MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 04830b32044eed19c43dce1d544c530532d60114d64970fafb7dcfb0f37f58c9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Stop


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 04830b32044eed19c43dce1d544c530532d60114d64970fafb7dcfb0f37f58c9
SHA3-384 hash: 92cf0a2ba826abe451b8d7ae844fd2c6cfa59b166bec5be194cf3b7ed2b4c5289329aa6b40623cfac0a5ff043deb373f
SHA1 hash: fbfb7751073b51d2c4740c06c29ba14d66a9c913
MD5 hash: 33af34cfaf8738b575cdc9e76b053ca5
humanhash: ack-indigo-two-two
File name:04830b32044eed19c43dce1d544c530532d60114d64970fafb7dcfb0f37f58c9
Download: download sample
Signature Stop
Create hunting rule
File size:766'976 bytes
First seen:2021-09-22 13:20:54 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 019bced73b51911db702af2d47c34cb7 (6 x RaccoonStealer, 2 x ArkeiStealer, 2 x Stop)
ssdeep 12288:12k+akBIApr/CLHaD96SB9pStmipHQxFgrKcZ3ahcTtbFNN3eHAywmBai:16DfeH5ApStmipwxFwKcMGTtb/dywmh
Threatray 675 similar samples on MalwareBazaar
TLSH T111F412017590C372D27741B08B71C3F16A76B922A9709B9B275BA37EEF203C13E29746
File icon (PE):PE icon
dhash icon 367a7c7d727e6e76 (1 x RaccoonStealer, 1 x Stop)
Reporter JAMESWT_WT
Tags:exe Stop

Intelligence

File Origin
# of uploads :
1
# of downloads :
173
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
04830b32044eed19c43dce1d544c530532d60114d64970fafb7dcfb0f37f58c9
Verdict:
Suspicious activity
Analysis date:
2021-09-22 14:06:18 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/ea6b2523-71c9-477f-9a20-e432eb19f6ce

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
STOP
Create hunting rule
Link:
https://www.capesandbox.com/analysis/190261/
Detection(s):
Win.Packed.Generic-9895572-0
Create hunting rule

