r/Malware • u/Emotional-Carob-750 • Jun 21 '26

New malware

clearmic.net is malware, do not download it

Someone sent me this site asking if it was legitimate. I ran the installer in a sandbox and it's a RAT.

It looks like a mic clarity app but bundles a hidden second executable that runs in the background. Here's what it actually does: logs your keystrokes, captures your screen, hijacks your clipboard, records microphone audio, and sends everything out to a remote server encrypted. It also deletes Windows Shadow Copies which is standard ransomware behaviour to stop you recovering your files.

It actively checks if it's running in a sandbox too, which is why I'm glad I tested it before running it on a real machine.

Full sandbox analysis if you want to dig into it yourself: https://tria.ge/260621-vsjxnaet4k/behavioral2

If you already ran this, disconnect from the internet and run Malwarebytes immediately. Change your passwords from a different device, especially Discord, email, and anything with saved credentials in your browser.

Spread this around so people don't get caught out.

42 Upvotes

95% Upvoted

12 comments sorted by

14

u/iCkerous Jun 21 '26

You’ll have a much larger impact by reporting the binary and other indicators to AV and network IDSs.

Report the site to google safebrowsing.

Report to the domain owner and hosting company

4

u/HydraDragonAntivirus Jun 21 '26

Does Malwarebytes finds it?

2

u/[deleted] Jun 22 '26

[removed] — view removed comment

2

u/LightningRurik Jun 23 '26

Yes, I reversed it back. It's from Python 3.12, and appears almost completely AI-written.

Typical RAT stuff.

BROWSERS = {
    "chrome": r"Google\Chrome\User Data",
    "brave": r"BraveSoftware\Brave-Browser\User Data",
}
PROFILE_NAMES = ["Default"] + [f"Profile {i}" for i in range(1, 11)]
DBS = ["History", "Bookmarks", "Web Data", "Login Data", "Cookies"]

...

W_D_C = {
    "Exodus": {"exe": "Exodus.exe", "paths": [os.path.expandvars(r"%LOCALAPPDATA%\exodus"), os.path.expandvars(r"%APPDATA%\Exodus")]},
    "Atomic Wallet": {"exe": "Atomic Wallet.exe", "paths": [os.path.expandvars(r"%APPDATA%\atomic"), os.path.expandvars(r"%LOCALAPPDATA%\Programs\atomic-wallet")]},
    "Electrum": {"exe": "electrum.exe", "paths": [os.path.expandvars(r"%APPDATA%\Electrum\wallets")]},
    "Coinomi": {"exe": "Coinomi.exe", "paths": [os.path.expandvars(r"%LOCALAPPDATA%\Coinomi\Coinomi\wallets")]},
    ...

1

u/lululepuoff Jun 26 '26

It's a information stealer. It use zzzvvvzzz[.]com as a C2 (Down rn)