Extracted

• • Target
    2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2
  • Size 749KB
  • SHA256 2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2
  • MD5 faf21f1f42846fc2bff2db7946354c8c
  • SHA1 c2c7a38cb28ab175ac3726bc65e5bf2820990168
  • SHA512 4e5ec876c441029769e707ac40087a3815cdaa6becbafbe76a07d758426a1567d95462450b7bd0c0361adf2be5883d4e6b3495bbae45520e01dcd4318ae11ca5
  • MD5 SHA1 SHA512

  Score

  10^/10

  djvuvidar517discoverypersistenceransomwarestealersuricata

  • Detected Djvu ransomware

  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request

    suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request

    suricata

  • Vidar Stealer

    stealer

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2