djvu | 49bc7d63d4e82e6d645b37f79c7e689fbe0f8313152376b14e68d570c99afb82

General

Target

setup_x86_x64_install.exe
Size

11.6MB
Sample

211126-zgtpyaegfp
MD5

54703a1521ec4d0d257fd72bcb318971
SHA1

40e376a63ff6866eadf5423b5b318fcc25758ffd
SHA256

49bc7d63d4e82e6d645b37f79c7e689fbe0f8313152376b14e68d570c99afb82
SHA512

6234c583ce20b05881872fd95ae71395ad2509eac1969f1a81b49ef972dec3a9414bf5c90adb243fa99374c838ac1f7ef5fb926778209f2004b8a92d1f12aed8

Score

10^/10

Malware Config

Extracted

Family

socelars

C2

http://www.ecgbg.com/

Extracted

Family

smokeloader

Version

2020

C2

http://membro.at/upload/

http://jeevanpunetha.com/upload/

http://misipu.cn/upload/

http://zavodooo.ru/upload/

http://targiko.ru/upload/

http://vues3d.com/upload/

rc4.i32

Extracted

Family

vidar

Version

48.7

Botnet

933

C2

https://mstdn.social/@anapa

https://mastodon.social/@mniami

Attributes

profile_id
933

Extracted

Family

djvu

C2

http://tzgl.org/fhsgtsspen6/get.php

Attributes

extension
.rigj
offline_id
Z5GGASEfY71jtxU3i3E8kzvrTJmY9oiZkjcSm0t1
payload_url
http://kotob.top/dl/build2.exe

http://tzgl.org/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-Tjb0YqckGX Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0353gSd743d

rsa_pubkey.plain

Targets

- Target
  
  setup_x86_x64_install.exe
- Size
  
  11.6MB
- MD5
  
  54703a1521ec4d0d257fd72bcb318971
- SHA1
  
  40e376a63ff6866eadf5423b5b318fcc25758ffd
- SHA256
  
  49bc7d63d4e82e6d645b37f79c7e689fbe0f8313152376b14e68d570c99afb82
- SHA512
  
  6234c583ce20b05881872fd95ae71395ad2509eac1969f1a81b49ef972dec3a9414bf5c90adb243fa99374c838ac1f7ef5fb926778209f2004b8a92d1f12aed8
Score

10^/10

djvu redline smokeloader socelars vidar 933 aspackv2 backdoor discovery infostealer ransomware spyware stealer suricata trojan
- Detected Djvu ransomware
- Djvu Ransomware
  Ransomware which is a variant of the STOP family.
  ransomware djvu
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Socelars
  Socelars is an infostealer targeting browser cookies and credit card credentials.
  stealer socelars
- Socelars Payload
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- suricata: ET MALWARE GCleaner Downloader Activity M5
  suricata: ET MALWARE GCleaner Downloader Activity M5
  suricata
- suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
  suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
  suricata
- Vidar Stealer
  stealer
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Looks up geolocation information via web service
  Uses a legitimate geolocation service to find the infected system's geolocation info.
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2