General
-
Target
1ad471585dfd2b3c05b3926e211b18b6e64d8ff1f753025c0d70ae213289ac8c.sample
-
Size
392KB
-
Sample
210726-f5pslcp1wa
-
MD5
280d48953880c4a27df69957916f718f
-
SHA1
0c4696c6094b0d1ae5ef08d054c1cf3f09d059be
-
SHA256
1ad471585dfd2b3c05b3926e211b18b6e64d8ff1f753025c0d70ae213289ac8c
-
SHA512
2eb5596ef8d5c6f1e345903bf3188432f42dcc26d0d520b0a501d6125bb638f638de20dd0f0fd341a5127a460381c0e2a3252792eb7da8357b7280d3f1578e27
Static task
static1
Behavioral task
behavioral1
Sample
1ad471585dfd2b3c05b3926e211b18b6e64d8ff1f753025c0d70ae213289ac8c.sample.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
1ad471585dfd2b3c05b3926e211b18b6e64d8ff1f753025c0d70ae213289ac8c.sample.exe
Resource
win10v20210408
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-2455352368-1077083310-2879168483-1000\RECOVERnymxm.txt
http://kkr4hbwdklf234bfl84uoqleflqwrfqwuelfh.brazabaya.com/52BCE19BBC9CCDA4
http://974gfbjhb23hbfkyfaby3byqlyuebvly5q254y.mendilobo.com/52BCE19BBC9CCDA4
http://a64gfdsjhb4htbiwaysbdvukyft5q.zobodine.at/52BCE19BBC9CCDA4
http://k7tlx3ghr3m4n2tu.onion/52BCE19BBC9CCDA4
Extracted
C:\$Recycle.Bin\S-1-5-21-1594587808-2047097707-2163810515-1000\RECOVERcrmnn.txt
http://kkr4hbwdklf234bfl84uoqleflqwrfqwuelfh.brazabaya.com/645FC398B211489F
http://974gfbjhb23hbfkyfaby3byqlyuebvly5q254y.mendilobo.com/645FC398B211489F
http://a64gfdsjhb4htbiwaysbdvukyft5q.zobodine.at/645FC398B211489F
http://k7tlx3ghr3m4n2tu.onion/645FC398B211489F
Targets
-
-
Target
1ad471585dfd2b3c05b3926e211b18b6e64d8ff1f753025c0d70ae213289ac8c.sample
-
Size
392KB
-
MD5
280d48953880c4a27df69957916f718f
-
SHA1
0c4696c6094b0d1ae5ef08d054c1cf3f09d059be
-
SHA256
1ad471585dfd2b3c05b3926e211b18b6e64d8ff1f753025c0d70ae213289ac8c
-
SHA512
2eb5596ef8d5c6f1e345903bf3188432f42dcc26d0d520b0a501d6125bb638f638de20dd0f0fd341a5127a460381c0e2a3252792eb7da8357b7280d3f1578e27
Score10/10-
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
-
Executes dropped EXE
-
Deletes itself
-
Drops startup file
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-