2020-02-05-netwalker-config.vk.raw

h/t @malwrhunterteam

Config:

{"mpk":"EXgCIpycIJzspm07Loi9L5uOcxC+VZ/NjxWfOn7UqVE=","mode":0,"thr":1500,"spsz":16384,"namesz":6,"idsz":5, "crmask":".mailto[{mail1}].{id}","mail":["REDACTED@cock.li","REDACTED@tutanota.com"],"lfile":"{ID}-Readme.txt","lend":"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9","white":{"path":["*system volume information","*windows.old","*:\\users\\*\\*temp","*msocache","*:\\winnt",        "*$windows.~ws","*perflogs","*boot","*:\\windows",        "*:\\program file*\\vmware","\\\\*\\users\\*\\*temp",        "\\\\*\\winnt","\\\\*\\windows","*\\program file*\\vmware", 	"*appdata*microsoft",	"*appdata*packages",	"*microsoft\\provisioning",	"*dvd maker", "*Internet Explorer", "*Mozilla", "*Mozilla*", "*Old Firefox data",	"*\\program file*\\windows media*","*\\program file*\\windows portable*",	"*windows defender","*\\program file*\\windows nt",	"*\\program file*\\windows photo*","*\\program file*\\windows side*",	"*\\program file*\\windowspowershell",	"*\\program file*\\cuass*", 	"*\\program file*\\microsoft games", "*\\program file*\\common files\\system","*\\program file*\\common files\\*shared",	"*\\program file*\\common files\\reference ass*","*\\windows\\cache*","*temporary internet*", "*media player",	"*:\\users\\*\\appdata\\*\\microsoft",	"\\\\*\\users\\*\\appdata\\*\\microsoft"],"file":["ntuser.dat*","iconcache.db","gdipfont*.dat","ntuser.ini","usrclass.dat", "usrclass.dat*", "boot.ini","bootmgr","bootnxt","desktop.ini","ntuser.dat","autorun.inf","ntldr","thumbs.db","bootsect.bak","bootfont.bin"],"ext":["msp","exe","sys","msc","mod","clb","mui","regtrans-ms", "theme","hta","shs","nomedia","diagpkg","cab","ics","msstyles","cur","drv","icns","diagcfg","dll","ocx","lnk","ico","idx","ps1","mpa","cpl","icl","msu","msi","nls","scr","adv","386","com","hlp","rom","lock","386","wpx","ani","prf","rtp","ldf","key","diagcab","cmd","spl","deskthemepack","bat","themepack"]}"kill":{"use":true,"task":["reboot","restart","shutdown","logoff","back"]}"net":{"use":true, "ignore": {  "use":true,  "disk":true,  "share":["ipc$","admin$"] }}"unlocker":{"use":true,  "ignore": {  "use":true,  "pspath":["*:\\windows*","*:\\winnt*","*:\\program file*\\vmwar*"],  "prc":["psexec.exe","system"]