Overview

overview

10

Static

static

dridex

windows10_x64

10
General
Target

f602931720643f83453d871cfcbbb7e0b04c7886a893fc83dc910bd479f36df6

Size

855KB

Sample

211111-pxhbqsgddj

Score
10/10
MD5

c6901bf62961a530ceec0a59bd610985

SHA1

891344934957544be0130013dd452c9168bbb5bc

SHA256

f602931720643f83453d871cfcbbb7e0b04c7886a893fc83dc910bd479f36df6

SHA512

ec91e6588cbf81628f198a2abd9179c1c901ca00418c5d063b5e114d4cb1b876037d3476a866553b4003b6aa1ea89113f4825afa2ad6d84ddde5df73b772640f

Malware Config

Extracted

Family

djvu
C2

http://pqkl.org/lancer/get.php
Attributes
extension
.qmak
offline_id
mGOVYjwKN5zpBZyRsr2Nqza9xnxDzO1NGhAl47t1
payload_url
http://kotob.top/dl/build2.exe
http://pqkl.org/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-W7mpKFSSv2 Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: manager@mailtemp.ch Reserve e-mail address to contact us: helprestoremanager@airmail.cc Your personal ID: 0348gSd743d
rsa_pubkey.plain
Targets
Target

f602931720643f83453d871cfcbbb7e0b04c7886a893fc83dc910bd479f36df6

MD5

c6901bf62961a530ceec0a59bd610985

Filesize

855KB

Score
10/10
SHA1

891344934957544be0130013dd452c9168bbb5bc

SHA256

f602931720643f83453d871cfcbbb7e0b04c7886a893fc83dc910bd479f36df6

SHA512

ec91e6588cbf81628f198a2abd9179c1c901ca00418c5d063b5e114d4cb1b876037d3476a866553b4003b6aa1ea89113f4825afa2ad6d84ddde5df73b772640f

Tags

Signatures

  • Detected Djvu ransomware

  • Djvu Ransomware

    Description

    Ransomware which is a variant of the STOP family.

    Tags

  • suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request

    Description

    suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request

    Tags

  • Modifies file permissions

    Tags

    TTPs

    File Permissions Modification

  • Adds Run key to start application

    Tags

    TTPs

    Registry Run Keys / Startup FolderModify Registry

  • Looks up external IP address via web service

    Description

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

Related Tasks

behavioral1
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Discovery
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Persistence
                  Privilege Escalation
                    Tasks

                    static1

                    Score
                    N/A

                    behavioral1

                    Score
                    10/10