General
-
Target
293317443192a9f2ce574febe990fad9ed399c760a350433020b06440dc92cfd
-
Size
372KB
-
Sample
220615-sh7jvscddk
-
MD5
69a333f36443f4e490e81a021aa7148b
-
SHA1
6261856cfc12e38b9b042bf18bba88066e036112
-
SHA256
293317443192a9f2ce574febe990fad9ed399c760a350433020b06440dc92cfd
-
SHA512
62e010ae830faa99b263aa2cd9932d3f1ef309d9bdef77248a8d0d6574b814f67f489af9f83db33263dafb4054d5ea08bbe49b482b0522200baba28f1a2704b7
Static task
static1
Behavioral task
behavioral1
Sample
293317443192a9f2ce574febe990fad9ed399c760a350433020b06440dc92cfd.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
293317443192a9f2ce574febe990fad9ed399c760a350433020b06440dc92cfd.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-1819626980-2277161760-1023733287-1000\Recovery+lmltp.txt
http://prest54538hnksjn4kjfwdbhwere.hotchunman.com/66E5E6E43B3C3CD0
http://b4youfred5485jgsa3453f.italazudda.com/66E5E6E43B3C3CD0
http://5rport45vcdef345adfkksawe.bematvocal.at/66E5E6E43B3C3CD0
http://fwgrhsao3aoml7ej.onion/66E5E6E43B3C3CD0
http://fwgrhsao3aoml7ej.ONION/66E5E6E43B3C3CD0
Extracted
C:\$Recycle.Bin\S-1-5-21-2632097139-1792035885-811742494-1000\Recovery+toilm.txt
http://prest54538hnksjn4kjfwdbhwere.hotchunman.com/CA9619913056196D
http://b4youfred5485jgsa3453f.italazudda.com/CA9619913056196D
http://5rport45vcdef345adfkksawe.bematvocal.at/CA9619913056196D
http://fwgrhsao3aoml7ej.onion/CA9619913056196D
http://fwgrhsao3aoml7ej.ONION/CA9619913056196D
Targets
-
-
Target
293317443192a9f2ce574febe990fad9ed399c760a350433020b06440dc92cfd
-
Size
372KB
-
MD5
69a333f36443f4e490e81a021aa7148b
-
SHA1
6261856cfc12e38b9b042bf18bba88066e036112
-
SHA256
293317443192a9f2ce574febe990fad9ed399c760a350433020b06440dc92cfd
-
SHA512
62e010ae830faa99b263aa2cd9932d3f1ef309d9bdef77248a8d0d6574b814f67f489af9f83db33263dafb4054d5ea08bbe49b482b0522200baba28f1a2704b7
Score10/10-
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-