djvu | 13eaec1adb4c48e91244e39e61fc77e1e287c4243ad45bffb2a9cb90a5d9f2a4

General

Target

13eaec1adb4c48e91244e39e61fc77e1e287c4243ad45bffb2a9cb90a5d9f2a4
Size

693KB
Sample

210926-pwe5zsehb9
MD5

b649c949cbf60499ea44c441a5a7bd04
SHA1

0852d060e1fb478e2bac3b09ada6169a9abfac92
SHA256

13eaec1adb4c48e91244e39e61fc77e1e287c4243ad45bffb2a9cb90a5d9f2a4
SHA512

b53503961c5cebde86b04f043a67541657d815784e2e5c52b220fcbc125fff387befc798dd5174d5a395bbbb184a87a210611efc5505622008e1fdcafadd31ae

Score

10^/10

Malware Config

Targets

- Target
  
  13eaec1adb4c48e91244e39e61fc77e1e287c4243ad45bffb2a9cb90a5d9f2a4
- Size
  
  693KB
- MD5
  
  b649c949cbf60499ea44c441a5a7bd04
- SHA1
  
  0852d060e1fb478e2bac3b09ada6169a9abfac92
- SHA256
  
  13eaec1adb4c48e91244e39e61fc77e1e287c4243ad45bffb2a9cb90a5d9f2a4
- SHA512
  
  b53503961c5cebde86b04f043a67541657d815784e2e5c52b220fcbc125fff387befc798dd5174d5a395bbbb184a87a210611efc5505622008e1fdcafadd31ae
Score

10^/10

djvu vidar discovery persistence ransomware spyware stealer
- Detected Djvu ransomware
- Djvu Ransomware
  Ransomware which is a variant of the STOP family.
  ransomware djvu
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Vidar Stealer
  stealer
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1