MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5eba82a7e94705bf27fadd086866acebcd1afe20d9b5ad9ee9f224ab21f46ad9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Stop


Vendor detections: 15


Intelligence 15 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5eba82a7e94705bf27fadd086866acebcd1afe20d9b5ad9ee9f224ab21f46ad9
SHA3-384 hash: 62395e9e9199747f8a90a9f75152715b20a261bbc5e1734b5d406afa9b7123c88a8b79eb17118b85ab782e69f36d51b7
SHA1 hash: 11230e9059b48782712c108fca29447506828d54
MD5 hash: 1e685995f535749175bf49526e2a8c68
humanhash: stream-failed-green-west
File name:5eba82a7e94705bf27fadd086866acebcd1afe20d9b5ad9ee9f224ab21f46ad9
Download: download sample
Signature Stop
Create hunting rule
File size:803'328 bytes
First seen:2022-04-05 06:10:24 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b6dc566a06bc77ef1171b0a7f77611f6 (3 x Stop)
ssdeep 12288:FbR5I4g1e4Jhx/DW2JTqz1fGDLnq4cuR1hKTZmuOvCOqpKCiG4TQwqUY8Eb:5wN33DzJG5OD24vwYuAGhw888
Threatray 1'112 similar samples on MalwareBazaar
TLSH T1BA05123176D0C431D4A6123178B98E21196DE8E1E86E5D8673B53B6EBF363C01AB139F
File icon (PE):PE icon
dhash icon 480c3c4c4f590b14 (23 x Smoke Loader, 16 x Amadey, 15 x RedLineStealer)
Reporter JAMESWT_WT
Tags:exe Stop

