General
-
Target
1d566994b2581a895e9680e7bbdc3908deebd409f265da389b996ffbed2c158f
-
Size
616KB
-
Sample
220607-ehkhfagac2
-
MD5
53c84ec33f905e5752991721cf27cdf4
-
SHA1
083799bd8d63162646c420f5d24a1bae7efbe546
-
SHA256
1d566994b2581a895e9680e7bbdc3908deebd409f265da389b996ffbed2c158f
-
SHA512
bafd06dd3791febf85c5c84f8afa83c3a3558e721cc16dfeee2ec732f7698c33df80002d6122a0547e18162f39606fabc6b143ac94c75dbb88e78d9b58cb239a
Static task
static1
Behavioral task
behavioral1
Sample
1d566994b2581a895e9680e7bbdc3908deebd409f265da389b996ffbed2c158f.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
1d566994b2581a895e9680e7bbdc3908deebd409f265da389b996ffbed2c158f.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-2277218442-1199762539-2004043321-1000\Recovery+fqbod.txt
http://p57gest54celltraf743knjf.mottesapo.com/27DF38B4883B9A9
http://k4restportgonst34d23r.oftpony.at/27DF38B4883B9A9
http://rr7mdgjbjhbefvkhbashrg.ginnypecht.com/27DF38B4883B9A9
http://fwgrhsao3aoml7ej.onion/27DF38B4883B9A9
http://fwgrhsao3aoml7ej.ONION/27DF38B4883B9A9
Extracted
C:\$Recycle.Bin\S-1-5-21-3751123196-3323558407-1869646069-1000\Recovery+dtfkn.txt
http://p57gest54celltraf743knjf.mottesapo.com/884B91B1E3A2815F
http://k4restportgonst34d23r.oftpony.at/884B91B1E3A2815F
http://rr7mdgjbjhbefvkhbashrg.ginnypecht.com/884B91B1E3A2815F
http://fwgrhsao3aoml7ej.onion/884B91B1E3A2815F
http://fwgrhsao3aoml7ej.ONION/884B91B1E3A2815F
Targets
-
-
Target
1d566994b2581a895e9680e7bbdc3908deebd409f265da389b996ffbed2c158f
-
Size
616KB
-
MD5
53c84ec33f905e5752991721cf27cdf4
-
SHA1
083799bd8d63162646c420f5d24a1bae7efbe546
-
SHA256
1d566994b2581a895e9680e7bbdc3908deebd409f265da389b996ffbed2c158f
-
SHA512
bafd06dd3791febf85c5c84f8afa83c3a3558e721cc16dfeee2ec732f7698c33df80002d6122a0547e18162f39606fabc6b143ac94c75dbb88e78d9b58cb239a
Score10/10-
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-