General

  • Target

    70fb564e7e133586e70b96aa8228e018f2dd343d487c62f9cc52615f7c2db314

  • Size

    805KB

  • Sample

    211022-dbqkfabhgk

  • MD5

    dcfb0c5d1f2d5565341c3ca2b83df66c

  • SHA1

    58233236d363ce65f1425b9fd85867291091a833

  • SHA256

    70fb564e7e133586e70b96aa8228e018f2dd343d487c62f9cc52615f7c2db314

  • SHA512

    03c7b36cbff86fa6641deeb14b82a12b37a5883b40eb6bb251ec7d269301d9eb228d53c20870a529ceecf98dfe04a1173bf2a7911896f87d7c6cff73f876b36d

Malware Config

Extracted

Family

vidar

Version

41.5

Botnet

517

C2

https://mas.to/@xeroxxx

Attributes
  • profile_id

    517

Extracted

Family

djvu

C2

http://rlrz.org/lancer

Targets

    • Target

      70fb564e7e133586e70b96aa8228e018f2dd343d487c62f9cc52615f7c2db314

    • Size

      805KB

    • MD5

      dcfb0c5d1f2d5565341c3ca2b83df66c

    • SHA1

      58233236d363ce65f1425b9fd85867291091a833

    • SHA256

      70fb564e7e133586e70b96aa8228e018f2dd343d487c62f9cc52615f7c2db314

    • SHA512

      03c7b36cbff86fa6641deeb14b82a12b37a5883b40eb6bb251ec7d269301d9eb228d53c20870a529ceecf98dfe04a1173bf2a7911896f87d7c6cff73f876b36d

    • Detected Djvu ransomware

    • Djvu Ransomware

      Ransomware which is a variant of the STOP family.

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request

      suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request

    • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

      suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

    • suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

      suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

    • suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

      suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

    • Vidar Stealer

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

File Permissions Modification

1
T1222

Modify Registry

2
T1112

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

3
T1005

Tasks