91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49

General
Target

91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49

Size

721KB

Sample

210826-e8sr1erfbn

Score
10 /10
MD5

92baa6d072d591b827950b6bc4730057

SHA1

17e968a7d200a75fcec9b6967bd635d8633405d9

SHA256

91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49

SHA512

21cd5c7c535b333c6e7297f0edb1d03cad96c24114d3318b6943c0af57c81e2486c6056103617222c3c7650ce666945c7fb4080947ae4946219acf229cd3f0da

Malware Config

Extracted

Path C:\_readme.txt
Family djvu
Ransom Note
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-ykQaS2tRyB Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: manager@mailtemp.ch Reserve e-mail address to contact us: managerhelper@airmail.cc Your personal ID: 0328gDrgoC4j04vLx6lqyFlyzpTC55w9igCGDgaBYLhUjv3Rr
Emails

manager@mailtemp.ch

managerhelper@airmail.cc

URLs

https://we.tl/t-ykQaS2tRyB

Extracted

Family vidar
Version 40.1
Botnet 517
C2

https://eduarroma.tumblr.com/

Attributes
profile_id
517
Targets
Target

91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49

MD5

92baa6d072d591b827950b6bc4730057

Filesize

721KB

Score
10 /10
SHA1

17e968a7d200a75fcec9b6967bd635d8633405d9

SHA256

91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49

SHA512

21cd5c7c535b333c6e7297f0edb1d03cad96c24114d3318b6943c0af57c81e2486c6056103617222c3c7650ce666945c7fb4080947ae4946219acf229cd3f0da

Tags

Signatures

  • Detected Djvu ransomeware

  • Djvu Ransomware

    Description

    Ransomware which is a variant of the STOP family.

    Tags

  • Vidar

    Description

    Vidar is an infostealer based on Arkei stealer.

    Tags

  • Vidar Stealer

    Tags

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Modifies extensions of user files

    Description

    Ransomware generally changes the extension on encrypted files.

    Tags

  • Loads dropped DLL

  • Modifies file permissions

    Tags

    TTPs

    File Permissions Modification
  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    Tags

    TTPs

    Data from Local System Credentials in Files
  • Accesses 2FA software files, possible credential harvesting

    Tags

    TTPs

    Data from Local System Credentials in Files
  • Accesses cryptocurrency files/wallets, possible credential harvesting

    Tags

    TTPs

    Data from Local System Credentials in Files
  • Adds Run key to start application

    Tags

    TTPs

    Registry Run Keys / Startup Folder Modify Registry
  • Checks installed software on the system

    Description

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    Tags

    TTPs

    Query Registry
  • Looks up external IP address via web service

    Description

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

Related Tasks

MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Execution
      Exfiltration
        Impact
          Initial Access
            Lateral Movement
              Privilege Escalation