djvu | f229887091f43e1d1f65606416a647a69a06446c120c4bf9c14b4660d0ba313b

General

Target

archive-020324-01_03_07.7z
Size

3.2MB
Sample

240302-rkjp5see24
MD5

dbd4c8abf1e774cea2e0373b77a7405d
SHA1

7097101aa40e2160e9ad1449061c0a6abdd9d7b0
SHA256

f229887091f43e1d1f65606416a647a69a06446c120c4bf9c14b4660d0ba313b
SHA512

7525ce2184948a6f3c90f60363d2f76bd2eabd0539ef74af27ad02e4fe7b6d9bb48d5dbae0d7a2b9984ca24dfe5b0a8df30f420a056b98b41c3c9b0caf04bb15
SSDEEP

98304:TVfsI8tS5hSIiJcXBfI4TMgz5v5Tr0yjPtH:OI8EvSIiJyjTZ9RTQS1H

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Extracted

Family

smokeloader

Version

2022

C2

http://selebration17io.io/index.php

http://vacantion18ffeu.cc/index.php

http://valarioulinity1.net/index.php

http://buriatiarutuhuob.net/index.php

http://cassiosssionunu.me/index.php

http://sulugilioiu19.net/index.php

http://goodfooggooftool.net/index.php

rc4.i32

Extracted

Family

djvu

C2

http://habrafa.com/test2/get.php

Attributes

extension
.wiaw
offline_id
4p0Nzrg1q0ND5of5Gtp2UBjthSXuE8VxnMrd4vt1
payload_url
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://wetransfer.com/downloads/ace9dcf133a3c07499672522e2c6bd3a20240301114053/77eeff Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: support@freshingmail.top Reserve e-mail address to contact us: datarestorehelpyou@airmail.cc Your personal ID: 0854ASdw

rsa_pubkey.plain

Extracted

Family

risepro

C2

193.233.132.49:50500

193.233.132.67:50500

193.233.132.62

Extracted

Family

vidar

Version

8

Botnet

438c7562661d92141bb0adbe01c2fc5f

C2

https://steamcommunity.com/profiles/76561199644883218

https://t.me/neoschats

Attributes

profile_id_v2
438c7562661d92141bb0adbe01c2fc5f
user_agent
Mozilla/5.0 (Linux; Android 11; M2102J20SG) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.99 Mobile Safari/537.36 EdgA/97.0.1072.78

Targets

- Target
  
  hash.bin
- Size
  
  176KB
- MD5
  
  4f0083cc81be49bc41651c385d3a8e4c
- SHA1
  
  b6dafbbeff6402a93848b9ce610f3a56c1b4ad3d
- SHA256
  
  0a326454e9523d8bc8e64fcc907ce7fee9d505da7d437f3447fc80a9e645b0a7
- SHA512
  
  6e210942e434a56a56e54e698ade8e397c328dae939dd0c9d70f99ef2f5e60a87589314f895e1782b68d736495ab3c7c3ce2c7f47776792e95380fa331cdddde
- SSDEEP
  
  3072:8zyHu+VQ+ZOTunDaFrK+OgX+kYZG14UYcKpnD2SWDDExe0b3RVqQ5dVrekmpuzUj:uyO+lZhDaFrzq3ZGmUYc8n6SWIbBdeOS
Score

3^/10
behavioral1
- Target
  
  setup.exe
- Size
  
  701.0MB
- MD5
  
  3f97f2e25057628aa1652a79339c2040
- SHA1
  
  86f81d05e21e8669cd58029e25fd11e34672c007
- SHA256
  
  c4edd5751beee612fe6c13877cd6c356474e4793eab2700dc6335efe94308acd
- SHA512
  
  dc700f9b49941678de747988b89a83fcf161547cc38102d785df589f95787142b216f7551f3b19094226e4ed83520efdd9908c8ea56c93ce6acbf65664c41508
- SSDEEP
  
  98304:QQrvrFhxwrq9XnYGKCTuNB7VeZnaEu+utQ3+APe:/HFhuq9oGKCwBVe91uV6
Score

10^/10

djvu glupteba risepro smokeloader vidar zgrat 438c7562661d92141bb0adbe01c2fc5f pub3 backdoor discovery dropper loader ransomware rat spyware stealer trojan
- Detect Vidar Stealer
  stealer
- Detect ZGRat V1
- Detected Djvu ransomware
- Djvu Ransomware
  Ransomware which is a variant of the STOP family.
  ransomware djvu
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Downloads MZ/PE file
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
behavioral2