Intelligence

File Origin
# of uploads :
1
# of downloads :
204
Origin country :
n/a
Vendor Threat Intelligence
Detection:
STOP
Create hunting rule
Link:
https://www.capesandbox.com/analysis/260810/
Detection(s):
Win.Dropper.Stop-9938042-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Searching for the window
Creating a window
Unauthorized injection to a recently created process
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Сreating synchronization primitives
Creating a file in the %temp% directory
Running batch commands
Creating a process with a hidden window
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/12628/overview
Behaviour
SystemUptime
MeasuringTime
CheckCmdLine
EvasionQueryPerformanceCounter
EvasionGetTickCount
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/624bdd7eaa7e43c6a6ba927b/reports/d3345db7-b18c-42b9-bd78-c59dbc5bf6fa/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
STOP Ransomware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/9d1b36db-a021-43d6-9712-bd7485d3be1e
Result
Threat name:
Djvu Vidar
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/970690
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Found ransom note / readme
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Modifies existing user documents (likely ransomware behavior)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Mail credentials (via file / registry access)
Yara detected Djvu Ransomware
Yara detected Vidar
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 603210 Sample: pHSy5hChyH Startdate: 05/04/2022 Architecture: WINDOWS Score: 100 87 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->87 89 Multi AV Scanner detection for domain / URL 2->89 91 Found malware configuration 2->91 93 13 other signatures 2->93 12 pHSy5hChyH.exe 2->12         started        15 pHSy5hChyH.exe 2->15         started        17 pHSy5hChyH.exe 2->17         started        19 pHSy5hChyH.exe 2->19         started        process3 signatures4 99 Contains functionality to inject code into remote processes 12->99 101 Injects a PE file into a foreign processes 12->101 21 pHSy5hChyH.exe 1 16 12->21         started        103 Machine Learning detection for dropped file 15->103 25 pHSy5hChyH.exe 12 15->25         started        27 pHSy5hChyH.exe 12 17->27         started        process5 dnsIp6 81 api.2ip.ua 162.0.217.254, 443, 49777, 49778 ACPCA Canada 21->81 63 C:\Users\user\AppData\...\pHSy5hChyH.exe, PE32 21->63 dropped 65 C:\Users\...\pHSy5hChyH.exe:Zone.Identifier, ASCII 21->65 dropped 29 pHSy5hChyH.exe 21->29         started        32 icacls.exe 21->32         started        file7 process8 signatures9 113 Injects a PE file into a foreign processes 29->113 34 pHSy5hChyH.exe 1 23 29->34         started        process10 dnsIp11 75 zerit.top 210.182.29.70, 49780, 80 LGDACOMLGDACOMCorporationKR Korea Republic of 34->75 77 fuyt.org 211.169.6.249, 49779, 49783, 80 LGDACOMLGDACOMCorporationKR Korea Republic of 34->77 79 api.2ip.ua 34->79 55 C:\Users\user\AppData\Local\...\build2[1].exe, PE32 34->55 dropped 57 C:\_readme.txt, ASCII 34->57 dropped 59 C:\Users\user\...\build2.exe.udla (copy), MS-DOS 34->59 dropped 61 8 other files (4 malicious) 34->61 dropped 95 Modifies existing user documents (likely ransomware behavior) 34->95 39 build2.exe 34->39         started        file12 signatures13 process14 signatures15 97 Injects a PE file into a foreign processes 39->97 42 build2.exe 39->42         started        process16 dnsIp17 83 78.47.227.68, 49790, 80 HETZNER-ASDE Germany 42->83 85 t.me 149.154.167.99, 443, 49788 TELEGRAMRU United Kingdom 42->85 67 C:\Users\user\AppData\Local\...