Extracted

Extracted

• • Target

    2fc8445a8abdfbdc6135125b6ad1a36670c52136d30973cf41f16d4f070720ce

  • Size

    864KB

  • MD5

    f3be5cf68ba866a6a4957c43fe4747f8

  • SHA1

    1fba60aab1e176addf56a9710d75ba8dce424d7c

  • SHA256

    2fc8445a8abdfbdc6135125b6ad1a36670c52136d30973cf41f16d4f070720ce

  • SHA512

    f9ab9af5f6e4d2c206031277fdd72e96649e593e4dd314f0bb87360ef5ad78286bf8c9b7757d29d67fac29bcfcc4406adb233da9b108acb1e0e0d949713a6e50

  Score

  10^/10

  djvuvidar517discoverypersistenceransomwarespywarestealer

  • Detected Djvu ransomware

  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar Stealer

    stealer

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1