vidar
-
17.8
-
0c21a99a3efb554917252ac08ba93fa5
-
https://telegram.me/ho00rq
-
https://steamcommunity.com/profiles/76561198742173262
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0
Targets
-
- Target Supernova/36b43e8350bc4890bbba8c1be515fd4e7468ef932dd1c73b3244575f1197075a.exe
- Size 48KB
- SHA256 36b43e8350bc4890bbba8c1be515fd4e7468ef932dd1c73b3244575f1197075a
Score10/10-
Family: Warmcookie, Badspace
Warmcookie aka Badspace is a backdoor written in C++.
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
- Target Supernova/3ab0c58f330345f3dae67a4f68a4b1b4e4b8ae975aa82d90f9b013200ed4f8b0.exe
- Size 103KB
- SHA256 3ab0c58f330345f3dae67a4f68a4b1b4e4b8ae975aa82d90f9b013200ed4f8b0
Score10/10-
Family: Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
- Target Supernova/3b7071def29490065f3235971fe3c7d474b2aafc96c47a65ced7f61417ecad1a.exe
- Size 1.8MB
- SHA256 3b7071def29490065f3235971fe3c7d474b2aafc96c47a65ced7f61417ecad1a
Score10/10-
Family: BlackGuard
Infostealer first seen in Late 2021.
-
- Target Supernova/3b89d829a950792bd9c07a149542bdab88594d124e3bda9f3ce6a52dc82528f9.exe
- Size 1016KB
- SHA256 3b89d829a950792bd9c07a149542bdab88594d124e3bda9f3ce6a52dc82528f9
Score10/10-
Detect Pykspa worm
-
Family: Pykspa
Pykspa is a worm spreads via Skype uses DGA and it's written in C++.
-
Modifies WinLogon for persistence
-
UAC bypass
-
Adds policy Run key to start application
-
Disables RegEdit via registry modification
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Impair Defenses: Safe Mode Boot
-
Adds Run key to start application
-
Checks whether UAC is enabled
-
Hijack Execution Flow: Executable Installer File Permissions Weakness
Possible Turn off User Account Control's privilege elevation for standard users.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory
-
- Target Supernova/3c26f16c4a0648d5ac113ec9a6cff38f.exe
- Size 3.2MB
- SHA256 52283bc3765b3e82a894786f9475cb5b520fcc2cac1826e50cf81c38a091ccfd
Score1/10 -
- Target Supernova/3e6f7f9456ae9906e40da831c58f9b78a2eee8af2682cac7a9abf1a854142aa0.exe
- Size 2.3MB
- SHA256 3e6f7f9456ae9906e40da831c58f9b78a2eee8af2682cac7a9abf1a854142aa0
Score10/10-
Family: RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Suspicious use of SetThreadContext
-
- Target Supernova/40132c04a7534bc0a1cfc605426fe5e409f64565712e3c972c1381d8639748b4.exe
- Size 417KB
- SHA256 40132c04a7534bc0a1cfc605426fe5e409f64565712e3c972c1381d8639748b4
Score10/10-
Family: Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target Supernova/414f883bbf5322758c422296faf07253a606900b93400e4e840d18ff90e38afc.exe
- Size 622KB
- SHA256 414f883bbf5322758c422296faf07253a606900b93400e4e840d18ff90e38afc
Score10/10-
Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Suspicious use of SetThreadContext
-
- Target Supernova/464622890dea3c326440b7d1f6da9f63dd2dfd98678965aa220ed62773a2cc70.exe
- Size 124KB
- SHA256 464622890dea3c326440b7d1f6da9f63dd2dfd98678965aa220ed62773a2cc70
Score3/10 -
- Target Supernova/4e63ad7ed49f94572e409e6764c8d1ca4f2253643f527fd2f03deab7fae691ac.exe
- Size 8.1MB
- SHA256 4e63ad7ed49f94572e409e6764c8d1ca4f2253643f527fd2f03deab7fae691ac
Score10/10-
Detects Vidar Stealer
-
Family: Vidar
Vidar is an infostealer based on Arkei stealer.
-
- Target Supernova/511b83e1fade46c48f65f19884df989a.exe
- Size 433KB
- SHA256 d946822e4b91d8c57cf4c85ddac0c59e7138b535ce71e5d1835897363879a78c
Score1/10 -
- Target Supernova/51a45c14f656447da2b50869ea6604e3.exe
- Size 3.0MB
- SHA256 364c2de5478ba2b1e93872cdde5f5f098666edd1288bb0034107e31fd45b0d93
Score1/10 -
- Target Supernova/5bf2b0d4b1ac39e443bfedb8785fc5963e85c8f80fce2a91f7d236000a47c98b.exe
- Size 364KB
- SHA256 5bf2b0d4b1ac39e443bfedb8785fc5963e85c8f80fce2a91f7d236000a47c98b
Score10/10-
Detects PandaZeuS
-
Family: PandaZeuS
PandaZeuS is a banking trojan that utilizes the ATS to automate actions within online banking portals.
-
Executes dropped EXE
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
- Target Supernova/5bfce4f39b38e9335c8f861cc605edd5ada8f98293ffce624408395345bd575f.js
- Size 3.9MB
- SHA256 5bfce4f39b38e9335c8f861cc605edd5ada8f98293ffce624408395345bd575f
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
- Target Supernova/5cdd47383ca7b3b3db0c20e69b9e99c316df2a08e8c56f6db30e464874e3aafc.exe
- Size 124KB
- SHA256 5cdd47383ca7b3b3db0c20e69b9e99c316df2a08e8c56f6db30e464874e3aafc
Score10/10-
Family: BlihanStealer
Blihan is a stealer written in C++.
-
Deletes itself
-
Executes dropped EXE
-
Adds Run key to start application
-
- Target Supernova/5d8920257c318caee990816b951125fc8d641e3b7ec762b95fec4431e37a9386.exe
- Size 8.4MB
- SHA256 5d8920257c318caee990816b951125fc8d641e3b7ec762b95fec4431e37a9386
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Reads WinSCP keys stored on the system
Tries to access WinSCP stored sessions.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Themida packer
Detects Themida, an advanced Windows software protection system.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4JavaScript
1PowerShell
2Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
3Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
3Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Impair Defenses
2Disable or Modify Tools
1Safe Mode Boot
1Modify Registry
5Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
5Credentials In Files
4Credentials in Registry
1