General
-
Target
4DB3.bin.zip
-
Size
8.1MB
-
Sample
211207-zmvt7afha8
-
MD5
70964076ed143594830a3c06ded4c385
-
SHA1
f6f3c604dc6bdb9713646cd8e958887d7ff38976
-
SHA256
5f65dd6a74baf05274208c326335057572519cc8d6cb468b8cb168dad3c2f1e6
-
SHA512
2f4a87bcfeb4727abd94219bd1fabbdd1f5092e1dc8b9d07c4366caab689923ac1e9fd0f3634af89148598dffc4f33fb9b1fd0123e0565fa3a8ca0297347a04a
Malware Config
Extracted
djvu
http://tzgl.org/fhsgtsspen6/get.php
-
extension
.wnlu
-
offline_id
gYuqQ5GsAaJom08TivUVhlPzZDKd916x4NcXrWt1
-
payload_url
http://kotob.top/dl/build2.exe
http://tzgl.org/files/1/build3.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-m8LBBi8x8F Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: manager@mailtemp.ch Reserve e-mail address to contact us: helprestoremanager@airmail.cc Your personal ID: 0357Sigrj
Extracted
vidar
49
517
https://mstdn.social/@sergeev43
https://koyu.space/@sergeev45
-
profile_id
517
Targets
-
-
Target
4DB3.bin
-
Size
826KB
-
MD5
ce492cc2d9bff6b9c1455b1d68776e77
-
SHA1
fd40c16d8de20f934e2f39cb12a6f5e30e859606
-
SHA256
234bb5fec4db69b563c807f168bfb48e37abde49e9ae5d4a7ee4cb90e552fa1e
-
SHA512
a1365398ba4f261f565b0365ddaa586f0a0eb51e86ccc831aba5e6a5dddf166e2c94e92d3fef0cbb897a0ae710328aef23730b59ab307cb0d58cc250df6e4243
Score10/10-
Detected Djvu ransomware
-
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
-
-
Target
vaccine.exe
-
Size
7.6MB
-
MD5
51036ffd690fc0b4c9d32a7f014e2225
-
SHA1
1a51a798ac54a271bdef2b15f2fbfec80299128b
-
SHA256
70732fc71c82134f96999b191de22feba361d1f3f4050a22f2160273fd1d316a
-
SHA512
927863d1e53b1b73a1a0773029593943ee90ccb2810c52fa15841bc5569ac8171efc218dd866d55847381fc573dc8c356d8282c16fc1b764b75481d6f1556f62
Score10/10-
Detected Djvu ransomware
-
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
Vidar Stealer
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses 2FA software files, possible credential harvesting
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-