MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a4ecbf9d395be341a8a4e042bab9679d4ee6e43f9f9cf1690d88bf277ef09803. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Stop

Vendor detections: 16

Intelligence 16 IOCs YARA 3 File information Comments

SHA256 hash:	a4ecbf9d395be341a8a4e042bab9679d4ee6e43f9f9cf1690d88bf277ef09803
SHA3-384 hash:	87d8eb7bf78b0a503c32857455ef6122c8fd377871da428d5be683d0d0203182659b72dd539280148beda7a2ee95f2d7
SHA1 hash:	864bcc7ad44100dd602f089969802eff5830c1ad
MD5 hash:	0a71da83060da9e4fffb05b88dc7e457
humanhash:	oxygen-grey-uranus-arizona
File name:	0a71da83060da9e4fffb05b88dc7e457.exe
Download:	download sample
Signature	Stop Create hunting rule
File size:	719'360 bytes
First seen:	2024-04-30 05:16:27 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	1679b6408c5d33ed187bba0fb99e14e0 (1 x Stop, 1 x Smoke Loader)
ssdeep	12288:aJON9tMho1RxtESImBxBt/qp3J0eDEzcLie/4lOOg/R78ECyDM6JdGA:COlSizIm7m3J0sE0j4EJ5aNSdGA
Threatray	1'825 similar samples on MalwareBazaar
TLSH	T1D2E4121069A1D572EE47A578195CC7C07F3B3532AA328D4BB3586B9EFE716C0FA24342
TrID	37.3% (.EXE) Win64 Executable (generic) (10523/12/4) 17.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 15.9% (.EXE) Win32 Executable (generic) (4504/4/1) 7.3% (.ICL) Windows Icons Library (generic) (2059/9) 7.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	64d29a9899999991 (1 x Stop)
Reporter	abuse_ch
Tags:	exe Stop

Intelligence

File Origin

# of uploads :

# of downloads :

328

Origin country :

Vendor Threat Intelligence

Malware family:

stop

ID:

File name:

a4ecbf9d395be341a8a4e042bab9679d4ee6e43f9f9cf1690d88bf277ef09803.exe

Verdict:

Malicious activity

Analysis date:

2024-04-30 05:19:20 UTC

Tags:

evasion ransomware stop djvu loader vodkagats raccoonclipper

Link:

https://app.any.run/tasks/665aeb25-fa54-4ebe-a75e-cfc9b667cecf

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

Win.Trojan.Windigo-10028444-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

Restart of the analyzed sample

Connection attempt to an infection source

Sending a TCP request to an infection source

Creating a file

Launching a process

Creating a process with a hidden window

Adding an access-denied ACE

Сreating synchronization primitives

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Query of malicious DNS domain

Enabling autorun by creating a file

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/a4ecbf9d395be341a8a4e042bab9679d4ee6e43f9f9cf1690d88bf277ef09803

Result

Verdict:

MALICIOUS

Malware family:

STOP Ransomware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/459e9e1b-b4df-4962-bb4f-7edfb1da94be

Result

Threat name:

Djvu

Detection:

malicious

Classification:

rans.troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1433818

Signature

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected Djvu Ransomware

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/a4ecbf9d395be341a8a4e042bab9679d4ee6e43f9f9cf1690d88bf277ef09803

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a4ecbf9d395be341a8a4e042bab9679d4ee6e43f9f9cf1690d88bf277ef09803/

Threat name:

Win32.Trojan.Vidar

Status:

Malicious

First seen:

2024-04-29 20:07:01 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

16 of 23 (69.57%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=utwl7hjzlprudkfe4bblvolhtvhonzb7t6opc2inrc7so7xqtabq._file

