djvu | ec12bb53d94b1a84e4715f0b671b87eeaff4360217c6336897622c225499b3b9

General

Target

file.exe
Size

820KB
Sample

220916-3ye5nacgdk
MD5

617ad37350065407d3f385ce460dfc65
SHA1

0b3083761f3417857f5a0f14d131bf691a32c087
SHA256

ec12bb53d94b1a84e4715f0b671b87eeaff4360217c6336897622c225499b3b9
SHA512

460af814aeaef538d0e6b2d67cfff3f53b245da0657d3f73c2797bcd3d2b2f141e7baa5f2d2b2f8d2f560465cd9eed93116158da3aa3b1cdf7dcc36b3c08fd38
SSDEEP

24576:bifl0zISMgxANgTHMyISKUfOLcHGKQWdvKTji:bs0zx6N5UmgKWV

Score

10^/10

Malware Config

Extracted

Family

djvu

C2

http://acacaca.org/test3/get.php

Attributes

extension
.aamv
offline_id
MyudhIExJux2oRQXw95TT1oAPu7mvqRMzxr1eet1
payload_url
http://rgyui.top/dl/build2.exe

http://acacaca.org/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-4Xcf4IX21n Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0564Jhyjd

rsa_pubkey.plain

Targets

- Target
  
  file.exe
- Size
  
  820KB
- MD5
  
  617ad37350065407d3f385ce460dfc65
- SHA1
  
  0b3083761f3417857f5a0f14d131bf691a32c087
- SHA256
  
  ec12bb53d94b1a84e4715f0b671b87eeaff4360217c6336897622c225499b3b9
- SHA512
  
  460af814aeaef538d0e6b2d67cfff3f53b245da0657d3f73c2797bcd3d2b2f141e7baa5f2d2b2f8d2f560465cd9eed93116158da3aa3b1cdf7dcc36b3c08fd38
- SSDEEP
  
  24576:bifl0zISMgxANgTHMyISKUfOLcHGKQWdvKTji:bs0zx6N5UmgKWV
Score

10^/10

djvu discovery persistence ransomware spyware stealer
- Detected Djvu ransomware
- Djvu Ransomware
  Ransomware which is a variant of the STOP family.
  ransomware djvu
- Downloads MZ/PE file
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2