djvu | 5e4de4ccd5d68a636fba5bc5f2e9f7c7754264cb22056c1cafcc90468bc407d0

General

Target

5e4de4ccd5d68a636fba5bc5f2e9f7c7754264cb22056c1cafcc90468bc407d0
Size

670KB
Sample

230222-cy7a2ahe48
MD5

f1da1e2b22c8a7eca0e21b666657775b
SHA1

5741175faa484bd49f4a0bed49261a9724aa19a4
SHA256

5e4de4ccd5d68a636fba5bc5f2e9f7c7754264cb22056c1cafcc90468bc407d0
SHA512

99e43e3d3f3ad96997a8f854248ef908a8b929245b26394ff91f99bbe8861bb15c01fbdeed860ca5dc9c7fd38ecb1c1b871428d9f7836608f708cf75a1683cb2
SSDEEP

12288:GOWH2dhu7Lb7n153R3erpyhy0uiAH1E020zVc3mAN2d9G2246At1O/cmdkp:GOTnu7PD153R3erpyhy0kVEMc2AkXG2m

Score

10^/10

djvu vidar 19 discovery persistence ransomware spyware stealer

Malware Config

Extracted

Family

djvu

C2

http://jiqaz.com/test2/get.php

Attributes

extension
.ioqa
offline_id
O5Ml6uMfuo0gYusk48e0q49EQlFERyL5eSVQmVt1
payload_url
http://uaery.top/dl/build2.exe
http://jiqaz.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-vdhH9Qcpjj Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: support@freshmail.top Reserve e-mail address to contact us: datarestorehelp@airmail.cc Your personal ID: 0650JOsie

rsa_pubkey.plain

Extracted

Family

vidar

Version

2.6

Botnet

19

Attributes

profile_id
19

Targets

- Target
  
  5e4de4ccd5d68a636fba5bc5f2e9f7c7754264cb22056c1cafcc90468bc407d0
- Size
  
  670KB
- MD5
  
  f1da1e2b22c8a7eca0e21b666657775b
- SHA1
  
  5741175faa484bd49f4a0bed49261a9724aa19a4
- SHA256
  
  5e4de4ccd5d68a636fba5bc5f2e9f7c7754264cb22056c1cafcc90468bc407d0
- SHA512
  
  99e43e3d3f3ad96997a8f854248ef908a8b929245b26394ff91f99bbe8861bb15c01fbdeed860ca5dc9c7fd38ecb1c1b871428d9f7836608f708cf75a1683cb2
- SSDEEP
  
  12288:GOWH2dhu7Lb7n153R3erpyhy0uiAH1E020zVc3mAN2d9G2246At1O/cmdkp:GOTnu7PD153R3erpyhy0kVEMc2AkXG2m
Score

10^/10

djvu vidar 19 discovery persistence ransomware spyware stealer
- Detected Djvu ransomware
- Djvu Ransomware
  Ransomware which is a variant of the STOP family.
  ransomware djvu
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1