djvu | 73762f0b48b71fda1b2e27e694d777f173cad907f1dc349715ecc141c69c0e4c

General

Target

73762f0b48b71fda1b2e27e694d777f173cad907f1dc349715ecc141c69c0e4c
Size

787KB
Sample

221007-b5ad7sbeck
MD5

7bd64a4c93cb85326992f60192377893
SHA1

2bc8541da2770c3289732f3d7dfc5b82e9328fef
SHA256

73762f0b48b71fda1b2e27e694d777f173cad907f1dc349715ecc141c69c0e4c
SHA512

2bea6c7f09d5ea80ba76829cde72bf6d11c5b4f123be25fd5c2a548d8bffaf2a4da5dd5548b587d30dae073aeeba8be3782a5f662b1a1ed46cf5ef76e22ba991
SSDEEP

24576:8fkcwJ9zltsv6gNmXfZEZ7xOknGOwftF:8dwzzlt0hNmXK/nwfT

Score

10^/10

Malware Config

Extracted

Family

djvu

C2

http://winnlinne.com/lancer/get.php

Attributes

extension
.towz
offline_id
SSHsHMHGmSIhrz50VnIxLJJX15osxEQY6iXedXt1
payload_url
http://rgyui.top/dl/build2.exe

http://winnlinne.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-Kbx8mJatqN Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0577Jhyjd

rsa_pubkey.plain

Extracted

Family

vidar

Version

54.9

Botnet

517

C2

https://t.me/larsenup

https://ioc.exchange/@zebra54

Attributes

profile_id
517

Targets

- Target
  
  73762f0b48b71fda1b2e27e694d777f173cad907f1dc349715ecc141c69c0e4c
- Size
  
  787KB
- MD5
  
  7bd64a4c93cb85326992f60192377893
- SHA1
  
  2bc8541da2770c3289732f3d7dfc5b82e9328fef
- SHA256
  
  73762f0b48b71fda1b2e27e694d777f173cad907f1dc349715ecc141c69c0e4c
- SHA512
  
  2bea6c7f09d5ea80ba76829cde72bf6d11c5b4f123be25fd5c2a548d8bffaf2a4da5dd5548b587d30dae073aeeba8be3782a5f662b1a1ed46cf5ef76e22ba991
- SSDEEP
  
  24576:8fkcwJ9zltsv6gNmXfZEZ7xOknGOwftF:8dwzzlt0hNmXK/nwfT
Score

10^/10

djvu vidar 517 discovery persistence ransomware spyware stealer
- Detected Djvu ransomware
- Djvu Ransomware
  Ransomware which is a variant of the STOP family.
  ransomware djvu
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Downloads MZ/PE file
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1