01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b

General
Target

01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b

Size

722KB

Sample

210826-r3j56qpnjj

Score
10 /10
MD5

55c13e0408310276dcb7a5356262a987

SHA1

d7d15e0d6298572a83a26ee67bf5488b93cabb05

SHA256

01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b

SHA512

52ac50b3c74d827dce52d44b2f47fbf24a4f5b9eedb32bb5e1126acf49cfb5bc4946cb4259b868d22b934524b0e84553a8df5b688acee1e750180e014fee27b1

Malware Config

Extracted

Path C:\_readme.txt
Family djvu
Ransom Note
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-ykQaS2tRyB Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: manager@mailtemp.ch Reserve e-mail address to contact us: managerhelper@airmail.cc Your personal ID: 0328gDrgoC4j04vLx6lqyFlyzpTC55w9igCGDgaBYLhUjv3Rr
Emails

manager@mailtemp.ch

managerhelper@airmail.cc

URLs

https://we.tl/t-ykQaS2tRyB

Extracted

Family vidar
Version 40.1
Botnet 517
C2

https://eduarroma.tumblr.com/

Attributes
profile_id
517
Targets
Target

01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b

MD5

55c13e0408310276dcb7a5356262a987

Filesize

722KB

Score
10 /10
SHA1

d7d15e0d6298572a83a26ee67bf5488b93cabb05

SHA256

01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b

SHA512

52ac50b3c74d827dce52d44b2f47fbf24a4f5b9eedb32bb5e1126acf49cfb5bc4946cb4259b868d22b934524b0e84553a8df5b688acee1e750180e014fee27b1

Tags

Signatures

  • Detected Djvu ransomeware

  • Djvu Ransomware

    Description

    Ransomware which is a variant of the STOP family.

    Tags

  • Vidar

    Description

    Vidar is an infostealer based on Arkei stealer.

    Tags

  • Vidar Stealer

    Tags

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Modifies extensions of user files

    Description

    Ransomware generally changes the extension on encrypted files.

    Tags

  • Loads dropped DLL

  • Modifies file permissions

    Tags

    TTPs

    File Permissions Modification
  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    Tags

    TTPs

    Data from Local System Credentials in Files
  • Accesses 2FA software files, possible credential harvesting

    Tags

    TTPs

    Data from Local System Credentials in Files
  • Accesses cryptocurrency files/wallets, possible credential harvesting

    Tags

    TTPs

    Data from Local System Credentials in Files
  • Adds Run key to start application

    Tags

    TTPs

    Registry Run Keys / Startup Folder Modify Registry
  • Checks installed software on the system

    Description

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    Tags

    TTPs

    Query Registry
  • Looks up external IP address via web service

    Description

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

Related Tasks

MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Execution
      Exfiltration
        Impact
          Initial Access
            Lateral Movement
              Privilege Escalation