\nss3[1].dll, PE32 42->67 dropped 69 C:\Users\user\AppData\...\softokn3[1].dll, PE32 42->69 dropped 71 C:\Users\user\AppData\...\freebl3[1].dll, PE32 42->71 dropped 73 9 other files (none is malicious) 42->73 dropped 105 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 42->105 107 Tries to steal Mail credentials (via file / registry access) 42->107 109 Tries to harvest and steal browser information (history, passwords, etc) 42->109 111 Tries to steal Crypto Currency Wallets 42->111 47 cmd.exe 42->47         started        file18 signatures19 process20 process21 49 conhost.exe 47->49         started        51 taskkill.exe 47->51         started        53 timeout.exe 47->53         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5eba82a7e94705bf27fadd086866acebcd1afe20d9b5ad9ee9f224ab21f46ad9/
Threat name:
Win32.Trojan.Azorult
Create hunting rule
Status:
Malicious
First seen:
2022-04-04 00:48:25 UTC
File Type:
PE (Exe)
Extracted files:
31
AV detection:
23 of 26 (88.46%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=l25ifj7ji4c36j723uegqzvm5pgrv7ra3g223hxj6iskwipunlmq._file
Verdict:
malicious
Similar samples:
45af7d799a8e6cd7b9427908e7bdba67693f63402b0b32316982656bf7d17462
Stop
5efb1ae4bb8bb433c72d9a5ffa3e567e9ac235eb666ce25a56035e30fb623abc
Stop
923d2af76cd47509cd42c94e47b6198321b16c2123b09bb39aa26b8c3daf9647
Stop
b35685146d30d976ea7a856d4f6011e2433d8a40244c320be021d40ed33f0ee0
Stop
edbe71fea0f03f364ec2b75c2786ddea29541034496d5005c132d8b402a3c778
Stop
+ 1'102 additional samples on MalwareBazaar
Result
Malware family:
djvu
Create hunting rule
Score:
  10/10
Tags:
family:djvu ransomware
Link:
https://tria.ge/reports/220405-gxlp6adhgr/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Detected Djvu ransomware
Djvu Ransomware
Malware Config
C2 Extraction:
http://fuyt.org/test1/get.php
Unpacked files
SH256 hash:
fc90a956316d6efabf262e575d5801e6ec502502dcef75269b2db592d0e5a70a
MD5 hash:
98fd0039533495e6a5756eae5a9ea38b
SHA1 hash:
5c8fdddd87ccc8b5ac13d0adc0178d2d356f0e6d
Detections:
win_stop_auto
Create hunting rule
Link:
https://www.unpac.me/results/24c0bd7e-6029-42fe-8a01-cfa90f10ee81/
Parent samples :
9cfe27f65401391f31681939a2044e00e873f2391398656a6066c9e09030f5e1
a7dd575a5d02cf4531309ba335481564cf35383285d84effa519d302962556e7
56fdae721975ff81c3ba41c65aa74395ffac22f832d494c1edd3ecc2593e45c0
adb3dfa05eb1eac98d1c860e0e88c6050952b00e854f962e02126b14ab0e8423
58800e8556bb1ecb9d1554a14cd59136cbf41bac263c56d8e0adea85e6fbcc35
ae46809e1f04125ca54e9108794c6426d389617e0bd8133ce91aeee9ce9bb573
a08d308902b9494ee1a0d38e4c7cb5dc91e302efc8e869be3c2ec0394034fe06
2fbd58e933ac02775649129f2d72a4a40c011f1075d4714052141c6c0813b049
1fc49b9f134cd2ce6b203dfea77b85269bba7ed1e29060d11dad4fabcaa66f67
1cf6de69e4116e27fdc7fdd485432566bd2c65598bc9420bc1089fd5f7c3cf4f
2b52418f70ca659187a5d9959802adc348af02b4bb4bdfaa634de930295d8ae3
5efb1ae4bb8bb433c72d9a5ffa3e567e9ac235eb666ce25a56035e30fb623abc
6fcec37ad944a768f9e87a590de03e1df6c5b86cd7ffe3105589ce463cc67615
28de739e5a1ed53773ef2d8747f800a88c631b7fc27466cbc6371bccb9259da9
37ee32817b5a8fe72af37a71d051f1330a2486a88a2735e051f860bf92fdbfdc
82e869f41c09e99a544ce6d50fedf25e1f08b60286a8085299d3196b00083a1b
295ba48b48c596fcf5792578fe2c0678b841984588efbcf77067f51961d374f2
3289a7e157927ea433bcbef1e2f4a14830051bf75824c0769c31efaf1225955c
3d14f23b4729d498460c0831236950c4d854fea2de797c1fe65b1eb6548dc241
9301195c700b39f71484a9302e0ee0f714b8914113394b08f4f4788cd6f5a40e
a512b4b6c99877a9990299da663556a582fc6eb9713b9984d9c2927d73c9c6ff
c10580e06da040aa1e72bb74f872bb45d63f1733e432f15920eff91848d31377
893641698acd5b415c7a079b5512abadd0da0ebcd9e9e440bd0cf33fc5596257
d536de2200a9424de07b26726d16c18a88277745eb87d3e3f31f3ce83207a2b6
e2008f3eb3480e576bd34e3a1079b21a17a03fe3f02d74c98461a1eef4e28275
eacbde48d95aaaa21da6ff9acb0e5e29b4a19d89816351a6616c6e800e686261
c4b422fc75b9e6b9b7bc6d5dc6ceb221aba807ccf9973710b5c62a30fd636bf8
ffbf3c9e0ec433e6ea684b848440bc8d039164fca4174763ba12335ab57d7606
436d45423beaf3553cf83814334614f11d786650981bfd1deec29093761efea3
6672fed2e98c442d1d0f86f03fcdc939f502cb9952061c57af7d4f232ed6d16c
d89e36841e53232e807fe543972ca6a1b4dd425da6ea87d7455043a75c6df957
e094869a8bb09c533b826e173f853cf8d7d1ab31f56fa7cbdf3ea72dabd7ead4
edbe71fea0f03f364ec2b75c2786ddea29541034496d5005c132d8b402a3c778
9dc1ae55fc0b55f3a3268a59a50fb9052d917b53295d1415cbc4045ddc3dbad0
02f7349342a424adae32d57fa13d89be4b7b54e119b068d1046c14e36b7f5bc3
6dceff38ea7aa0c62437cdb32c52bbaff747db2bcd8cf38597dce31a26695c3c
0b6c3923a7d34f3062dab70853887a2a3c8bdb009e9a110d4a554bef892b26fd
3dd2f20a676053db4004a363fe3a838b4eeea2b24447336f80b19de465affa9a
5eba82a7e94705bf27fadd086866acebcd1afe20d9b5ad9ee9f224ab21f46ad9
8a2d0bf67b76ca5e61e73cb91957a5cc4281ebf9ff3a2cc83d5c0262c64d7abe
8c5a7318f7201df35cfd4c7902108e287a1932454a8120c47da88114cd845138
9d86a0b05fe7895b350e225e4585dc999008ce6df6bb54cfb1141613f1e97df1
22a282ef1bcc703568825a99c13a5f409718291d9817d11a2ab4ca0ef9272865
28ab91ea2d0e18a098cf8d26e786a7a477a98d6b0a6dcc1ec9e6e54395534b5d
44eed310cb747cc6e34b10937c0f7f8011d20b7559ab8846bf981def59275f5a
99eaee03c735e58c791b29c4d8b0911a0b42b70bd55ac3e5f33cf0729accfe0f
23a56459c8c96187dccb00c4f206678c901ac4b20f25a92babd1197213f16b01
83f32b4c80b69df7ac87e097e57990f759d71433010558083e0260238fe3a795
726e184388fa817075ff40803a1c921e9907d426888cf8e265f14d88d606b2bb
bbc0573a3c27403f6191fd3820ee001dc8d248f4af20200ebbac79cb63ef1023
556a1f630405c06e4ebceadee1c8dc291f1fcaba0955adcdb8946cae5765a939
05369a22c30ed4a64f2559bb9e8acbaf0838eac9f4ad2c06e9c5f06bd3d8b01f
b76029c0f387e9c39ca61093bab92354550a28281b8de0ed56e6be3cc59873c4
db31b33ef9ba03ebc8ad2ff4fe5ab3fb5934d92a26c2b512e784bfc34c3effc2
910fe03c505bbae3cb251f6fa48c837347a4505f7e74ba658a06c41667bf03b3
db796fc968041267daff136126768ff072bd3e4e271d1c81120b0eaf6056bf60
fc6ccdf10a489163e43fbd96ed5c48d0b2948e2a21a29a793083cd15b64b5739
6120caded2eeed1982670216779cbfd5a1b6917b339c96106bc23051ea6a2670
8166fa2f97612f886d127e68c511bc2d8edae19cf9eba76ead300beb41b5aa69
e93dfe97cdd0a9bcd8cc42063fb14cef4e4e0d588871614c3cea18e4c4ba77d7
SH256 hash:
5eba82a7e94705bf27fadd086866acebcd1afe20d9b5ad9ee9f224ab21f46ad9
MD5 hash:
1e685995f535749175bf49526e2a8c68
SHA1 hash:
11230e9059b48782712c108fca29447506828d54
Link:
https://www.unpac.me/results/24c0bd7e-6029-42fe-8a01-cfa90f10ee81/
Malware family:
Djvu
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/5eba82a7e947/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5eba82a7e94705bf27fadd086866acebcd1afe20d9b5ad9ee9f224ab21f46ad9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_STOP
Create hunting rule
Author:ditekSHen
Description:Detects STOP ransomware
Rule name:SUSP_XORed_URL_in_EXE
Create hunting rule
Author:Florian Roth
Description:Detects an XORed URL in an executable
Reference:https://twitter.com/stvemillertime/status/1237035794973560834
Rule name:SUSP_XORed_URL_in_EXE_RID2E46
Create hunting rule
Author:Florian Roth
Description:Detects an XORed URL in an executable
Reference:https://twitter.com/stvemillertime/status/1237035794973560834
Rule name:win_stop_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.stop.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Stop

Executable exe 5eba82a7e94705bf27fadd086866acebcd1afe20d9b5ad9ee9f224ab21f46ad9

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2084511/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/260810/

Comments