djvu | 1b1b0e38d8f3de589e7d0b33d8eea47b9272f0c62ae0d3fd4f015258ab049cbb

General

Target

1b1b0e38d8f3de589e7d0b33d8eea47b9272f0c62ae0d3fd4f015258ab049cbb
Size

804KB
Sample

211021-3kcglsahf7
MD5

7205de53e7bd067205e970e0b744efc1
SHA1

512622a263aa3ebfaec1575fad480e3968877974
SHA256

1b1b0e38d8f3de589e7d0b33d8eea47b9272f0c62ae0d3fd4f015258ab049cbb
SHA512

3562cea220bc9dcf03ee37f9e902fe8e4fa39106731407fae7dc218c4d888f854e63b791f66f83338c1d76e4c152c363351b6cda10d55c4a74fb3cf6be9a1784

Score

10^/10

Malware Config

Extracted

Family

vidar

Version

41.5

Botnet

517

C2

https://mas.to/@xeroxxx

Attributes

profile_id
517

Extracted

Family

djvu

C2

http://rlrz.org/fhsgtsspen6

Targets

- Target
  
  1b1b0e38d8f3de589e7d0b33d8eea47b9272f0c62ae0d3fd4f015258ab049cbb
- Size
  
  804KB
- MD5
  
  7205de53e7bd067205e970e0b744efc1
- SHA1
  
  512622a263aa3ebfaec1575fad480e3968877974
- SHA256
  
  1b1b0e38d8f3de589e7d0b33d8eea47b9272f0c62ae0d3fd4f015258ab049cbb
- SHA512
  
  3562cea220bc9dcf03ee37f9e902fe8e4fa39106731407fae7dc218c4d888f854e63b791f66f83338c1d76e4c152c363351b6cda10d55c4a74fb3cf6be9a1784
Score

10^/10

djvu vidar 517 discovery persistence ransomware spyware stealer
- Detected Djvu ransomware
- Djvu Ransomware
  Ransomware which is a variant of the STOP family.
  ransomware djvu
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Vidar Stealer
  stealer
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1