Overview

overview

10

Static

static

3

5af0f5b0ba...de.exe

windows7-x64

10

5af0f5b0ba...de.exe

windows10-2004-x64

10

MihalyLeve...g.docx

windows7-x64

3

MihalyLeve...g.docx

windows10-2004-x64

1

Mihály Le...17.pdf

windows7-x64

3

Mihály Le...17.pdf

windows10-2004-x64

3

Mérések ...2.xlsx

windows7-x64

3

Mérések ...2.xlsx

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    43df4500189c83808a119ee66ee8b77488619eed618316d937461e602cdc156d.zip

  • Size

    1.5MB

  • Sample

    250325-zv99vasvhz

  • MD5

    ebf6868f78af8611dbb4172f8615198e

  • SHA1

    3b646653eeb0abd8f9058c262a4e31c11018077d

  • SHA256

    43df4500189c83808a119ee66ee8b77488619eed618316d937461e602cdc156d

  • SHA512

    0188d8680fcf50c2786365882f2408e6ffe84eee6cead4b5e2e7e34b4b1d57233a0de7d6965795531fc674c2d89485ffa7fc7098c6d6cbdd29d01091928c9fe8

  • SSDEEP

    49152:fjwJSo17q3UZwSwJXZpT+686RwuEnduAgnWJjShYU2n:soo5q3UZwZJXZp86EUW5c2n

Score
10/10
djvudiscoverypersistenceransomware

Malware Config

Extracted

Family

djvu

C2

http://vjsi.top/nddddhsspen6/get.php

Attributes
  • extension

    .nobu

  • offline_id

    YEy9XNzIuKSJ9bVw38Nvhm3G1ggaNsF2HShNYFt1

  • payload_url

    http://vjsi.top/files/penelop/updatewin1.exe

    http://vjsi.top/files/penelop/updatewin2.exe

    http://vjsi.top/files/penelop/updatewin.exe

    http://vjsi.top/files/penelop/3.exe

    http://vjsi.top/files/penelop/4.exe

    http://vjsi.top/files/penelop/5.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-j3hj0RjttJ Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0269Orjk

rsa_pubkey.plain

Extracted

Path

F:\_readme.txt

Family

djvu

Ransom Note
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-j3hj0RjttJ Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0269OrjkYEy9XNzIuKSJ9bVw38Nvhm3G1ggaNsF2HShNYFt1
URLs

https://we.tl/t-j3hj0RjttJ

Targets

    • Target

      5af0f5b0bada5b7aaa681eddebc47734267af06eb39610590a625315f449d4de.bin

    • Size

      710KB

    • MD5

      f8ef98bbaff6ac82dacde20ee90bfa55

    • SHA1

      65761535a352bfeece2a708eaf6a329fc544872e

    • SHA256

      5af0f5b0bada5b7aaa681eddebc47734267af06eb39610590a625315f449d4de

    • SHA512

      21618fa54b094fa37deeed5ef7e2fba6da13e57dc36119a5fe502e855a81fa5c9530b45a8be1a0333c8aa0ee862eb07f5c4af1c622b79bbfa8b3e4a3285790dd

    • SSDEEP

      12288:brr/q8UczPPvwkvhfloghhbUkxMEpLJ+GXJwvnvO2BfYV3yXL2QCd:bIqwkpf6gUAGO21O3yCQA

    Score
    10/10
    djvudiscoverypersistenceransomware

    • Detected Djvu ransomware

    • Djvu Ransomware

      Ransomware which is a variant of the STOP family.

      ransomwaredjvu

    • Djvu family

      djvu

    • Renames multiple (169) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Modifies file permissions

      discovery

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

    • Target

      MihalyLevente_Vezetotrening.docx

    • Size

      18KB

    • MD5

      b443528e516923416423f8ec45675334

    • SHA1

      0682c887258d00b4e9a32be446e3d51d2270c2b4

    • SHA256

      4e1fc557e9d03f5f26f51504e9eafd71da654ebeec958a32991ce3d4feda5500

    • SHA512

      41e9d74a2f1229547ab747fd3a670f4728f3a3f23105f91272c28d3edb860a13d744f73be4b0f93f2ac4f84f96a50d6847af935cd0495a3ce1676dbea44ca4d8

    • SSDEEP

      384:aNOe++wwZpYarc42VAxCSYYsDnw4NaXqKTbhw8FSXNvQbYgjW:TedBcPAxRUnmaQhP0dvFx

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      Mihály Levente_Tartalmi kivonat_2017.pdf

    • Size

      393KB

    • MD5

      0c45e66bfc426204973a46d445390cba

    • SHA1

      dc19b9cdd3f6610e4b9aa6dbf98f9d4005a94d47

    • SHA256

      06abc5656494da7c43fecd8f35fe21d9ea20663e7639717e8adf631ee3c15207

    • SHA512

      2d0de5d667829a1b72331c532b4f38fedae33f99f35e8589b5f9ef2185b34af66f65976f9686995e2f7c2b2cdafe823b0a372ceecd8952e9de7ef0ef477cb4e8

    • SSDEEP

      12288:bShkqN0cQbIy6hVh2eOaH8anOvZ0ox/gV1xOvtP0+sw:bShjZ4ZGhcAYRB4181PJ

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      Mérések Co2 lézeres kezelésre_v2.xlsx

    • Size

      47KB

    • MD5

      1f6317291ab6d7789947860ed92885d1

    • SHA1

      bf7eac4d1e74aefa63f8104d541dd98f3e7a9e47

    • SHA256

      a5fe7ab849f57ddbc0c03c783abe786caa21b174e6744bb87330217f0866b132

    • SHA512

      46588d572787dbe0e4075764462cce4c16ccea54db6f088b292cc5256dcf76fd6e9112f584ad87b51f07d24f0e2d53ef24a7c335baf9d6c81b392fefc10559c7

    • SSDEEP

      768:TPazaRvYNB1GrrfMQJ48HIz2FAIZ4kXS2PDjVr/N51M9OofTLHVqFxa0eSiT:WzadYT1MoRCIzEewl/NTMoWzVqFcbT

    Score
    3/10
    discovery
    behavioral7behavioral8

MITRE ATT&CK Enterprise v15

Tasks