djvu | 498e8a5e4f3d86aa89f77d725fb8386199dec3cde8f2c35bda2c346d831d8268

General

Target

75f895c5ea6da52121cb6b32685a6fedb231dda44cb1d086442a9ea8ff78532a.zip
Size

628KB
Sample

230321-r5ddvsde7s
MD5

c664d466ba75ea288e8a0f943c23781d
SHA1

56846ff5ccdf7120318208c39607a5856ea8f46c
SHA256

498e8a5e4f3d86aa89f77d725fb8386199dec3cde8f2c35bda2c346d831d8268
SHA512

4ab995cca8ee5581acd6983eb52e66d6e5c0f4dba7afec54294975de90dafe33b7ca29c1f521c6e1a182ebb3fa7d6c3f1810c7b1d8db4bf7fdb0d38c09e4748a
SSDEEP

12288:WtPB1+P/o0MW4jVaAhpjDFr66NMNC9qk7MD9JArvv8rawK:mBkojRRLNNMS3S9JW8c

Score

10^/10

Malware Config

Extracted

Family

djvu

C2

http://zexeq.com/test2/get.php

Attributes

extension
.dapo
offline_id
8EM6M9LqEzIk18qaQ87WiPQ1u84RRdej5V1ovht1
payload_url
http://uaery.top/dl/build2.exe

http://zexeq.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-vbVkogQdu2 Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0667JOsie

rsa_pubkey.plain

Extracted

Family

vidar

C2

https://steamcommunity.com/profiles/76561199472266392

Extracted

Family

vidar

Version

�^

C2

https://steamcommunity.com/profiles/76561199472266392

Targets

- Target
  
  75f895c5ea6da52121cb6b32685a6fedb231dda44cb1d086442a9ea8ff78532a.exe
- Size
  
  685KB
- MD5
  
  aa4a88959e7d106e6f5842595e2861f4
- SHA1
  
  14ebd62040f13496182106d2c70d7e0a88c96d9f
- SHA256
  
  75f895c5ea6da52121cb6b32685a6fedb231dda44cb1d086442a9ea8ff78532a
- SHA512
  
  e450854e8353b646c5c7c847f6d314cbda6b7804e13445baa9b87580ed338f22a59ea4962a161ca18af01eaa9884b056a8cb0c33804d0fe3579cc47e19088c0f
- SSDEEP
  
  12288:4hm6CJSZeOO3yoJwRyPl5POMPdtuK4MivrQnR7z228DaC:ibO3yoJ4yPl5mSsr0h228DaC
Score

10^/10

djvu discovery persistence ransomware vidar spyware stealer
- Detected Djvu ransomware
- Djvu Ransomware
  Ransomware which is a variant of the STOP family.
  ransomware djvu
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2