djvu | dca4aa089e3a75aa3e0611e3479a0e7125b61fbab3ddc3556389dfd593f15eab

General

Target
a9bac1dee06b3257cab19cb09bef3d1c.exe
Size 732KB
Sample230124-pff3caag22
SHA256 dca4aa089e3a75aa3e0611e3479a0e7125b61fbab3ddc3556389dfd593f15eab
MD5 a9bac1dee06b3257cab19cb09bef3d1c
SHA1 2be37ca987a82592dde5e01293266a6a26e7892c
SHA512 db5bbb434d50f16562a5e590f591a55337ccaf8618b46d8310a8eaef81b141120e4f7dbc8129a9e318f2c5a6e1c75658f8f1cef90c542c1aa9995ced616a713c
SSDEEP 12288:dpiiinM8+zlgy0DjQxGZeS5eLebl75VAJSZ:dpiiiM8+z5mjQEZeS5eLeprAs
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

djvu vidar 19 discovery persistence ransomware spyware stealer

Malware Config

Extracted

Family

djvu

C2

http://spaceris.com/test1/get.php

Attributes

extension
.poqw
offline_id
ZMk7348t4yGVy3t2uxofhOwYXOGjluI9PiRO8dt1
payload_url
http://uaery.top/dl/build2.exe

http://spaceris.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-GTrvfBi8hs Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0632JOsie

rsa_pubkey.plain

Extracted

Family

vidar

Version

2.2

Botnet

19

C2

https://t.me/litlebey
https://steamcommunity.com/profiles/76561199472399815

Attributes

profile_id
19

Targets

- Target
  a9bac1dee06b3257cab19cb09bef3d1c.exe
- Size 732KB
- SHA256 dca4aa089e3a75aa3e0611e3479a0e7125b61fbab3ddc3556389dfd593f15eab
- MD5 a9bac1dee06b3257cab19cb09bef3d1c
- SHA1 2be37ca987a82592dde5e01293266a6a26e7892c
- SHA512 db5bbb434d50f16562a5e590f591a55337ccaf8618b46d8310a8eaef81b141120e4f7dbc8129a9e318f2c5a6e1c75658f8f1cef90c542c1aa9995ced616a713c
- SSDEEP 12288:dpiiinM8+zlgy0DjQxGZeS5eLebl75VAJSZ:dpiiiM8+z5mjQEZeS5eLeprAs
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

djvu vidar 19 discovery persistence ransomware stealer spyware
- Detected Djvu ransomware
- Djvu Ransomware
  Ransomware which is a variant of the STOP family.
  ransomware djvu
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Downloads MZ/PE file
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2