General
-
Target
8184432307b0f546d168e3e386a20999f5b0de0bd4085753bb2b09cfc7fec071.sample
-
Size
276KB
-
Sample
210726-nq4jm6wjvx
-
MD5
6bfa1c01c3af6206a189b975178965fe
-
SHA1
260dd322089862a5400a00dbcb35774b66ce2d47
-
SHA256
8184432307b0f546d168e3e386a20999f5b0de0bd4085753bb2b09cfc7fec071
-
SHA512
f518f82554b7a4d6c14655cd980ab710e08c20b3efb2979e39429c44cdf85f66f6db2021bd4758ec6cdcfa4c89fe3224628198094888adc4af243d17c730ddf8
Static task
static1
Behavioral task
behavioral1
Sample
8184432307b0f546d168e3e386a20999f5b0de0bd4085753bb2b09cfc7fec071.sample.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
8184432307b0f546d168e3e386a20999f5b0de0bd4085753bb2b09cfc7fec071.sample.exe
Resource
win10v20210408
Malware Config
Extracted
C:\Documents and Settings\-!RecOveR!-ibefa++.Txt
http://74bfc.flubspiel.com/52C28F7421287E23
http://ibf4d.ukegaub.at/52C28F7421287E23
http://k3cxd.pileanoted.com/52C28F7421287E23
http://xzjvzkgjxebzreap.onion/52C28F7421287E23
Extracted
C:\Boot\bg-BG\-!RecOveR!-ftunh++.Txt
http://74bfc.flubspiel.com/D87F7A5EA1CD454A
http://ibf4d.ukegaub.at/D87F7A5EA1CD454A
http://k3cxd.pileanoted.com/D87F7A5EA1CD454A
http://xzjvzkgjxebzreap.onion/D87F7A5EA1CD454A
Targets
-
-
Target
8184432307b0f546d168e3e386a20999f5b0de0bd4085753bb2b09cfc7fec071.sample
-
Size
276KB
-
MD5
6bfa1c01c3af6206a189b975178965fe
-
SHA1
260dd322089862a5400a00dbcb35774b66ce2d47
-
SHA256
8184432307b0f546d168e3e386a20999f5b0de0bd4085753bb2b09cfc7fec071
-
SHA512
f518f82554b7a4d6c14655cd980ab710e08c20b3efb2979e39429c44cdf85f66f6db2021bd4758ec6cdcfa4c89fe3224628198094888adc4af243d17c730ddf8
Score10/10-
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Deletes itself
-
Drops startup file
-
Loads dropped DLL
-
Adds Run key to start application
-