General
-
Target
1940475968ba60f13e822197055a8f49897709f071b0a99ee1df1e62a24b060e
-
Size
781KB
-
Sample
211025-fgclwafeg3
-
MD5
f2c68a72c60941a3448df9245b96a5ee
-
SHA1
82bd6d53b08f522d77a700cb90f22f5a649a4262
-
SHA256
1940475968ba60f13e822197055a8f49897709f071b0a99ee1df1e62a24b060e
-
SHA512
c82cec74db0280840bd38d4f31903e474de2751380bd8c6cc834e0432560ee1def1ea2b0567fc633eef9cee3a914578f939cc2e8424c351d54949c7ab8e833b6
Static task
static1
Behavioral task
behavioral1
Sample
1940475968ba60f13e822197055a8f49897709f071b0a99ee1df1e62a24b060e.exe
Resource
win10-en-20211014
Malware Config
Extracted
vidar
41.5
517
https://mas.to/@xeroxxx
-
profile_id
517
Extracted
djvu
http://rlrz.org/lancer
Targets
-
-
Target
1940475968ba60f13e822197055a8f49897709f071b0a99ee1df1e62a24b060e
-
Size
781KB
-
MD5
f2c68a72c60941a3448df9245b96a5ee
-
SHA1
82bd6d53b08f522d77a700cb90f22f5a649a4262
-
SHA256
1940475968ba60f13e822197055a8f49897709f071b0a99ee1df1e62a24b060e
-
SHA512
c82cec74db0280840bd38d4f31903e474de2751380bd8c6cc834e0432560ee1def1ea2b0567fc633eef9cee3a914578f939cc2e8424c351d54949c7ab8e833b6
-
Detected Djvu ransomware
-
Vidar Stealer
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-