MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 82b8c3ed64a41126bfd663ac2c20800146279d5c93f59080490afe114c5b3e14. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Stop


Vendor detections: 11


Intelligence 11 IOCs 1 YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 82b8c3ed64a41126bfd663ac2c20800146279d5c93f59080490afe114c5b3e14
SHA3-384 hash: c58494c378b038945729925b5d7aceec87956f3cea4de46c257c803fcf0844246c0dff0e9edf539ae7ed37d3cf234989
SHA1 hash: a4b7af63c342b2606e8252c33d58d7b1624d6f4d
MD5 hash: 6968e4b56566c31ddbc5f67aadd40dca
humanhash: twenty-comet-summer-monkey
File name:6968e4b56566c31ddbc5f67aadd40dca.exe
Download: download sample
Signature Stop
Create hunting rule
File size:864'768 bytes
First seen:2021-06-01 05:40:25 UTC
Last seen:2021-06-01 06:50:41 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f9bd684309ec108423c625f7e337de4e (1 x Stop, 1 x RaccoonStealer, 1 x ArkeiStealer)
ssdeep 24576:JYuBRjuzK5mZ+jq+gk15VnhBMlqEvegdim:JZuOEezVnLMlpeR
Threatray 224 similar samples on MalwareBazaar
TLSH 7105F1006790D034F1B735F98ABB527CAA2D7DA1EB6851CF52C4A9EE57386E0AC31317
Reporter abuse_ch
Tags:exe Stop


Avatar
abuse_ch
Stop C2:
http://162.55.189.141/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://162.55.189.141/ https://threatfox.abuse.ch/ioc/67961/

