Analysis
-
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
05-01-2024 12:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20231215-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
file.exe
-
Size
780KB
-
MD5
ee4df7e66fae1dd2dd4184a582efe89b
-
SHA1
af24b93484d5cc961dd9fa2c6da0229e92340386
-
SHA256
fc033161f27b2a779ed33cd69173d269b141414ad57ea833fbe2e02f2503540d
-
SHA512
5b4521cbe88f09d8a385608d88ea8e6704a9f62c63bb228352d37870282e76a4e2d4592df32dd64d1e15f9e038fdf1fe392c97ba3b2e185d96a06931e95ec460
-
SSDEEP
24576:0WnBJHfIqAaLA5/1m6sqB1V6DFvcNmAbJ:rJ/GF5/7XuvcNmeJ
Score
10/10
Malware Config
Signatures
-
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 31 api.2ip.ua 8 api.2ip.ua 10 api.2ip.ua