djvu | 6318be892d092976958575601b5693dea00125d9c6f67df89a722fd4e7f8c1f6

General

Target

Password_is_5432764372___Adobe-Photoshop.exe
Size

27.6MB
Sample

211023-v1pg4scdd4
MD5

85fc603eb185b9ede6ce8b819554f7d8
SHA1

a90a7830852936c7dc89f39616e70a0e004fa664
SHA256

6318be892d092976958575601b5693dea00125d9c6f67df89a722fd4e7f8c1f6
SHA512

909e7404759153b44a6e8583709b4211dab000c5747b5f5f044b17c122f44ae1ec8880d1e4afb209ee2838bab0a22c91014203b7c11eb54cc61d03eeb141d3b4

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://directorycart.com/upload/

http://tierzahnarzt.at/upload/

http://streetofcards.com/upload/

http://ycdfzd.com/upload/

http://successcoachceo.com/upload/

http://uhvu.cn/upload/

http://japanarticle.com/upload/

rc4.i32

Extracted

Family

vidar

Version

41.5

Botnet

933

C2

https://mas.to/@xeroxxx

Attributes

profile_id
933

Extracted

Family

djvu

C2

http://rlrz.org/lancer

Targets

- Target
  
  Password_is_5432764372___Adobe-Photoshop.exe
- Size
  
  27.6MB
- MD5
  
  85fc603eb185b9ede6ce8b819554f7d8
- SHA1
  
  a90a7830852936c7dc89f39616e70a0e004fa664
- SHA256
  
  6318be892d092976958575601b5693dea00125d9c6f67df89a722fd4e7f8c1f6
- SHA512
  
  909e7404759153b44a6e8583709b4211dab000c5747b5f5f044b17c122f44ae1ec8880d1e4afb209ee2838bab0a22c91014203b7c11eb54cc61d03eeb141d3b4
Score

10^/10

djvu redline smokeloader vidar 933 aspackv2 backdoor discovery evasion infostealer ransomware spyware stealer trojan
- Djvu Ransomware
  Ransomware which is a variant of the STOP family.
  ransomware djvu
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Vidar Stealer
  stealer
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Downloads MZ/PE file
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
behavioral1