Overview

overview

10

Static

static

3

hash.bin

windows11-21h2-x64

3

setup.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    archive-020324-01_03_07.7z

  • Size

    3.2MB

  • Sample

    240302-rkjp5see24

  • MD5

    dbd4c8abf1e774cea2e0373b77a7405d

  • SHA1

    7097101aa40e2160e9ad1449061c0a6abdd9d7b0

  • SHA256

    f229887091f43e1d1f65606416a647a69a06446c120c4bf9c14b4660d0ba313b

  • SHA512

    7525ce2184948a6f3c90f60363d2f76bd2eabd0539ef74af27ad02e4fe7b6d9bb48d5dbae0d7a2b9984ca24dfe5b0a8df30f420a056b98b41c3c9b0caf04bb15

  • SSDEEP

    98304:TVfsI8tS5hSIiJcXBfI4TMgz5v5Tr0yjPtH:OI8EvSIiJyjTZ9RTQS1H

Score
10/10
djvugluptebariseprosmokeloadervidarzgrat438c7562661d92141bb0adbe01c2fc5fpub3backdoordiscoverydropperloaderransomwareratspywarestealertrojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Extracted

Family

smokeloader

Version

2022

C2

http://selebration17io.io/index.php

http://vacantion18ffeu.cc/index.php

http://valarioulinity1.net/index.php

http://buriatiarutuhuob.net/index.php

http://cassiosssionunu.me/index.php

http://sulugilioiu19.net/index.php

http://goodfooggooftool.net/index.php
rc4.i32
rc4.i32

Extracted

Family

djvu

C2

http://habrafa.com/test2/get.php

Attributes
  • extension

    .wiaw

  • offline_id

    4p0Nzrg1q0ND5of5Gtp2UBjthSXuE8VxnMrd4vt1

  • payload_url

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://wetransfer.com/downloads/ace9dcf133a3c07499672522e2c6bd3a20240301114053/77eeff Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0854ASdw

rsa_pubkey.plain

Extracted

Family

risepro

C2

193.233.132.49:50500

193.233.132.67:50500

193.233.132.62

Extracted

Family

vidar

Version

8

Botnet

438c7562661d92141bb0adbe01c2fc5f

C2

https://steamcommunity.com/profiles/76561199644883218

https://t.me/neoschats
Attributes
  • profile_id_v2

    438c7562661d92141bb0adbe01c2fc5f

  • user_agent

    Mozilla/5.0 (Linux; Android 11; M2102J20SG) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.99 Mobile Safari/537.36 EdgA/97.0.1072.78

Targets

    • Target

      hash.bin

    • Size

      176KB

    • MD5

      4f0083cc81be49bc41651c385d3a8e4c

    • SHA1

      b6dafbbeff6402a93848b9ce610f3a56c1b4ad3d

    • SHA256

      0a326454e9523d8bc8e64fcc907ce7fee9d505da7d437f3447fc80a9e645b0a7

    • SHA512

      6e210942e434a56a56e54e698ade8e397c328dae939dd0c9d70f99ef2f5e60a87589314f895e1782b68d736495ab3c7c3ce2c7f47776792e95380fa331cdddde

    • SSDEEP

      3072:8zyHu+VQ+ZOTunDaFrK+OgX+kYZG14UYcKpnD2SWDDExe0b3RVqQ5dVrekmpuzUj:uyO+lZhDaFrzq3ZGmUYc8n6SWIbBdeOS

    Score
    3/10
    behavioral1

    • Target

      setup.exe

    • Size

      701.0MB

    • MD5

      3f97f2e25057628aa1652a79339c2040

    • SHA1

      86f81d05e21e8669cd58029e25fd11e34672c007

    • SHA256

      c4edd5751beee612fe6c13877cd6c356474e4793eab2700dc6335efe94308acd

    • SHA512

      dc700f9b49941678de747988b89a83fcf161547cc38102d785df589f95787142b216f7551f3b19094226e4ed83520efdd9908c8ea56c93ce6acbf65664c41508

    • SSDEEP

      98304:QQrvrFhxwrq9XnYGKCTuNB7VeZnaEu+utQ3+APe:/HFhuq9oGKCwBVe91uV6

    Score
    10/10
    djvugluptebariseprosmokeloadervidarzgrat438c7562661d92141bb0adbe01c2fc5fpub3backdoordiscoverydropperloaderransomwareratspywarestealertrojan

    • Detect Vidar Stealer

      stealer

    • Detect ZGRat V1

    • Detected Djvu ransomware

    • Djvu Ransomware

      Ransomware which is a variant of the STOP family.

      ransomwaredjvu

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba payload

    • RisePro

      RisePro stealer is an infostealer distributed by PrivateLoader.

      stealerrisepro

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Downloads MZ/PE file

    • Modifies file permissions

      discovery

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral2

MITRE ATT&CK Enterprise v15

Tasks