djvu | b01beeb1e5331f73cf0a30720545b81e89eb7a9163064c12f4b2a7ac37716b29

General

Target

b01beeb1e5331f73cf0a30720545b81e89eb7a9163064c12f4b2a7ac37716b29
Size

853KB
Sample

211022-2e441adaer
MD5

1f762973f3ef9c0eb84f1e72739241e8
SHA1

8180a2cf4557ddd2999e14ea168f7b7c72b1095e
SHA256

b01beeb1e5331f73cf0a30720545b81e89eb7a9163064c12f4b2a7ac37716b29
SHA512

5e755530b6974ea5d1a36bdfae69d02ce750fcaa2095d971ed84ff12cedfeca403214cc41f0f319e8d5d9d9b35c66c115a15afbb499a80060c2b5c5e2482188a

Score

10^/10

Malware Config

Extracted

Family

vidar

Version

41.5

Botnet

517

C2

https://mas.to/@xeroxxx

Attributes

profile_id
517

Extracted

Family

djvu

C2

http://rlrz.org/fhsgtsspen6

Targets

- Target
  
  b01beeb1e5331f73cf0a30720545b81e89eb7a9163064c12f4b2a7ac37716b29
- Size
  
  853KB
- MD5
  
  1f762973f3ef9c0eb84f1e72739241e8
- SHA1
  
  8180a2cf4557ddd2999e14ea168f7b7c72b1095e
- SHA256
  
  b01beeb1e5331f73cf0a30720545b81e89eb7a9163064c12f4b2a7ac37716b29
- SHA512
  
  5e755530b6974ea5d1a36bdfae69d02ce750fcaa2095d971ed84ff12cedfeca403214cc41f0f319e8d5d9d9b35c66c115a15afbb499a80060c2b5c5e2482188a
Score

10^/10

djvu vidar 517 discovery persistence ransomware spyware stealer suricata
- Detected Djvu ransomware
- Djvu Ransomware
  Ransomware which is a variant of the STOP family.
  ransomware djvu
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
  suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
  suricata
- suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
  suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
  suricata
- suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
  suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
  suricata
- suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
  suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
  suricata
- Vidar Stealer
  stealer
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1