Verdict:

malicious

Stop

35ba91ddf0d41590d0de137bc1d6e5524d8a84ecfabdae793e6b3a499f2c67d4

Stop

6a455892dc6b808ff4f012010f20ad4bbf16b881b9c235d98c85565591289012

Stop

83c4c80adbeb1d8411e49c1d14a886af6a26c9fb9827d8852d4e45e4a5f09b17

Stop

a0038a7651f4408728f4a8c7a2abe43b237fc9dc6645fa34e5c4d9c212658878

Stop

b299675e7e4654beadcaa2c38a96bf8324bbde96904ede17fdd88ebb7fdf2748

Stop

d46fec4abba46efe6663f19c2d9963a612f4ff25023c0dc6fc5bb559f106859d

Stop

+ 1'815 additional samples on MalwareBazaar

Result

Malware family:

djvu

Score:

10/10

Tags:

family:djvu discovery persistence ransomware

Link:

https://tria.ge/reports/240430-fyp9asdg7s/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Adds Run key to start application

Looks up external IP address via web service

Checks computer location settings

Modifies file permissions

Detected Djvu ransomware

Djvu Ransomware

Malware Config

C2 Extraction:

http://cajgtus.com/test2/get.php

Unpacked files

SH256 hash:

18f3120c547c3568ab79e3762b4f3112f6f8c5024c35e6f3a2b43242191ce91d

MD5 hash:

0219f65aec5c3d049d69e9741fabf37a

SHA1 hash:

77f19519bd90bbed0da7eaea1ba74f67d51e84fc

Detections:

djvu_ransomware

win_stop_auto

SUSP_XORed_URL_In_EXE

MALWARE_Win_STOP

Link:

https://www.unpac.me/results/5282a379-f9ca-41ec-a03a-015f7e872dec/

Parent samples :

53193f424f55572d6c57e1efc0d9afbce1fb8d2e09de0669bc230c34dccd330d
bcbaec2245e008d98b6b8a15dd780aacf1b3afbe3daf68508f48a5e32e283c1c
651bf6dc2ce11fbbda045ac186ab58ac3d691f8d28dc811f2b1552fe74b275cc
200690de2b973c6f7a702d5129dea09aec57d548cab07e19f012e5a8e0c6ae64
2f48e39c1fa623b569c7580066026dc25e629fcd4a9cdb8a58d22e45c9eb99c2
f6a6765642f0f8c4b81f45d4e1a9f65505432bbf4c249fa3c96b82d9c712effe
0b80ebd4dffd54e98c8dd781246d247546f9e47ca86eca4215b07d8631370891
0e40646d6311552a7f6e7a386a06421d97de655f65b099e455cf22db10afd746
a4ecbf9d395be341a8a4e042bab9679d4ee6e43f9f9cf1690d88bf277ef09803

SH256 hash:

a4ecbf9d395be341a8a4e042bab9679d4ee6e43f9f9cf1690d88bf277ef09803

MD5 hash:

0a71da83060da9e4fffb05b88dc7e457

SHA1 hash:

864bcc7ad44100dd602f089969802eff5830c1ad

Link:

https://www.unpac.me/results/5282a379-f9ca-41ec-a03a-015f7e872dec/

Malware family:

Djvu

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/a4ecbf9d395b/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/a4ecbf9d395be341a8a4e042bab9679d4ee6e43f9f9cf1690d88bf277ef09803

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BitcoinAddress Create hunting rule
Author:	Didier Stevens (@DidierStevens)
Description:	Contains a valid Bitcoin address

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Stop

exe a4ecbf9d395be341a8a4e042bab9679d4ee6e43f9f9cf1690d88bf277ef09803

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/2786048/

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryA KERNEL32.dll::GetVolumeInformationA KERNEL32.dll::GetStartupInfoA KERNEL32.dll::GetCommandLineA
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleA KERNEL32.dll::WriteConsoleW KERNEL32.dll::ReadConsoleW KERNEL32.dll::SetConsoleCtrlHandler KERNEL32.dll::SetConsoleDisplayMode KERNEL32.dll::SetConsoleTitleW
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateFileA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample