General

  • Target

    305858e0866dfa53436a14a2493a87aa9e88a85bdb8c87352f11050be461c093

  • Size

    396KB

  • Sample

    220621-eyft7abdhl

  • MD5

    3d2d7e095c2c74036f299724faaa584b

  • SHA1

    eb296cce6ed9c5ea7180828c31ebff6c76fa8639

  • SHA256

    305858e0866dfa53436a14a2493a87aa9e88a85bdb8c87352f11050be461c093

  • SHA512

    82e5e0677e1bfcbd03a769237c989ce0901e95e95f09853ad34b2a653c12a4423a34971e1ac6d29885597142ff1f18c2912bac2b85d16dd3f7d6cca89ac94302

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-1819626980-2277161760-1023733287-1000\RECOVERhelgy.txt

Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com What's the matter with your files? Your data was secured using a strong encryption with RSA4096. Use the link down below to find additional information on the encryption keys using RSA4096:https://en.wikipedia.org/wiki/RSA_(cryptosystem) What exactly that means? It means that on a structural level your files have been transformed. You won't be able to use, read, see or work with them anymore. In other words they are useless, however, there is a possibility to restore them with our help. What exactly happened to your files? *** Two personal RSA4096 keys were generated for your PC/Laptop; one key is public, another key is private. *** All your data and files were encrypted by the means of the public key, which you received over the web. *** In order to decrypt your data and gain access to your computer you need a private key and a decryption software, which can be found on one of our secret servers. What should you do next? There are several options for you to consider: 1. You can wait for a while until the price of a private key will raise, so you will have to pay twice as much to access your files or 2. You can start getting BitCoins right now and get access to your data quite fast. In case you have valuable files, we advise you to act fast as there is no other option rather than paying in order to get back your data. In order to obtain specific instructions, please access your personal homepage by choosing one of the few addresses down below: http://h5nuwefkuh134ljngkasdbasfg.corolbugan.com/3AABDCA29990ECA6 http://p54dhkus4tlkfashdb6vjetgsdfg.greetingshere.at/3AABDCA29990ECA6 http://f4dsbjhb45wfiuqeib4fkqeg.meccaledgy.at/3AABDCA29990ECA6 If you can't access your personal homepage or the addresses are not working, complete the following steps: 1 Download TOR Browser - http://www.torproject.org/projects/torbrowser.html.en 2 Install TOR Browser 3 Open TOR Browser 4 Insert the following link in the address bar: k7tlx3ghr3m4n2tu.onion/3AABDCA29990ECA6 5 Follow the steps on your screen IMPORTANT INFORMATION Your personal homepages: http://h5nuwefkuh134ljngkasdbasfg.corolbugan.com/3AABDCA29990ECA6 http://p54dhkus4tlkfashdb6vjetgsdfg.greetingshere.at/3AABDCA29990ECA6 http://f4dsbjhb45wfiuqeib4fkqeg.meccaledgy.at/3AABDCA29990ECA6 Your personal page Tor-Browser k7tlx3ghr3m4n2tu.onion/3AABDCA29990ECA6 Your personal identification ID: 3AABDCA29990ECA6
URLs

http://h5nuwefkuh134ljngkasdbasfg.corolbugan.com/3AABDCA29990ECA6

http://p54dhkus4tlkfashdb6vjetgsdfg.greetingshere.at/3AABDCA29990ECA6

http://f4dsbjhb45wfiuqeib4fkqeg.meccaledgy.at/3AABDCA29990ECA6

http://k7tlx3ghr3m4n2tu.onion/3AABDCA29990ECA6

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-1809750270-3141839489-3074374771-1000\RECOVERorxvn.txt

Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com What's the matter with your files? Your data was secured using a strong encryption with RSA4096. Use the link down below to find additional information on the encryption keys using RSA4096:https://en.wikipedia.org/wiki/RSA_(cryptosystem) What exactly that means? It means that on a structural level your files have been transformed. You won't be able to use, read, see or work with them anymore. In other words they are useless, however, there is a possibility to restore them with our help. What exactly happened to your files? *** Two personal RSA4096 keys were generated for your PC/Laptop; one key is public, another key is private. *** All your data and files were encrypted by the means of the public key, which you received over the web. *** In order to decrypt your data and gain access to your computer you need a private key and a decryption software, which can be found on one of our secret servers. What should you do next? There are several options for you to consider: 1. You can wait for a while until the price of a private key will raise, so you will have to pay twice as much to access your files or 2. You can start getting BitCoins right now and get access to your data quite fast. In case you have valuable files, we advise you to act fast as there is no other option rather than paying in order to get back your data. In order to obtain specific instructions, please access your personal homepage by choosing one of the few addresses down below: http://h5nuwefkuh134ljngkasdbasfg.corolbugan.com/F88C1F770899B7B http://p54dhkus4tlkfashdb6vjetgsdfg.greetingshere.at/F88C1F770899B7B http://f4dsbjhb45wfiuqeib4fkqeg.meccaledgy.at/F88C1F770899B7B If you can't access your personal homepage or the addresses are not working, complete the following steps: 1 Download TOR Browser - http://www.torproject.org/projects/torbrowser.html.en 2 Install TOR Browser 3 Open TOR Browser 4 Insert the following link in the address bar: k7tlx3ghr3m4n2tu.onion/F88C1F770899B7B 5 Follow the steps on your screen IMPORTANT INFORMATION Your personal homepages: http://h5nuwefkuh134ljngkasdbasfg.corolbugan.com/F88C1F770899B7B http://p54dhkus4tlkfashdb6vjetgsdfg.greetingshere.at/F88C1F770899B7B http://f4dsbjhb45wfiuqeib4fkqeg.meccaledgy.at/F88C1F770899B7B Your personal page Tor-Browser k7tlx3ghr3m4n2tu.onion/F88C1F770899B7B Your personal identification ID: F88C1F770899B7B
URLs

http://h5nuwefkuh134ljngkasdbasfg.corolbugan.com/F88C1F770899B7B

http://p54dhkus4tlkfashdb6vjetgsdfg.greetingshere.at/F88C1F770899B7B

http://f4dsbjhb45wfiuqeib4fkqeg.meccaledgy.at/F88C1F770899B7B

http://k7tlx3ghr3m4n2tu.onion/F88C1F770899B7B

Targets

    • Target

      305858e0866dfa53436a14a2493a87aa9e88a85bdb8c87352f11050be461c093

    • Size

      396KB

    • MD5

      3d2d7e095c2c74036f299724faaa584b

    • SHA1

      eb296cce6ed9c5ea7180828c31ebff6c76fa8639

    • SHA256

      305858e0866dfa53436a14a2493a87aa9e88a85bdb8c87352f11050be461c093

    • SHA512

      82e5e0677e1bfcbd03a769237c989ce0901e95e95f09853ad34b2a653c12a4423a34971e1ac6d29885597142ff1f18c2912bac2b85d16dd3f7d6cca89ac94302

    • suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon

      suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks