General
- Target dc42dd95ce4017c9984f759a77788bec.exe
- Size 666KB
- Sample210926-hlxtqaeddq
- SHA256 f5928b4b67f399e11ece2de04588730b5891105ab72add45c7a9ff1fc3d961b7
Score
10/10
Malware Config
Targets
-
- Target dc42dd95ce4017c9984f759a77788bec.exe
- Size 666KB
- SHA256 f5928b4b67f399e11ece2de04588730b5891105ab72add45c7a9ff1fc3d961b7
Score10/10Detected Djvu ransomware
Djvu Ransomware
Ransomware which is a variant of the STOP family.
Vidar
Vidar is an infostealer based on Arkei stealer.
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
Vidar Stealer
Downloads MZ/PE file
Executes dropped EXE
Loads dropped DLL
Modifies file permissions
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Accesses 2FA software files, possible credential harvesting
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Suspicious use of SetThreadContext