djvu | e20fbb632004bd2385e1c0ff35df1e34a2444a803b810d166592e7b3aefafa4f

General

Target

e20fbb632004bd2385e1c0ff35df1e34a2444a803b810d166592e7b3aefafa4f
Size

854KB
Sample

211024-bp8l3acfh5
MD5

09186ef44abc9a5280e2ecd20d58002b
SHA1

e2151d022ded1b1f764d5ed46e1fda8ae4b086c6
SHA256

e20fbb632004bd2385e1c0ff35df1e34a2444a803b810d166592e7b3aefafa4f
SHA512

e2bc7b1957e131adbefa7a4b1cce0e0789ab73dc08c7ace3064c53ca4c03a6f34e5ad34e2d404d0130424acf1d905829c9e8673526cd014f20b01b7a79ea15e4

Score

10^/10

Malware Config

Extracted

Family

vidar

Version

41.5

Botnet

517

C2

https://mas.to/@xeroxxx

Attributes

profile_id
517

Extracted

Family

djvu

C2

http://rlrz.org/lancer

Targets

- Target
  
  e20fbb632004bd2385e1c0ff35df1e34a2444a803b810d166592e7b3aefafa4f
- Size
  
  854KB
- MD5
  
  09186ef44abc9a5280e2ecd20d58002b
- SHA1
  
  e2151d022ded1b1f764d5ed46e1fda8ae4b086c6
- SHA256
  
  e20fbb632004bd2385e1c0ff35df1e34a2444a803b810d166592e7b3aefafa4f
- SHA512
  
  e2bc7b1957e131adbefa7a4b1cce0e0789ab73dc08c7ace3064c53ca4c03a6f34e5ad34e2d404d0130424acf1d905829c9e8673526cd014f20b01b7a79ea15e4
Score

10^/10

djvu vidar 517 discovery persistence ransomware spyware stealer
- Detected Djvu ransomware
- Djvu Ransomware
  Ransomware which is a variant of the STOP family.
  ransomware djvu
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Vidar Stealer
  stealer
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1