General
-
Target
29a895e02f76f777c976eb865f8a8d49c2e721223bd3c98d8f4f60a8c96b9583
-
Size
608KB
-
Sample
220615-qy8qrabhh3
-
MD5
06f298ca1b04905975e45371d6594fbf
-
SHA1
6046763379a81c4be4cc733f750429f28f8892dd
-
SHA256
29a895e02f76f777c976eb865f8a8d49c2e721223bd3c98d8f4f60a8c96b9583
-
SHA512
4f0144b47f7ce29908dedb1669fb58e94508e8c7af9ab0be04a61442b9f73765ace6bb604349b61ebdffaf68c77021b72e6848f48faead75826549fd7976e640
Static task
static1
Behavioral task
behavioral1
Sample
29a895e02f76f777c976eb865f8a8d49c2e721223bd3c98d8f4f60a8c96b9583.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
29a895e02f76f777c976eb865f8a8d49c2e721223bd3c98d8f4f60a8c96b9583.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-1083475884-596052423-1669053738-1000\RECOVER+paxmx.TXT
http://akdfrefdkm45tf33fsdfsdf.yamenswash.com/C8874E3A14BD870
http://p4fhmjnsdfbm4w4fdsc.avowvoice.com/C8874E3A14BD870
http://nn54djhfnrnm4dnjnerfsd.replylaten.at/C8874E3A14BD870
http://fwgrhsao3aoml7ej.onion/C8874E3A14BD870
Extracted
C:\$Recycle.Bin\S-1-5-21-2632097139-1792035885-811742494-1000\RECOVER+seekg.TXT
http://akdfrefdkm45tf33fsdfsdf.yamenswash.com/6AB85974F3829A73
http://p4fhmjnsdfbm4w4fdsc.avowvoice.com/6AB85974F3829A73
http://nn54djhfnrnm4dnjnerfsd.replylaten.at/6AB85974F3829A73
http://fwgrhsao3aoml7ej.onion/6AB85974F3829A73
Targets
-
-
Target
29a895e02f76f777c976eb865f8a8d49c2e721223bd3c98d8f4f60a8c96b9583
-
Size
608KB
-
MD5
06f298ca1b04905975e45371d6594fbf
-
SHA1
6046763379a81c4be4cc733f750429f28f8892dd
-
SHA256
29a895e02f76f777c976eb865f8a8d49c2e721223bd3c98d8f4f60a8c96b9583
-
SHA512
4f0144b47f7ce29908dedb1669fb58e94508e8c7af9ab0be04a61442b9f73765ace6bb604349b61ebdffaf68c77021b72e6848f48faead75826549fd7976e640
Score10/10-
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-