djvu | ad09e6469ff6f776f4dda5c3bfd3ef3bda8d3e66a0f3656c19a003428ee43db7

General

Target

ad09e6469ff6f776f4dda5c3bfd3ef3bda8d3e66a0f3656c19a003428ee43db7
Size

174KB
Sample

240201-fk2p6sdfgk
MD5

20d467f075750c049e83ec92d895e531
SHA1

d1dfbb732c9b883acd7cba5b4db5690d504dc885
SHA256

ad09e6469ff6f776f4dda5c3bfd3ef3bda8d3e66a0f3656c19a003428ee43db7
SHA512

10f4bb6cfa937e041edb9e523ae52bf8abc51e13012dd805907b22eb0295a79c3bebe5302cf45fa01a366a354143603577bd259934395d208ae6266448e870a6
SSDEEP

3072:OGFLyRU39oZ2XmegMW1mMj0jPWg34RxbA13:7LyRKoZ2XmJt1ijPebA

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

C2

http://trad-einmyus.com/index.php

http://tradein-myus.com/index.php

http://trade-inmyus.com/index.php

rc4.i32

Extracted

Family

djvu

C2

http://habrafa.com/test1/get.php

Attributes

extension
.cdcc
offline_id
LBxKKiegnAy53rpqH3Pj2j46vwldiEt9kqHSuMt1
payload_url
http://brusuax.com/dl/build2.exe

http://habrafa.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-iVcrVFVRqu Price of private key and decrypt software is $1999. Discount 50% available if you contact us first 72 hours, that's price for you is $999. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0846ASdw

rsa_pubkey.plain

Extracted

Family

vidar

Version

7.6

Botnet

1b9d7ec5a25ab9d78c31777a0016a097

C2

https://t.me/tvrugrats

https://steamcommunity.com/profiles/76561199627279110

Attributes

profile_id_v2
1b9d7ec5a25ab9d78c31777a0016a097

Extracted

Family

risepro

C2

193.233.132.62:50500

Targets

- Target
  
  ad09e6469ff6f776f4dda5c3bfd3ef3bda8d3e66a0f3656c19a003428ee43db7
- Size
  
  174KB
- MD5
  
  20d467f075750c049e83ec92d895e531
- SHA1
  
  d1dfbb732c9b883acd7cba5b4db5690d504dc885
- SHA256
  
  ad09e6469ff6f776f4dda5c3bfd3ef3bda8d3e66a0f3656c19a003428ee43db7
- SHA512
  
  10f4bb6cfa937e041edb9e523ae52bf8abc51e13012dd805907b22eb0295a79c3bebe5302cf45fa01a366a354143603577bd259934395d208ae6266448e870a6
- SSDEEP
  
  3072:OGFLyRU39oZ2XmegMW1mMj0jPWg34RxbA13:7LyRKoZ2XmJt1ijPebA
Score

10^/10

djvu risepro smokeloader socks5systemz vidar 1b9d7ec5a25ab9d78c31777a0016a097 pub1 backdoor botnet discovery evasion persistence ransomware stealer trojan
- Detect Socks5Systemz Payload
- Detect Vidar Stealer
  stealer
- Detected Djvu ransomware
- Djvu Ransomware
  Ransomware which is a variant of the STOP family.
  ransomware djvu
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Socks5Systemz
  Socks5Systemz is a botnet written in C++.
  botnet socks5systemz
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Downloads MZ/PE file
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Deletes itself
- Executes dropped EXE
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Loads dropped DLL
- Modifies file permissions
  discovery
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2