djvu | ab27cd1f7b8146210ab69d0d011463e9a9d7d2ee40930452744a882b1b9b13c5

General

Target

ab27cd1f7b8146210ab69d0d011463e9a9d7d2ee40930452744a882b1b9b13c5
Size

833KB
Sample

230907-ttya1abf3x
MD5

b7d6e0d4e7c4103645cb79133537e737
SHA1

411f5be09a1ecce1ebb26ff639f79d55f190f1eb
SHA256

ab27cd1f7b8146210ab69d0d011463e9a9d7d2ee40930452744a882b1b9b13c5
SHA512

1c0c260642a445c3549ab6f1f072e0a5ef3ad9afa5c543b7c76b87cee940973573ace561d9e9fae82440dc1d0309f0d3d9890be357dff7aca6182ad687f5b08f
SSDEEP

12288:WPXO8AW1c6UmYnp/vLHSzs5RIYfmb9elhuwNqMAiR8xX:WvOU1c7np/vLHCs5RIY09el8wNbp4X

Score

10^/10

Malware Config

Extracted

Family

djvu

C2

http://zexeq.com/test1/get.php

Attributes

extension
.hgkd
offline_id
Nk8w6hJsuGrE3s2SYWM3ehMUHvjgVRqqgX84dat1
payload_url
http://colisumy.com/dl/build2.exe

http://zexeq.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-iTbDHY13BX Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0778JOsie

rsa_pubkey.plain

Extracted

Family

vidar

Version

5.5

Botnet

b8051b8228ebec240e80eed1f06471da

C2

https://t.me/macstoc

https://steamcommunity.com/profiles/76561199548518734

Attributes

profile_id_v2
b8051b8228ebec240e80eed1f06471da

Targets

- Target
  
  ab27cd1f7b8146210ab69d0d011463e9a9d7d2ee40930452744a882b1b9b13c5
- Size
  
  833KB
- MD5
  
  b7d6e0d4e7c4103645cb79133537e737
- SHA1
  
  411f5be09a1ecce1ebb26ff639f79d55f190f1eb
- SHA256
  
  ab27cd1f7b8146210ab69d0d011463e9a9d7d2ee40930452744a882b1b9b13c5
- SHA512
  
  1c0c260642a445c3549ab6f1f072e0a5ef3ad9afa5c543b7c76b87cee940973573ace561d9e9fae82440dc1d0309f0d3d9890be357dff7aca6182ad687f5b08f
- SSDEEP
  
  12288:WPXO8AW1c6UmYnp/vLHSzs5RIYfmb9elhuwNqMAiR8xX:WvOU1c7np/vLHCs5RIY09el8wNbp4X
Score

10^/10

djvu vidar b8051b8228ebec240e80eed1f06471da discovery persistence ransomware spyware stealer
- Detected Djvu ransomware
- Djvu Ransomware
  Ransomware which is a variant of the STOP family.
  ransomware djvu
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1