djvu | 92ccd0b6b6dbaa325a9081291a374e6a86f2ff57c408316916bc36b5477cd72f

General

Target
d50998a6f27fb031ce63ec433ac9f1c0.exe
Size 795KB
Sample220820-a4mgpscfdl
SHA256 92ccd0b6b6dbaa325a9081291a374e6a86f2ff57c408316916bc36b5477cd72f
MD5 d50998a6f27fb031ce63ec433ac9f1c0
SHA1 3157eb2c0319f3b21d7da8dbc4774753258b93ef
SHA512 3487ed81f506628cbe50f96244b6504ad5b323143e480a9488f78dd5a191d4e5f23d128d33804c906d506284c596ac37dceec1ee98baf04ad8083efcd2cee5c5
SSDEEP 24576:wWPL2cMXjZqpW7G6UWF8wS3rSdwMzeDY5:wpTZqk7tc3bSdfyDY5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

djvu

C2

http://acacaca.org/test1/get.php

Attributes

extension
.qqmt
offline_id
arwRSmitYZVDfxec0G8jyNLbXK8rKdnmN0jfDBt1
payload_url
http://rgyui.top/dl/build2.exe

http://acacaca.org/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-SLR8OOjitY Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0540tOidj

rsa_pubkey.plain

Targets

- Target
  d50998a6f27fb031ce63ec433ac9f1c0.exe
- Size 795KB
- SHA256 92ccd0b6b6dbaa325a9081291a374e6a86f2ff57c408316916bc36b5477cd72f
- MD5 d50998a6f27fb031ce63ec433ac9f1c0
- SHA1 3157eb2c0319f3b21d7da8dbc4774753258b93ef
- SHA512 3487ed81f506628cbe50f96244b6504ad5b323143e480a9488f78dd5a191d4e5f23d128d33804c906d506284c596ac37dceec1ee98baf04ad8083efcd2cee5c5
- SSDEEP 24576:wWPL2cMXjZqpW7G6UWF8wS3rSdwMzeDY5:wpTZqk7tc3bSdfyDY5
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

djvu discovery persistence ransomware spyware stealer
- Detected Djvu ransomware
- Djvu Ransomware
  Ransomware which is a variant of the STOP family.
  ransomware djvu
- Downloads MZ/PE file
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2