Intelligence

File Origin
# of uploads :
2
# of downloads :
126
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
6968e4b56566c31ddbc5f67aadd40dca.exe
Verdict:
Suspicious activity
Analysis date:
2021-06-01 05:42:56 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/2f524172-c2b3-47cb-aa9b-2de59d39a51a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
STOP
Create hunting rule
Link:
https://www.capesandbox.com/analysis/163622/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.46397811.8663.13233.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Unauthorized injection to a recently created process
DNS request
Sending a custom TCP request
Creating a file
Launching a process
Creating a process with a hidden window
Adding an access-denied ACE
Deleting a recently created file
Sending an HTTP GET request
Creating a process from a recently created file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Djvu
Create hunting rule
Detection:
malicious
Classification:
rans.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/794972
Signature
Contains functionality to inject code into remote processes
Found ransom note / readme
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies existing user documents (likely ransomware behavior)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected Djvu Ransomware
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 427368 Sample: 930OjSVfn0.exe Startdate: 01/06/2021 Architecture: WINDOWS Score: 100 54 Multi AV Scanner detection for domain / URL 2->54 56 Multi AV Scanner detection for submitted file 2->56 58 Found ransom note / readme 2->58 60 2 other signatures 2->60 8 930OjSVfn0.exe 2->8         started        11 930OjSVfn0.exe 2->11         started        13 930OjSVfn0.exe 2->13         started        15 930OjSVfn0.exe 2->15         started        process3 signatures4 64 Injects a PE file into a foreign processes 8->64 17 930OjSVfn0.exe 1 19 8->17         started        66 Contains functionality to inject code into remote processes 11->66 22 930OjSVfn0.exe 1 16 11->22         started        68 Multi AV Scanner detection for dropped file 13->68 70 Machine Learning detection for dropped file 13->70 24 930OjSVfn0.exe 12 13->24         started        26 930OjSVfn0.exe 12 15->26         started        process5 dnsIp6 48 asvb.top 34.105.39.31, 49755, 80 GOOGLEUS United States 17->48 36 C:\_readme.txt, ASCII 17->36 dropped 38 C:\Users\user\Desktop\DQOFHVHTMG.xlsx, data 17->38 dropped 40 C:\Users\user\Desktop\BUFZSQPCOH.jpg, data 17->40 dropped 46 3 other files (2 malicious) 17->46 dropped 62 Modifies existing user documents (likely ransomware behavior) 17->62 50 api.2ip.ua 77.123.139.190, 443, 49742, 49748 VOLIA-ASUA Ukraine 22->50 42 C:\Users\user\AppData\...\930OjSVfn0.exe, PE32 22->42 dropped 44 C:\Users\...\930OjSVfn0.exe:Zone.Identifier, ASCII 22->44 dropped 28 930OjSVfn0.exe 22->28         started        31 icacls.exe 22->31         started        file7 signatures8 process9 signatures10 72 Injects a PE file into a foreign processes 28->72 33 930OjSVfn0.exe 12 28->33         started        process11 dnsIp12 52 api.2ip.ua 33->52
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/82b8c3ed64a41126bfd663ac2c20800146279d5c93f59080490afe114c5b3e14/
Threat name:
Win32.Trojan.Azorult
Create hunting rule
Status:
Malicious
First seen:
2021-05-31 23:47:40 UTC
File Type:
PE (Exe)
Extracted files:
21
AV detection:
22 of 45 (48.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qk4mh3leuqisnp6wmowcyieaafdcphk4sp2zbacjbl7bctc3hyka._file
Verdict:
malicious
Similar samples:
006da02d7c8b4354776da398a953529efafe216507184dc0191eaf4f6aab1553
Stop
0e55e17532909ad5ad34eb4e35d791b27c6951dd15a8baba34c29ae572c884d0
Stop
2a8f13cc0d990ecfd9c2a6f3120b97bc9faa27251e54c1d2e27f80453f29f60a
Stop
3446fd547e18ca3ed3a99c84e093b8b052893f6c2295d51f3eaaa2e9b395242a
Stop
49eff97c11de31ced5821ed81894372318a2405375c1848131fc87bfb1282716
Stop
8519f5350b808b66c09a89e2f7391cb2d366be6017864e872a5da2290bc7617d
Stop
869bd0ca39150a6e0f87609ca7e927211ba9cf636b69c33c3cd09db85922dd94
Stop
b48348bce63f1ad4550e28f99b61f3166e30eec746299c4258632a5fae95df7d
Stop
d4978cc7d08c43156ea6fc939de6719d2a6123f1a56fdb8a504794291df84a32
Stop
ed8a7ffec56f450a365e758012db092883bbd23565f3f9fbb004c189fb703de3
Stop
+ 214 additional samples on MalwareBazaar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:djvu family:vidar discovery evasion persistence ransomware spyware stealer
Link:
https://tria.ge/reports/210601-s1aj545zkx/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Kills process with taskkill
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses 2FA software files, possible credential harvesting
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Looks up external IP address via web service
Loads dropped DLL
Modifies file permissions
Reads local data of messenger clients
Reads user/profile data of web browsers
Disables Task Manager via registry modification
Downloads MZ/PE file
Drops file in Drivers directory
Executes dropped EXE
Deletes Windows Defender Definitions
Djvu Ransomware
Vidar
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/82b8c3ed64a41126bfd663ac2c20800146279d5c93f59080490afe114c5b3e14

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_References_CryptoWallets
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many cryptocurrency mining wallets or apps. Observed in information stealers
Rule name:MALWARE_Win_STOP
Create hunting rule
Author:ditekSHen
Description:Detects STOP ransomware
Rule name:MALWARE_Win_Vidar
Create hunting rule
Author:ditekSHen
Description:Detects Vidar / ArkeiStealer
Rule name:Ping_Del_method_bin_mem
Create hunting rule
Author:James_inthe_box
Description:cmd ping IP nul del
Rule name:SUSP_XORed_URL_in_EXE
Create hunting rule
Author:Florian Roth
Description:Detects an XORed URL in an executable
Reference:https://twitter.com/stvemillertime/status/1237035794973560834
Rule name:Vidar
Create hunting rule
Author:kevoreilly
Description:Vidar Payload
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Stop

Executable exe 82b8c3ed64a41126bfd663ac2c20800146279d5c93f59080490afe114c5b3e14

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1256494/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/163622/

Comments