Overview

overview

10

Static

static

dridex

windows10_x64

10
General
Target

56fec529e038e9b0bb2cced4e29a4a9619a9c4b55506ffeb6302b7304689180b

Size

777KB

Sample

211108-x56cjaaafk

Score
10/10
MD5

b401489eb0ca1a9dda5b3bbbf10dd8e6

SHA1

dfa92f2f8a1dc83ffba0f9f58efb063634d920ab

SHA256

56fec529e038e9b0bb2cced4e29a4a9619a9c4b55506ffeb6302b7304689180b

SHA512

14e1b6c608ede54432fdf457088308c875f465d7940d7723a6f09c28e17341a3c6f40644de2a13a701b62391cd732bdfbf971ab47406957d9145aae950fa7732

Malware Config

Extracted

Family

djvu
C2

http://pqkl.org/fhsgtsspen6/get.php
Attributes
extension
.stax
offline_id
7HKlLI6NrOQGMaTs5PqjvV1UcZ3VOcIeyFiH3Wt1
payload_url
http://kotob.top/dl/build2.exe
http://pqkl.org/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-dFmA3YqXzs Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: manager@mailtemp.ch Reserve e-mail address to contact us: helprestoremanager@airmail.cc Your personal ID: 0345uSifke
rsa_pubkey.plain

Extracted

Family

vidar
Version

48
Botnet

517
C2

https://social.chinwag.org/@rspich
Attributes
profile_id
517
Targets
Target

56fec529e038e9b0bb2cced4e29a4a9619a9c4b55506ffeb6302b7304689180b

MD5

b401489eb0ca1a9dda5b3bbbf10dd8e6

Filesize

777KB

Score
10/10
SHA1

dfa92f2f8a1dc83ffba0f9f58efb063634d920ab

SHA256

56fec529e038e9b0bb2cced4e29a4a9619a9c4b55506ffeb6302b7304689180b

SHA512

14e1b6c608ede54432fdf457088308c875f465d7940d7723a6f09c28e17341a3c6f40644de2a13a701b62391cd732bdfbf971ab47406957d9145aae950fa7732

Tags

Signatures

  • Detected Djvu ransomware

  • Djvu Ransomware

    Description

    Ransomware which is a variant of the STOP family.

    Tags

  • Vidar

    Description

    Vidar is an infostealer based on Arkei stealer.

    Tags

  • suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request

    Description

    suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request

    Tags

  • Vidar Stealer

    Tags

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Modifies file permissions

    Tags

    TTPs

    File Permissions Modification

  • Adds Run key to start application

    Tags

    TTPs

    Registry Run Keys / Startup FolderModify Registry

  • Looks up external IP address via web service

    Description

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

Related Tasks

behavioral1
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Discovery
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Persistence
                  Privilege Escalation
                    Tasks

                    static1

                    Score
                    N/A

                    behavioral1

                    Score
                    10/10