MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1da3193c52b5ec3a14b36acbc9c92266a2a531399e33c1e3a209e828eda7a0a5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Stop


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1da3193c52b5ec3a14b36acbc9c92266a2a531399e33c1e3a209e828eda7a0a5
SHA3-384 hash: 734920b48b82ae10fc2a391c714dbf62885b1df809fd2ed15dee8ba8b0e4e99a4f95dc7dfaa362e57eab4faf6c03d10b
SHA1 hash: c8307acc01c7de73eed6692dae49820d5514dda4
MD5 hash: 100cbacc61fc7aa967e534bc353c6f39
humanhash: oxygen-fanta-magnesium-ceiling
File name:1da3193c52b5ec3a14b36acbc9c92266a2a531399e33c1e3a209e828eda7a0a5
Download: download sample
Signature Stop
Create hunting rule
File size:723'968 bytes
First seen:2021-05-03 01:14:08 UTC
Last seen:2021-05-03 02:01:22 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash d7565e12e5db64d47debae818150e3f7 (1 x Stop)
ssdeep 12288:BkxbBvtM5hEg7SJ8dgcEdQKmhzLMPxpdV9Ji2XdpfwCDuCnV7xBvPhgm+3bGEG0b:BGM5hVJtEdTmhYZldX3KCZ5gHnNb
Threatray 50 similar samples on MalwareBazaar
TLSH 41F41202B1C8C573D15062B74835C3A55A69FCE95B239DCF7AC876FCCF292928B15B0A
Reporter fbgwls245
Tags:.wrui djvu Ransomware Stop