Win.Packed.Generic-9895679-0
Create hunting rule

Malware family:
STOP Ransomware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c939966e-0d59-4ae3-add3-531fe312424c
Result
Threat name:
Djvu
Create hunting rule
Detection:
malicious
Classification:
rans.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/855797
Signature
Antivirus detection for URL or domain
Contains functionality to inject code into remote processes
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found ransom note / readme
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies existing user documents (likely ransomware behavior)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected Djvu Ransomware
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 488228 Sample: BVPM6O60dD Startdate: 22/09/2021 Architecture: WINDOWS Score: 100 56 Antivirus detection for URL or domain 2->56 58 Multi AV Scanner detection for submitted file 2->58 60 Found ransom note / readme 2->60 62 2 other signatures 2->62 8 BVPM6O60dD.exe 2->8         started        11 BVPM6O60dD.exe 2->11         started        13 BVPM6O60dD.exe 2->13         started        15 BVPM6O60dD.exe 2->15         started        process3 signatures4 66 Multi AV Scanner detection for dropped file 8->66 68 Detected unpacking (changes PE section rights) 8->68 70 Detected unpacking (overwrites its own PE header) 8->70 74 2 other signatures 8->74 17 BVPM6O60dD.exe 1 16 8->17         started        72 Injects a PE file into a foreign processes 11->72 22 BVPM6O60dD.exe 1 16 11->22         started        24 BVPM6O60dD.exe 12 13->24         started        26 BVPM6O60dD.exe 15->26         started        process5 dnsIp6 48 tbpws.top 17->48 36 C:\_readme.txt, ASCII 17->36 dropped 38 C:\Users\user\Desktop\PALRGUCVEH.pdf, data 17->38 dropped 40 C:\Users\user\Desktop\PALRGUCVEH.mp3, data 17->40 dropped 46 11 other files (3 malicious) 17->46 dropped 64 Modifies existing user documents (likely ransomware behavior) 17->64 50 api.2ip.ua 77.123.139.190, 443, 49731, 49736 VOLIA-ASUA Ukraine 22->50 42 C:\Users\user\AppData\...\BVPM6O60dD.exe, PE32 22->42 dropped 44 C:\Users\...\BVPM6O60dD.exe:Zone.Identifier, ASCII 22->44 dropped 28 BVPM6O60dD.exe 22->28         started        31 icacls.exe 22->31         started        52 192.168.2.1 unknown unknown 24->52 file7 signatures8 process9 signatures10 76 Injects a PE file into a foreign processes 28->76 33 BVPM6O60dD.exe 12 28->33         started        process11 dnsIp12 54 api.2ip.ua 33->54
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/04830b32044eed19c43dce1d544c530532d60114d64970fafb7dcfb0f37f58c9/
Threat name:
Win32.Ransomware.StopCrypt
Create hunting rule
Status:
Malicious
First seen:
2021-09-21 21:49:00 UTC
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=asbqwmqej3wrtrb5zyovitctauznmaiu2zexb6x3pxh3b437ldeq._file
Verdict:
malicious
Similar samples:
456079ac17674de342836dee558093a80c9b6fb869b5a7562a615db1bbe1b42d
Stop
9735f688e3338582266589c582a22bdac2a0accbc423225ffb5d792801d0d1a5
Stop
a4520e17b63c5503219d9c36435b26054ac63e4539883c5244b3129535d82879
Stop
be8b6e6da114bdcb1a060a06ace28d03550173a4a719b4704510e65ee6e47f02
Stop
d6353ac6a08f1e678698f658274332bcc27588c14e75e029e761dd6af0b4ef41
Stop
dc9fcb210bb6436bee5b9cac39a3a5f9dd06a2e5ebf4062cf0b0e66d14d5236f
Stop
f64101c39b8344473763277c715167216eba418e86f4f2cf22ee7724182b930a
Stop
+ 665 additional samples on MalwareBazaar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:djvu family:vidar botnet:517 discovery persistence ransomware stealer
Link:
https://tria.ge/reports/210922-qlqpeacgf2/
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Looks up external IP address via web service
Adds Run key to start application
Modifies file permissions
Downloads MZ/PE file
Executes dropped EXE
Vidar Stealer
Detected Djvu ransomware
Djvu Ransomware
Vidar
Malware Config
C2 Extraction:
https://pavlovoler.tumblr.com/
Unpacked files
SH256 hash:
e3a758405e0871107c905ba5cf211ec30bd7fb9345950a9a0b3def7f14c9e87c
MD5 hash:
2590861b15fd552297b400342732e746
SHA1 hash:
0663677bd8ef8ded4f9d97de3038ccab7fccadab
Detections:
win_stop_auto
Create hunting rule
Link:
https://www.unpac.me/results/4ab72e57-8a76-4161-80b2-ea455c478a39/
Parent samples :
4cc8bff20f9320c5ad0a543d3a7d97f05b4b6ad83de1dab439e25ec06671efbb
a941e90ff8f1750aadb4763c366b930ae9e6af28036e7ccd790c6c83c7163bff
16ab0466f24ceac741c81e152831d103d97087fe06ad52cdf40c0af437feaf07
a15f72a2d96072229513aa1cf5d8b8747282b5edcb3781a16cba7f1511ddaebb
c83075a8214e1b1631c4090ec9bb3b98e27bedc042c972bd780b054aedbe6c26
2640e5c56cf421eba34ddfd83cf01e243d2cb69a2291863f9f650efecf56318b
325df09a1d1478a0be19a6112b0753714fb0e3b6308b263c0bfe8c65a0708c05
aed0d2debb077e84fb10fce79e0bdd1aa2b1d85163f0bfeb4c7c345a649e61c5
8a7a5384394e62b20745f2a786a8184b26e88afc9cc0e96b2a3d2a6acb13ea7f
8824c8925e085ca11ef0ce41f6cf0d2fed532a0785113f5f34e89164ab4022bd
3c71f2d4d000810aeeaa5378811e1955947b9cdf3e8bc858159199d583a22825
24e01f6ef65d42467608a1db86f06cdbeb114ba6b6da744d5133c7d933adaaad
2f960d8ed44f6c4a4dc31187794e9605fa281f88ed3e2984287cbdd212965ee2
04830b32044eed19c43dce1d544c530532d60114d64970fafb7dcfb0f37f58c9
f8ad6344537c95c3421926b12bfe0de0931676b94c9f624744249343d84bf4de
00da27fd6c2199b83130478b8d22f90c8617a50703ec0dee60672ef2f9462d8a
8bc9f093f57c88b4aaad4f32acf87b89e24b00a28b51eabae5737af7c3567e0d
e5cceee07167bcac472b4d7286bd6afe892ad5241f36e7eec85e70ce16aaeadf
478195a740b83147fea1b6d9fe3b9b98411e99fd369fd34dc6f94a8fe6981ae9
334aaca9cc8d70cd876830bbc3c2a6100161d72f2de771e524bbad31834d7186
4254f97bcd155b5a248f841f4d152bcfd8a0c8bec63186e7f204e449e0e011bd
f0f977ae27df7a111ae322b49b8227ff2fd951461a649ea8fab8c5bec6efb47b
61fc32f8c793924084254b066bc5576480079942866f09ab188763007c40e81a
85fb4ff6108ebf0f167b448775ffa9b03c92f6d075b2da9dea6cb328b8b5aaaf
ca60ed97fc35897fdb89daf1b39d312391137eefc93bfd96fd8f8264ab2b12a1
6386e8a1f4537c6e541be6e04bfbf81ad4d42312f6ad244b415d090d063c25c8
SH256 hash:
04830b32044eed19c43dce1d544c530532d60114d64970fafb7dcfb0f37f58c9
MD5 hash:
33af34cfaf8738b575cdc9e76b053ca5
SHA1 hash:
fbfb7751073b51d2c4740c06c29ba14d66a9c913
Link:
https://www.unpac.me/results/4ab72e57-8a76-4161-80b2-ea455c478a39/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/04830b32044eed19c43dce1d544c530532d60114d64970fafb7dcfb0f37f58c9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/190261/

Comments