General

  • Target

    293317443192a9f2ce574febe990fad9ed399c760a350433020b06440dc92cfd

  • Size

    372KB

  • Sample

    220615-sh7jvscddk

  • MD5

    69a333f36443f4e490e81a021aa7148b

  • SHA1

    6261856cfc12e38b9b042bf18bba88066e036112

  • SHA256

    293317443192a9f2ce574febe990fad9ed399c760a350433020b06440dc92cfd

  • SHA512

    62e010ae830faa99b263aa2cd9932d3f1ef309d9bdef77248a8d0d6574b814f67f489af9f83db33263dafb4054d5ea08bbe49b482b0522200baba28f1a2704b7

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-1819626980-2277161760-1023733287-1000\Recovery+lmltp.txt

Ransom Note
__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#! NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA-4096. More information about the encryption keys using RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA-4096 KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://prest54538hnksjn4kjfwdbhwere.hotchunman.com/66E5E6E43B3C3CD0 2. http://b4youfred5485jgsa3453f.italazudda.com/66E5E6E43B3C3CD0 3. http://5rport45vcdef345adfkksawe.bematvocal.at/66E5E6E43B3C3CD0 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser and wait for initialization 3. Type in the address bar: fwgrhsao3aoml7ej.onion/66E5E6E43B3C3CD0 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://prest54538hnksjn4kjfwdbhwere.hotchunman.com/66E5E6E43B3C3CD0 http://b4youfred5485jgsa3453f.italazudda.com/66E5E6E43B3C3CD0 http://5rport45vcdef345adfkksawe.bematvocal.at/66E5E6E43B3C3CD0 *-*-* Your personal page Tor-Browser: fwgrhsao3aoml7ej.ONION/66E5E6E43B3C3CD0 *-*-* Your personal identification ID: 66E5E6E43B3C3CD0
URLs

http://prest54538hnksjn4kjfwdbhwere.hotchunman.com/66E5E6E43B3C3CD0

http://b4youfred5485jgsa3453f.italazudda.com/66E5E6E43B3C3CD0

http://5rport45vcdef345adfkksawe.bematvocal.at/66E5E6E43B3C3CD0

http://fwgrhsao3aoml7ej.onion/66E5E6E43B3C3CD0

http://fwgrhsao3aoml7ej.ONION/66E5E6E43B3C3CD0

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-2632097139-1792035885-811742494-1000\Recovery+toilm.txt

Ransom Note
__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#! NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA-4096. More information about the encryption keys using RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA-4096 KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://prest54538hnksjn4kjfwdbhwere.hotchunman.com/CA9619913056196D 2. http://b4youfred5485jgsa3453f.italazudda.com/CA9619913056196D 3. http://5rport45vcdef345adfkksawe.bematvocal.at/CA9619913056196D If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser and wait for initialization 3. Type in the address bar: fwgrhsao3aoml7ej.onion/CA9619913056196D 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://prest54538hnksjn4kjfwdbhwere.hotchunman.com/CA9619913056196D http://b4youfred5485jgsa3453f.italazudda.com/CA9619913056196D http://5rport45vcdef345adfkksawe.bematvocal.at/CA9619913056196D *-*-* Your personal page Tor-Browser: fwgrhsao3aoml7ej.ONION/CA9619913056196D *-*-* Your personal identification ID: CA9619913056196D
URLs

http://prest54538hnksjn4kjfwdbhwere.hotchunman.com/CA9619913056196D

http://b4youfred5485jgsa3453f.italazudda.com/CA9619913056196D

http://5rport45vcdef345adfkksawe.bematvocal.at/CA9619913056196D

http://fwgrhsao3aoml7ej.onion/CA9619913056196D

http://fwgrhsao3aoml7ej.ONION/CA9619913056196D

Targets

    • Target

      293317443192a9f2ce574febe990fad9ed399c760a350433020b06440dc92cfd

    • Size

      372KB

    • MD5

      69a333f36443f4e490e81a021aa7148b

    • SHA1

      6261856cfc12e38b9b042bf18bba88066e036112

    • SHA256

      293317443192a9f2ce574febe990fad9ed399c760a350433020b06440dc92cfd

    • SHA512

      62e010ae830faa99b263aa2cd9932d3f1ef309d9bdef77248a8d0d6574b814f67f489af9f83db33263dafb4054d5ea08bbe49b482b0522200baba28f1a2704b7

    • suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon

      suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

File Deletion

1
T1107

Modify Registry

2
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Impact

Inhibit System Recovery

1
T1490

Tasks