Intelligence

File Origin
# of uploads :
2
# of downloads :
1'228
Origin country :
n/a
Vendor Threat Intelligence
Detection:
STOP
Create hunting rule
Link:
https://www.capesandbox.com/analysis/148047/
Detection(s):
Win.Malware.Generic-9857167-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending a custom TCP request
Creating a file
Launching a process
Creating a process with a hidden window
Adding an access-denied ACE
Sending a UDP request
Deleting a recently created file
Sending an HTTP GET request
Creating a window
Creating a process from a recently created file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Djvu
Create hunting rule
Detection:
malicious
Classification:
rans.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/706805
Signature
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found ransom note / readme
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies existing user documents (likely ransomware behavior)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected Djvu Ransomware
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 402323 Sample: QsO4ETjF7s Startdate: 03/05/2021 Architecture: WINDOWS Score: 100 42 Multi AV Scanner detection for domain / URL 2->42 44 Multi AV Scanner detection for submitted file 2->44 46 Found ransom note / readme 2->46 48 2 other signatures 2->48 6 QsO4ETjF7s.exe 1 19 2->6         started        11 QsO4ETjF7s.exe 13 2->11         started        13 QsO4ETjF7s.exe 1 18 2->13         started        15 QsO4ETjF7s.exe 13 2->15         started        process3 dnsIp4 38 jfes.top 31.40.251.99, 49727, 80 ITLDC-NLUA Russian Federation 6->38 22 C:\_readme.txt, ASCII 6->22 dropped 24 C:\Users\user\Desktop\QsO4ETjF7s.exe, PGP\011Secret 6->24 dropped 26 C:\Users\user\Desktop\...\PWCCAWLGRE.xlsx, data 6->26 dropped 32 4 other files (2 malicious) 6->32 dropped 50 Modifies existing user documents (likely ransomware behavior) 6->50 52 Multi AV Scanner detection for dropped file 11->52 54 Detected unpacking (changes PE section rights) 11->54 56 Detected unpacking (overwrites its own PE header) 11->56 58 Machine Learning detection for dropped file 11->58 40 api.2ip.ua 77.123.139.190, 443, 49712, 49720 VOLIA-ASUA Ukraine 13->40 28 C:\Users\user\AppData\...\QsO4ETjF7s.exe, PE32 13->28 dropped 30 C:\Users\...\QsO4ETjF7s.exe:Zone.Identifier, ASCII 13->30 dropped 17 QsO4ETjF7s.exe 13 13->17         started        20 icacls.exe 13->20         started        file5 signatures6 process7 dnsIp8 34 192.168.2.1 unknown unknown 17->34 36 api.2ip.ua 17->36
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1da3193c52b5ec3a14b36acbc9c92266a2a531399e33c1e3a209e828eda7a0a5/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-05-02 00:39:39 UTC
File Type:
PE (Exe)
Extracted files:
23
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dwrrspcswxwdufftnlf4tsjcm2rkkmjztyz4dy5cbhucr3nhucsq._file
Verdict:
malicious
Similar samples:
0aae86fc0351f1ea0999b86cfe8c6ab1b22d16697ba4753e465c5a31fe7746bb
Stop
12750a545215e41d452a16e1c451f0e0682a5330078813313b67cd09499ac674
Stop
496b5885ff8f521c91ca037338e188ea0374bf86816d0c804d3010fd2f5fec38
Stop
68516622ba1e5d57863f74ace36e02e400b92640281507f3c89ecbc8dacbd9fa
Stop
6ed8e078433a7e7938f2084f83a640d707708ac99a246b31736bd22327664668
Stop
a0e32603876c3035d76a78e35d5f89576ded2475451b4d27e19331bf9e6abfc3
Stop
a3c074948f5e3d2b89f0035bbf7bd74b1a3ec0525dc1496b4463f55ef15f3521
Stop
c14987c4c6fc2de2cac43355964465d7611652e29f699d64fa292399f526c103
Stop
e833b7fc4bf14527edb120ee4e691a660b21f93b1ec22bf15881bdcee4c5bb8d
Stop
ed8a7ffec56f450a365e758012db092883bbd23565f3f9fbb004c189fb703de3
Stop
+ 40 additional samples on MalwareBazaar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:djvu family:vidar discovery evasion persistence ransomware spyware stealer
Link:
https://tria.ge/reports/210503-4htccemges/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Kills process with taskkill
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Accesses 2FA software files, possible credential harvesting
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Looks up external IP address via web service
Loads dropped DLL
Modifies file permissions
Reads local data of messenger clients
Reads user/profile data of web browsers
Disables Task Manager via registry modification
Downloads MZ/PE file
Drops file in Drivers directory
Executes dropped EXE
Deletes Windows Defender Definitions
Djvu Ransomware
Vidar
Unpacked files
SH256 hash:
b58165bb5a4f9040d187791e870f691c449e59d3f5fa8312ba7655864236328f
MD5 hash:
5fe929b15555feeb7e4ef768211d8caa
SHA1 hash:
49f52ac9a44d3259167dbf20e7328fdaf287ac7f
Detections:
win_stop_auto
Create hunting rule
Link:
https://www.unpac.me/results/6edf0c1e-9e74-4efa-bf9e-77cebce33d45/
Parent samples :
7c75df63bc40beca5ccf65db76c33539ee9f3468a4149e1a0c0bfd30949f4b4d
1da3193c52b5ec3a14b36acbc9c92266a2a531399e33c1e3a209e828eda7a0a5
7c9bc6a878b6cb355bb2a5c70170aa48b1e8f369dd64ee47df3ac9ea9e213b02
9ded335a6f346de4aafbc4f8c08e90dce1f064820b13d6580f01731c9837d7a8
a0e32603876c3035d76a78e35d5f89576ded2475451b4d27e19331bf9e6abfc3
c14987c4c6fc2de2cac43355964465d7611652e29f699d64fa292399f526c103
e833b7fc4bf14527edb120ee4e691a660b21f93b1ec22bf15881bdcee4c5bb8d
712e9e9e2976782e38288d45a2d177f1dc3757c7610b4b9bae9e35be9f20b913
SH256 hash:
1da3193c52b5ec3a14b36acbc9c92266a2a531399e33c1e3a209e828eda7a0a5
MD5 hash:
100cbacc61fc7aa967e534bc353c6f39
SHA1 hash:
c8307acc01c7de73eed6692dae49820d5514dda4
Link:
https://www.unpac.me/results/6edf0c1e-9e74-4efa-bf9e-77cebce33d45/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Ransomware
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1da3193c52b5ec3a14b36acbc9c92266a2a531399e33c1e3a209e828eda7a0a5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_STOP
Create hunting rule
Author:ditekSHen
Description:Detects STOP ransomware
Rule name:SUSP_XORed_URL_in_EXE
Create hunting rule
Author:Florian Roth
Description:Detects an XORed URL in an executable
Reference:https://twitter.com/stvemillertime/status/1237035794973560834
Rule name:win_stop_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/148047/

Comments


Avatar
a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-05-03 02:11:01 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [B0009] Anti-Behavioral Analysis::Virtual Machine Detection
1) [C0003.002] Communication Micro-objective::Connect Pipe::Interprocess Communication
2) [C0003.001] Communication Micro-objective::Create Pipe::Interprocess Communication
3) [C0003.003] Communication Micro-objective::Read Pipe::Interprocess Communication
4) [C0003.004] Communication Micro-objective::Write Pipe::Interprocess Communication
5) [C0047] File System Micro-objective::Delete File
6) [C0049] File System Micro-objective::Get File Attributes
7) [C0052] File System Micro-objective::Writes File
8) [C0007] Memory Micro-objective::Allocate Memory
9) [C0034.001] Operating System Micro-objective::Set Variable::Environment Variable
10) [C0040] Process Micro-objective::Allocate Thread Local Storage
11) [C0042] Process Micro-objective::Create Mutex
12) [C0041] Process Micro-objective::Set Thread Local Storage Value
13) [C0018] Process Micro-objective::Terminate Process
14) [C0039] Process Micro-objective::Terminate Thread