Extracted

• • Target
    4c56095dc5818d4ab935ca0af8270be2.exe
  • Size 842KB
  • SHA256 797b65020bbfa1c58f0d72c7d0ee746fcf28acbaeaad7c5877ff9c53a8bf1cf4
  • MD5 4c56095dc5818d4ab935ca0af8270be2
  • SHA1 f0d271daa2d2243b44e51af24d65fdfc65255ddc
  • SHA512 d9eb8e469114bfa19eb5f5793c49f67517eb43f5731ed781826814f802892b5f7af9c776b573e6d8b0ff6a7783133a61ec5e59abcf855b1acad630eab3db7698
  • MD5 SHA1 SHA512

  Score

  10^/10

  djvuvidar517discoveryevasionpersistenceransomwarespywarestealer

  • Deletes Windows Defender Definitions

    Uses mpcmdrun utility to delete all AV definitions.

    evasion

  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar Stealer

    stealer

  • Disables Task Manager via registry modification

    evasion

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2