djvu | 80cdfc120b7824e7cb5b34fc9ab1b6b43b84dfb435fd8f3e681ad4ae0ebd41de

General

Target
80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe
Size 206KB
Sample220321-qf3rsacfej
SHA256 80cdfc120b7824e7cb5b34fc9ab1b6b43b84dfb435fd8f3e681ad4ae0ebd41de
MD5 bdf006ab7d3b4238dab5d9b3d65cd64e
SHA1 8d0a87a19e5c1be940e8829aa5ee9be5312fda67
SHA512 540b02490c5e9b5adba34c46d06f712f1d2b3c7178a1c2b3c5d4e6b94c2cf8117c145aa0cad9cab680e8c14037b68f8431e753f1a1782be1563cecc7a7bedaef
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

bomji1234

C2

86.107.197.196:63065

Attributes

auth_value
c1142ca8af2e545509032e96c9bc48d7

Extracted

Family

vidar

Version

50.9

Botnet

937

C2

https://ieji.de/@sam7al
https://busshi.moe/@sam0al

Attributes

profile_id
937

Extracted

Family

djvu

C2

http://fuyt.org/test3/get.php

Attributes

extension
.ssoi
offline_id
dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1
payload_url
http://zerit.top/dl/build2.exe

http://fuyt.org/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-NdDG3HIUZp Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0427Jsfkjn

rsa_pubkey.plain

Targets

- Target
  80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe
- Size 206KB
- SHA256 80cdfc120b7824e7cb5b34fc9ab1b6b43b84dfb435fd8f3e681ad4ae0ebd41de
- MD5 bdf006ab7d3b4238dab5d9b3d65cd64e
- SHA1 8d0a87a19e5c1be940e8829aa5ee9be5312fda67
- SHA512 540b02490c5e9b5adba34c46d06f712f1d2b3c7178a1c2b3c5d4e6b94c2cf8117c145aa0cad9cab680e8c14037b68f8431e753f1a1782be1563cecc7a7bedaef
- MD5 SHA1 SHA512
Score

10^/10

djvu redline vidar 937 bomji1234 evasion infostealer ransomware spyware stealer suricata trojan
- Detected Djvu ransomware
- Djvu Ransomware
  Ransomware which is a variant of the STOP family.
  ransomware djvu
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- suricata: ET MALWARE GCleaner Downloader Activity M5
  suricata: ET MALWARE GCleaner Downloader Activity M5
  suricata
- suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
  suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
  suricata
- suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
  suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
  suricata
- suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
  suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
  suricata
- suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3
  suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3
  suricata
- suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
  suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
  suricata
- Vidar Stealer
  stealer
- Downloads MZ/PE file
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2