djvu | 884e57392641d54e46d7461a747a82d865380971fdc13f08e1fb313c4bd6509d

Resubmissions

16-06-2022 19:48

220616-yh7grabde9 10

13-06-2022 21:53

220613-1rlbzsahhq 10

Sharing

Copy URL

Twitter E-mail

General

Target

7586326133.zip
Size

3.9MB
Sample

220613-1rlbzsahhq
MD5

0cb01a8c09973ca390a93eb9aa6a3683
SHA1

84e32b609296ae2eed02fecf95a48890b47b5a3e
SHA256

884e57392641d54e46d7461a747a82d865380971fdc13f08e1fb313c4bd6509d
SHA512

37d7d0c778261872ac22efe9bfaa9b2a022ebdaeae33e6fbf79e92c9dbef7776abe905c3596572b0294630efd218de921ea9289c1c0d99070cc86dbb5704d464

Malware Config

Extracted

Family

socelars

http://www.iyiqian.com/

http://www.hbgents.top/

http://www.rsnzhy.com/

http://www.efxety.top/

Extracted

Family

redline

Botnet

sehrish2

135.181.129.119:4805

Attributes

auth_value
b69102cdbd4afe2d3159f88fb6dac731

Extracted

Family

redline

Botnet

ChrisNEW

194.104.136.5:46013

Attributes

auth_value
9491a1c5e11eb6097e68a4fa8627fda8

Extracted

Family

redline

Botnet

media21

91.121.67.60:23325

Attributes

auth_value
e37d5065561884bb54c8ed1baa6de446

Extracted

Family

djvu

http://abababa.org/test3/get.php

Attributes

extension
.bbii
offline_id
fE1iyGbFRSHwEwVlLZsE3FvHU8UKd1wubsS4CFt1
payload_url
http://rgyui.top/dl/build2.exe
http://abababa.org/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-KXqYlvxcUy Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: support@bestyourmail.ch Reserve e-mail address to contact us: supportsys@airmail.cc Your personal ID: 0498JIjdm

rsa_pubkey.plain

Targets

- Target
  
  00b5c410d204d6a92f6636e23998777d2716e8928f96b56826b093c9177afaae
- Size
  
  3.9MB
- MD5
  
  d53ddc86260fa2b2508bb4a7270bf985
- SHA1
  
  353242843d7115c936b0b370ef0dc3b5243fed04
- SHA256
  
  00b5c410d204d6a92f6636e23998777d2716e8928f96b56826b093c9177afaae
- SHA512
  
  d72a29e96368cadf7323c814075edb8837e5109d8e80b3c2516b7c429b13018e0a09b96c5e367d51d123bb80797fd020d9f337c35ca56503328c2135d504c047
Score

10^/10

pseudomanuscrypt redline socelars chrisnew sehrish2 aspackv2 discovery evasion infostealer loader persistence spyware stealer trojan djvu tofsee media21 ransomware suricata themida vmprotect
- Detect PseudoManuscrypt loader dropped by the installer
  loader
- Detected Djvu ransomware
- Djvu Ransomware
  Ransomware which is a variant of the STOP family.
  ransomware djvu
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- PseudoManuscrypt
  PseudoManuscrypt is a malware Lazarus’s Manuscrypt targeting government organizations and ICS.
  loader pseudomanuscrypt
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- Socelars
  Socelars is an infostealer targeting browser cookies and credit card credentials.
  stealer socelars
- Socelars Payload
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Tofsee
  Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
  trojan tofsee
- Windows security bypass
  evasion trojan
- suricata: ET MALWARE Generic Stealer Config Download Request
  suricata: ET MALWARE Generic Stealer Config Download Request
  suricata
- suricata: ET MALWARE Generic Stealer Sending System Information M1
  suricata: ET MALWARE Generic Stealer Sending System Information M1
  suricata
- suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
  suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
  suricata
- suricata: ET MALWARE Recordbreaker Stealer CnC Checkin
  suricata: ET MALWARE Recordbreaker Stealer CnC Checkin
  suricata
- suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
  suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
  suricata
- suricata: ET MALWARE Vidar/Arkei/Megumin Stealer Keywords Retrieved
  suricata: ET MALWARE Vidar/Arkei/Megumin Stealer Keywords Retrieved
  suricata
- suricata: ET MALWARE W32/Agent.OGR!tr.pws Stealer
  suricata: ET MALWARE W32/Agent.OGR!tr.pws Stealer
  suricata
- suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3
  suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3
  suricata
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Creates new service(s)
  persistence
- Downloads MZ/PE file
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Sets DLL path for service in the registry
  persistence
- Sets service image path in registry
  persistence
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Looks up geolocation information via web service
  Uses a legitimate geolocation service to find the infected system's geolocation info.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

New Service

T1050

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

New Service

T1050

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

File Permissions Modification

T1222

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Targets

Detect PseudoManuscrypt loader dropped by the installer

Detected Djvu ransomware

Djvu Ransomware

Modifies Windows Defender Real-time Protection settings

Process spawned unexpected child process

PseudoManuscrypt

RedLine

RedLine Payload

Socelars

Socelars Payload

Suspicious use of NtCreateUserProcessOtherParentProcess

Tofsee

Windows security bypass

suricata: ET MALWARE Generic Stealer Config Download Request

suricata: ET MALWARE Generic Stealer Sending System Information M1

suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

suricata: ET MALWARE Recordbreaker Stealer CnC Checkin

suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

suricata: ET MALWARE Vidar/Arkei/Megumin Stealer Keywords Retrieved

suricata: ET MALWARE W32/Agent.OGR!tr.pws Stealer

suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3

ASPack v2.12-2.42

Creates new service(s)

Downloads MZ/PE file

Executes dropped EXE

Modifies Windows Firewall

Sets DLL path for service in the registry

Sets service image path in registry

VMProtect packed file

Checks computer location settings

Loads dropped DLL

Modifies file permissions

Reads user/profile data of web browsers

Themida packer

Unexpected DNS network traffic destination

Checks installed software on the system

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Looks up geolocation information via web service

Drops file in System32 directory

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2