djvu | c25e82a6382c31556410ef44875e9e0c6959bf15217eb9438aacc0fb833f66a9

General

Target

c25e82a6382c31556410ef44875e9e0c6959bf15217eb9438aacc0fb833f66a9
Size

864KB
Sample

211022-k8jaysbdf9
MD5

7c2299bbb8fa106c97cbf2b53a15e7c3
SHA1

74444b42d04a4472ab967de239e181b88f9a93d5
SHA256

c25e82a6382c31556410ef44875e9e0c6959bf15217eb9438aacc0fb833f66a9
SHA512

4f5d9c602d93bbd9d915951132cd22787b47956e098d64176038c1473e115ae22d741544027148565f6ef0c8dfc6f89a589821f4bd665fa88c86fa98f2145c87

Score

10^/10

Malware Config

Extracted

Family

vidar

Version

41.5

Botnet

517

C2

https://mas.to/@xeroxxx

Attributes

profile_id
517

Extracted

Family

djvu

C2

http://rlrz.org/fhsgtsspen6

Targets

- Target
  
  c25e82a6382c31556410ef44875e9e0c6959bf15217eb9438aacc0fb833f66a9
- Size
  
  864KB
- MD5
  
  7c2299bbb8fa106c97cbf2b53a15e7c3
- SHA1
  
  74444b42d04a4472ab967de239e181b88f9a93d5
- SHA256
  
  c25e82a6382c31556410ef44875e9e0c6959bf15217eb9438aacc0fb833f66a9
- SHA512
  
  4f5d9c602d93bbd9d915951132cd22787b47956e098d64176038c1473e115ae22d741544027148565f6ef0c8dfc6f89a589821f4bd665fa88c86fa98f2145c87
Score

10^/10

djvu vidar 517 discovery persistence ransomware spyware stealer
- Detected Djvu ransomware
- Djvu Ransomware
  Ransomware which is a variant of the STOP family.
  ransomware djvu
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Vidar Stealer
  stealer
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1