djvu | e3683f1a58054c1166a94d5758848ed053777c7dc575a7af69c938b39f204eb5

General

Target

file_release_4.rar
Size

14.6MB
Sample

240223-vmbzvseg4s
MD5

b53f9821429a957dbb940190b929208f
SHA1

61dea662a6608ba8239d7e0f459cd72640f0cd58
SHA256

e3683f1a58054c1166a94d5758848ed053777c7dc575a7af69c938b39f204eb5
SHA512

13c5fa541964d8d4bb8ccd6e35ace5a82ffc71134a439d08e19b1043acc138bf01634f32177c75690d1b401189490187380cea5d0af13892c23d23e654058278
SSDEEP

393216:UCmEcAypbKLd/OXCRmXTaDLhV5MVlW5yPGKHIo+vDHQEoSs2X6YhDpd4:GEcAGgdw7XTaVv5yzUHQzSs2XPhDpm

Score

10^/10

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.24

Attributes

url_path
/f993692117a3fda2.php

Extracted

Family

risepro

C2

193.233.132.62

193.233.132.67:50500

Extracted

Family

smokeloader

Version

2022

C2

http://selebration17io.io/index.php

http://vacantion18ffeu.cc/index.php

http://valarioulinity1.net/index.php

http://buriatiarutuhuob.net/index.php

http://cassiosssionunu.me/index.php

http://sulugilioiu19.net/index.php

http://goodfooggooftool.net/index.php

rc4.i32

Extracted

Family

smokeloader

Botnet

pub3

Extracted

Family

djvu

C2

http://habrafa.com/test2/get.php

Attributes

extension
.lkfr
offline_id
OxV6DGl22io8sqMOW1zCCOlzPiv4f1Vqzw7Y8zt1
payload_url
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://we.tl/t-uNdL2KHHdy Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0852ASdw

rsa_pubkey.plain

Targets

- Target
  
  ICQLiteShell.dll
- Size
  
  56KB
- MD5
  
  05e61539b8917fca37c03756bbdd043d
- SHA1
  
  5a72e0e528260de0ea5b34badb9e5f9873cb4245
- SHA256
  
  515c8e0b93f0fef15da3e2573ad92b7e7840374140e65e5d73df63d8e22cb3e8
- SHA512
  
  565d57783e6044d6e7e2026c79dbd897e637c5e1d96e7930dc704ef2b6d801669b38f0c26382f00e67e26668439274941e937a0ade54666de50b5d84f6da7e97
- SSDEEP
  
  768:YEGJ9blT7XZBSbHwJU+tGR0KZUyGKZ0ZgwmF1+3UVambg:YEGJ9bln5o0KZjGKZ0Z1mF1+3UVayg
Score

1^/10
behavioral1
- Target
  
  ICQRT.dll
- Size
  
  32KB
- MD5
  
  1aedcb8994d6ad63ef9dcb87016e028f
- SHA1
  
  f5b891aa15c6353b681bdb7e2d96c6ac8a5f02d7
- SHA256
  
  53e1f40144bab532f9700ff25ec3d5c6a39784a98e17fada583b4ee6d9dd5dbc
- SHA512
  
  89c0f408797c4d78afc52335a9e162345c614e1e419f55487cb358c14f7a69ec82138a7e6250be3133233386ba3659d241e80ab63c9b972b6c8b26b0424cb0c8
- SSDEEP
  
  384:+qtTeds1tkMAp4TxCW9su5UcSu93ggoXUQQIPGEANHl:FTedukelF95RjQUUPpANHl
Score

3^/10
behavioral2
- Target
  
  Language/WinRar.exe
- Size
  
  3.2MB
- MD5
  
  b66dec691784f00061bc43e62030c343
- SHA1
  
  779d947d41efafc2995878e56e213411de8fb4cf
- SHA256
  
  26b40c79356453c60498772423f99384a3d24dd2d0662d215506768cb9c58370
- SHA512
  
  6a89bd581baf372f07e76a3378e6f6eb29cac2e4981a7f0affb4101153407cadfce9f1b6b28d5a003f7d4039577029b2ec6ebcfd58e55288e056614fb03f8ba3
- SSDEEP
  
  98304:lJXOBfK92HbAw0CNB3kJElzNsy8vGUvfCo3ABH43:lJ192HbAXCvDlzNsy8vGUyo3AB8
Score

1^/10
behavioral3
- Target
  
  LiteRes.dll
- Size
  
  735KB
- MD5
  
  88962410244bc5c03482b82a7e3cb5e1
- SHA1
  
  4622be2d3deda305bf0a16c0e01bc2ecf9d56fad
- SHA256
  
  afa884228afc5c05f4b47e90b6de42854d5a8886ec5ed15a253faeccd5309036
- SHA512
  
  c6e7667f91c1439e33ad4d9e2052b7c9fcc3ca2c7688d9e2bc0550b71a5762b76aa76427331df0217429d9bd984925997c7a8d009f25e44e2776c5ce7cc9d98c
- SSDEEP
  
  6144:x9Ej/jb82/HRoXO1q2pt+Mc1/PDPicsUzM+gYESoE/wOuET8F62bH5vnGfcJvl+b:fqptG/PDPo0no2Iq8F6CHBTWqU
Score

1^/10
behavioral4
- Target
  
  LiteSkinUtils.dll
- Size
  
  48KB
- MD5
  
  059d94e8944eca4056e92d60f7044f14
- SHA1
  
  46a491abbbb434b6a1a2a1b1a793d24acd1d6c4b
- SHA256
  
  9fa7cacb5730faacc2b17d735c45ee1370130d863c3366d08ec013afe648bfa6
- SHA512
  
  0f45fe8d5e80a8fabf9a1fd2a3f69b2c4ebb19f5ffdcfec6d17670f5577d5855378023a91988e0855c4bd85c9b2cc80375c3a0acb1d7a701aff32e9e78347902
- SSDEEP
  
  768:FPGeoWyuTx6vrP/zAdWQS6Z9CSKh64crVKTl9inMUAK:tGeJxIHepSKzjVK9iMUAK
Score

3^/10
behavioral5
- Target
  
  setup.exe
- Size
  
  717.0MB
- MD5
  
  c3c8543919bbd677773e9bb97e12eb62
- SHA1
  
  dbce58ffd5606a2aa99983b1359bd509ffe14248
- SHA256
  
  aafb7f16f653a0d189981974bc16214fea9e9ab8ba6ea13f0e4d389d2bc97f12
- SHA512
  
  ba6d954d49fd76084f436cd54e63104ffbd9d655c6fb665a4206863576404f972035d828a917d81125da000ee48f8d63394e0b6684a01eccfbc9697df3b8d7f6
- SSDEEP
  
  98304:3Y6P2L8j12IU+fHyGTQVobss/lHGxeAo:IRw2I7Q+mxe
Score

10^/10

djvu risepro smokeloader stealc zgrat pub3 backdoor discovery evasion ransomware rat spyware stealer themida trojan
- Detect ZGRat V1
- Detected Djvu ransomware
- Djvu Ransomware
  Ransomware which is a variant of the STOP family.
  ransomware djvu
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Downloads MZ/PE file
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Checks whether UAC is enabled
  evasion trojan
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral6