Overview

overview

10

Static

static

3

ec3f1269bb...18.exe

windows7-x64

10

ec3f1269bb...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ec3f1269bb1442106d93361f7bde2b43_JaffaCakes118

  • Size

    854KB

  • Sample

    240919-1kq9nasemq

  • MD5

    ec3f1269bb1442106d93361f7bde2b43

  • SHA1

    3fe8e6d37aaac065c158bdd8f29b8d9598167dcb

  • SHA256

    c8c90476499981166b84df46c15871b2cce74ab65d1e9a6d2dad660b06f80143

  • SHA512

    96c2c62e0a864c6da1646ef4436b77b1e22cd7d5b1bb08d34d234d6d83c2f610c0d0d8b5f99d3f6821b3aa1c5c2cd72374cd7144bd6a87b10ddbb5fedfca9cc3

  • SSDEEP

    24576:YIHbAiVDPXfiDrJBaWC8sTTmhi/Gw41YeI0bAiOe5dH:YoVDCJBsTyi+wRIp

Score
10/10
djvudiscoverypersistenceransomware

Malware Config

Extracted

Family

djvu

C2

http://asvb.top/nddddhsspen6/get.php

Attributes
  • extension

    .mppq

  • offline_id

    EiZX0rbexOkp612YCVCqdSZE3kObdqTVIZD2j9t1

  • payload_url

    http://asvb.top/files/penelop/updatewin1.exe

    http://asvb.top/files/penelop/updatewin2.exe

    http://asvb.top/files/penelop/updatewin.exe

    http://asvb.top/files/penelop/3.exe

    http://asvb.top/files/penelop/4.exe

    http://asvb.top/files/penelop/5.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-A2MIyY0Wsw Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0302ewgfDd

rsa_pubkey.plain

Targets

    • Target

      ec3f1269bb1442106d93361f7bde2b43_JaffaCakes118

    • Size

      854KB

    • MD5

      ec3f1269bb1442106d93361f7bde2b43

    • SHA1

      3fe8e6d37aaac065c158bdd8f29b8d9598167dcb

    • SHA256

      c8c90476499981166b84df46c15871b2cce74ab65d1e9a6d2dad660b06f80143

    • SHA512

      96c2c62e0a864c6da1646ef4436b77b1e22cd7d5b1bb08d34d234d6d83c2f610c0d0d8b5f99d3f6821b3aa1c5c2cd72374cd7144bd6a87b10ddbb5fedfca9cc3

    • SSDEEP

      24576:YIHbAiVDPXfiDrJBaWC8sTTmhi/Gw41YeI0bAiOe5dH:YoVDCJBsTyi+wRIp

    Score
    10/10
    djvudiscoverypersistenceransomware

    • Detected Djvu ransomware

    • Djvu Ransomware

      Ransomware which is a variant of the STOP family.

      ransomwaredjvu

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Modifies file permissions

      discovery

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks