General
Target

45376600c8e5307a742d759f359c63a8bcfff11cd45b1ac6d01e1c76a4fa632f

Size

831KB

Sample

220806-g28qgsdhf7

Score
10/10
MD5

b6eb62288ca782e26d71236994995d57

SHA1

ed5080d2301df02600b3ec0d3e4de91541bb32e8

SHA256

45376600c8e5307a742d759f359c63a8bcfff11cd45b1ac6d01e1c76a4fa632f

SHA512

0b2f11dd857390155a8520aaa64693bae19caa67b27da8026937f2aec491861da761841e9c309142b1a0e7d3aa87d13ac1be0904481ed8be9dbf48be1b9276fd

Malware Config

Extracted

Family

djvu

C2

http://acacaca.org/test2/get.php

Attributes
extension
.vvyu
offline_id
rE5LpDv2ftYRXAo7bC18EpzfRMTHSGjgfyIMfZt1
payload_url
http://rgyui.top/dl/build2.exe
http://acacaca.org/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-QsoSRIeAK6 Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: support@bestyourmail.ch Reserve e-mail address to contact us: datarestorehelp@airmail.cc Your personal ID: 0531Jhyjd
rsa_pubkey.plain
Targets
Target

45376600c8e5307a742d759f359c63a8bcfff11cd45b1ac6d01e1c76a4fa632f

MD5

b6eb62288ca782e26d71236994995d57

Filesize

831KB

Score
10/10
SHA1

ed5080d2301df02600b3ec0d3e4de91541bb32e8

SHA256

45376600c8e5307a742d759f359c63a8bcfff11cd45b1ac6d01e1c76a4fa632f

SHA512

0b2f11dd857390155a8520aaa64693bae19caa67b27da8026937f2aec491861da761841e9c309142b1a0e7d3aa87d13ac1be0904481ed8be9dbf48be1b9276fd

Tags

Signatures

  • Detected Djvu ransomware

  • Djvu Ransomware

    Description

    Ransomware which is a variant of the STOP family.

    Tags

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Description

    Looks up country code configured in the registry, likely geofence.

    TTPs

    Query RegistrySystem Information Discovery
  • Modifies file permissions

    Tags

    TTPs

    File Permissions Modification
  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    Tags

    TTPs

    Data from Local SystemCredentials in Files
  • Accesses 2FA software files, possible credential harvesting

    Tags

    TTPs

    Data from Local SystemCredentials in Files
  • Accesses cryptocurrency files/wallets, possible credential harvesting

    Tags

    TTPs

    Data from Local SystemCredentials in Files
  • Adds Run key to start application

    Tags

    TTPs

    Registry Run Keys / Startup FolderModify Registry
  • Checks installed software on the system

    Description

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    Tags

    TTPs

    Query Registry
  • Looks up external IP address via web service

    Description

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

Related Tasks

MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Execution
      Exfiltration
        Impact
          Initial Access
            Lateral Movement
              Privilege Escalation
                Tasks

                static1

                Score
                N/A