General
-
Target
202ab1a5c4d7809c216ff364842923ed5b133f652159147396e02c1f7fd06685
-
Size
604KB
-
Sample
220612-qqdweahed9
-
MD5
0eff9e6701cb10ddc66f3d619dae7a36
-
SHA1
20a506351b97caef312b7f808638623512435c23
-
SHA256
202ab1a5c4d7809c216ff364842923ed5b133f652159147396e02c1f7fd06685
-
SHA512
41bc0934a29ae6f18804006ac9ff264ec1b41edc0bc2b312db4e24f14acd64a3c6f0838406c9d0d1d70ebc8aad7fb0b9a9882401e7e807aec95c999be9923c01
Static task
static1
Behavioral task
behavioral1
Sample
202ab1a5c4d7809c216ff364842923ed5b133f652159147396e02c1f7fd06685.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
202ab1a5c4d7809c216ff364842923ed5b133f652159147396e02c1f7fd06685.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-1819626980-2277161760-1023733287-1000\_H_e_l_p_RECOVER_INSTRUCTIONS+hgi.txt
http://jj4dhbg4d86sdgrsdfzcadc.ziraimshi.com/29E01CCCDE9BD5E7
http://uu5dbnmsedf4s3jdnfbh34fsdf.parsesun.at/29E01CCCDE9BD5E7
http://perc54hg47fhnkjnfvcdgvdc.clinkjuno.com/29E01CCCDE9BD5E7
http://fwgrhsao3aoml7ej.onion/29E01CCCDE9BD5E7
Extracted
C:\$Recycle.Bin\S-1-5-21-2632097139-1792035885-811742494-1000\_H_e_l_p_RECOVER_INSTRUCTIONS+aiq.txt
http://jj4dhbg4d86sdgrsdfzcadc.ziraimshi.com/EAFE5591E4426EFA
http://uu5dbnmsedf4s3jdnfbh34fsdf.parsesun.at/EAFE5591E4426EFA
http://perc54hg47fhnkjnfvcdgvdc.clinkjuno.com/EAFE5591E4426EFA
http://fwgrhsao3aoml7ej.onion/EAFE5591E4426EFA
Targets
-
-
Target
202ab1a5c4d7809c216ff364842923ed5b133f652159147396e02c1f7fd06685
-
Size
604KB
-
MD5
0eff9e6701cb10ddc66f3d619dae7a36
-
SHA1
20a506351b97caef312b7f808638623512435c23
-
SHA256
202ab1a5c4d7809c216ff364842923ed5b133f652159147396e02c1f7fd06685
-
SHA512
41bc0934a29ae6f18804006ac9ff264ec1b41edc0bc2b312db4e24f14acd64a3c6f0838406c9d0d1d70ebc8aad7fb0b9a9882401e7e807aec95c999be9923c01
Score10/10-
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
-
Modifies boot configuration data using bcdedit
-
Adds policy Run key to start application
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-