General
-
Target
0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256
-
Size
604KB
-
Sample
220604-x9jz4agher
-
MD5
5836ef38d2aa4152f5787e506951048c
-
SHA1
72e36c98291f7dad95fa2a77f0d843e6b931f0dd
-
SHA256
0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256
-
SHA512
4540097f7cead8f61bc71aed09564fb15da6e6b52dfe97a7e47431790241c5f13be5c6e7120326162fb54ed06b0a2618896cd91809595b04c519381121df71a2
Static task
static1
Behavioral task
behavioral1
Sample
0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-1083475884-596052423-1669053738-1000\_H_e_l_p_RECOVER_INSTRUCTIONS+ctn.txt
http://jj4dhbg4d86sdgrsdfzcadc.ziraimshi.com/4195E03EE465B15B
http://uu5dbnmsedf4s3jdnfbh34fsdf.parsesun.at/4195E03EE465B15B
http://perc54hg47fhnkjnfvcdgvdc.clinkjuno.com/4195E03EE465B15B
http://fwgrhsao3aoml7ej.onion/4195E03EE465B15B
Extracted
C:\$Recycle.Bin\S-1-5-21-2632097139-1792035885-811742494-1000\_H_e_l_p_RECOVER_INSTRUCTIONS+bfq.txt
http://jj4dhbg4d86sdgrsdfzcadc.ziraimshi.com/79DEB3EF5598668
http://uu5dbnmsedf4s3jdnfbh34fsdf.parsesun.at/79DEB3EF5598668
http://perc54hg47fhnkjnfvcdgvdc.clinkjuno.com/79DEB3EF5598668
http://fwgrhsao3aoml7ej.onion/79DEB3EF5598668
Targets
-
-
Target
0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256
-
Size
604KB
-
MD5
5836ef38d2aa4152f5787e506951048c
-
SHA1
72e36c98291f7dad95fa2a77f0d843e6b931f0dd
-
SHA256
0e3eeeff8a9838a73de58d935e38417fca0b4948849343fc2a94251c4e4e4256
-
SHA512
4540097f7cead8f61bc71aed09564fb15da6e6b52dfe97a7e47431790241c5f13be5c6e7120326162fb54ed06b0a2618896cd91809595b04c519381121df71a2
Score10/10-
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
-
Modifies boot configuration data using bcdedit
-
Adds policy Run key to start application
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-