Extracted

• • Target
    24e01f6ef65d42467608a1db86f06cdbeb114ba6b6da744d5133c7d933adaaad
  • Size 790KB
  • SHA256 24e01f6ef65d42467608a1db86f06cdbeb114ba6b6da744d5133c7d933adaaad
  • MD5 7bf350b51060d91b753c82f9dd2105e8
  • SHA1 8f2e2c6b0b3eccea09dd5035282a4615e4278f5c
  • SHA512 807d54e11b7f1bc9299ee38a7c576f464bae36d0b99c074f4071f7d243bcc5464f658618528133683c46305e943b0b6d922715a92180ac6bf2d6c2ab63234772
  • MD5 SHA1 SHA512

  Score

  10^/10

  djvuvidar517discoverypersistenceransomwarestealersuricata

  • Detected Djvu ransomware

  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request

    suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request

    suricata

  • Vidar Stealer

    stealer

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2