Submit Reports Overview overview 10 Static static 79fe08c83e...4a.exe windows7-x64 10 79fe08c83e...4a.exe windows10-2004-x64 10 Resubmissions 29-01-2023 06:15 230129-gzxv7sbe38 10 29-01-2023 06:02 230129-grzptsbb44 10 Sharing Copy URL Twitter E-mail General Target 79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a.zip Size 188KB Sample 230129-grzptsbb44 MD5 9589d70973b25b23ef6463febfa1d232 SHA1 3e59cb26229c9668141d591b7ef6ddad51da1bc3 SHA256 2fa5adb1940605fdf9a3b39af904fe7cc2dba8d70039e1f96829a510242d71e2 SHA512 a0c5a01ed41d5c59014d4e9df9c92bd8c7aed42305508afba6e696f17b7ef085146dd321075fadf61aaf2af8b03d760011aa4d2c5f2b9f9e96c2993c245b7ba0 SSDEEP 3072:4st/N3hi2aPG8896EbLXjClJzpYlyCV3p9vdYiL/gxqq3pJ/YNlK:4ilxVaPG88kEbDjIVYH36CIxqqbArK Score 10 /10 djvusmokeloadervidar19backdoordiscoverypersistenceransomwarespywarestealertrojanvmprotect Static task static1 Behavioral task behavioral1 Sample 79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a.exe Resource win7-20220812-en smokeloaderbackdoortrojan windows7-x64 5 signatures 150 seconds Behavioral task behavioral2 Sample 79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a.exe Resource win10v2004-20221111-en djvusmokeloadervidar19backdoordiscoverypersistenceransomwarespywarestealertrojanvmprotect windows10-2004-x64 29 signatures 150 seconds Malware Config djvu http://drampik.com/lancer/get.php http://drampik.com/lancer/get.php extension .mzop offline_id ex4uvTKsM2vEkIcr3MjXi2C6v27h1mS682iUXGt1 payload_url http://uaery.top/dl/build2.exe http://drampik.com/files/1/build3.exe ransomnote ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-uZxWxoKbU5 Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0637JOsie vidar 2.2 19 https://t.me/litlebey https://steamcommunity.com/profiles/76561199472399815 https://t.me/litlebey https://steamcommunity.com/profiles/76561199472399815 profile_id 19 Targets Target 79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a.exe Size 298KB MD5 11511ba5fd4de1fc5051d0bcefb388ae SHA1 5e9476f39df92e01d0952e703869e71f85d470cd SHA256 79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a SHA512 904f0e3a252cd0ef8108492de955ac520008b10b66da736cc4bbdc6a8c3736440a9a11edb73707ba415d7f3f4c2c590dfa983aca01864b9d66a6c3559ed744e9 SSDEEP 3072:0pb2LIT54Ga9Qzgp4gaCJrSjgBoMZmYKxQCBnIyCSyxzID1C7hZW0KIsiuNZ:xLIKGa96dfkBoMsDlqSwzIDM/KPP Score 10 /10 smokeloaderbackdoortrojandjvuvidar19discoverypersistenceransomwarespywarestealervmprotect Detected Djvu ransomware Detects Smokeloader packer Djvu Ransomware Ransomware which is a variant of the STOP family. ransomwaredjvu SmokeLoader Modular backdoor trojan in use since 2014. trojanbackdoorsmokeloader Vidar Vidar is an infostealer based on Arkei stealer. stealervidar Downloads MZ/PE file Executes dropped EXE VMProtect packed file Detects executables packed with VMProtect commercial packer. vmprotect Checks computer location settings Looks up country code configured in the registry, likely geofence. Loads dropped DLL Modifies file permissions discovery Reads user/profile data of web browsers Infostealers often target stored browser data, which can include saved credentials etc. spywarestealer Accesses 2FA software files, possible credential harvesting spywarestealer Accesses cryptocurrency files/wallets, possible credential harvesting spyware Adds Run key to start application persistence Checks installed software on the system Looks up Uninstall key entries in the registry to enumerate software on the system. discovery Looks up external IP address via web service Uses a legitimate IP lookup service to find the infected system's external IP. Suspicious use of SetThreadContext behavioral1behavioral2 MITRE ATT&CK Matrix Collection Data from Local System Command and Control Credential Access Credentials in Files Defense Evasion Modify Registry File Permissions Modification Discovery Query Registry System Information Discovery Peripheral Device Discovery Execution Exfiltration Impact Initial Access Lateral Movement Persistence Scheduled Task Registry Run Keys / Startup Folder Privilege Escalation Tasks Score N/A smokeloader backdoor trojan Score 10 /10 djvu smokeloader vidar 19 backdoor discovery persistence ransomware spyware stealer trojan vmprotect Score 10 /10 © 2018-2023 Terms | Privacy