djvu | ef69e77d706439dcbcb7f2d26857e171c9f1c56346a117b54cde2d0b0cd49728

General

Target

4754179f8d7da64352226d77af9d1bdf434b572a2a773f16d96d664cc7d2b404
Size

626KB
Sample

231101-tq18gsca65
MD5

bcdee7b4bbad171149e9eb5f73ba88a7
SHA1

3069dfcbf18708ae72a0c4d2a389b2558b9d460f
SHA256

ef69e77d706439dcbcb7f2d26857e171c9f1c56346a117b54cde2d0b0cd49728
SHA512

a8d571c3bdbf0ceae2d905beda74a84b7381d7ea64165406dc31961aa0594fa96101f6b605f26c7acd263a278721b54b4e672462fb0f4b0ea3cda6c286780bf8
SSDEEP

12288:MhfStKah7cnPqRGWcb/1o2p1qe5ci9cVki2fCuJoY6ji+ERXW:EfStKah7cnCGW2/1o2p1qcrfCHjhEs

Score

10^/10

Malware Config

Extracted

Family

djvu

C2

http://zexeq.com/test1/get.php

Attributes

extension
.ppvs
offline_id
phJtdHo970vyx7vwlYG00OakDR75RuJz7NXDArt1
payload_url
http://colisumy.com/dl/build2.exe

http://zexeq.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-eyUsqpKbFl Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0815JOsie

rsa_pubkey.plain

Targets

- Target
  
  4754179f8d7da64352226d77af9d1bdf434b572a2a773f16d96d664cc7d2b404
- Size
  
  685KB
- MD5
  
  1fb673645d2101b59debb53ffa81653d
- SHA1
  
  d2932942074cdad85a7eb9a9571a22183bf6697b
- SHA256
  
  4754179f8d7da64352226d77af9d1bdf434b572a2a773f16d96d664cc7d2b404
- SHA512
  
  8f8889c68801a8de8f04371112d86348d6d59577effd722c6d193b8f30f7c204e4e79dcf208e7c0d666cdc02407ffa7c9de29f78d0545ec1e52de8908c3d3074
- SSDEEP
  
  12288:yqxClOKad7cnfq1GWcb/7o2p1qI52K9+VkiqfouJCw4jiz3:bAOKad7cnUGW2/7o2p1q+Jfonj
Score

10^/10

djvu discovery persistence ransomware spyware stealer
- Detected Djvu ransomware
- Djvu Ransomware
  Ransomware which is a variant of the STOP family.
  ransomware djvu
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2