General
-
Target
2f0810867bfe800a8b8028b43570a6ee4147c611deadf90a51167590bb7a2e04
-
Size
372KB
-
Sample
220622-ajgqqaffaq
-
MD5
6de3b59f26dda2c66e22365020580483
-
SHA1
60ca0323a0fa7f0846e4250b2915590546b6b224
-
SHA256
2f0810867bfe800a8b8028b43570a6ee4147c611deadf90a51167590bb7a2e04
-
SHA512
3eac93a917aedc5a4b3ea4f69b8ab6099fe8bffc2de9dc43b1e5d5f4dce7e01e95d4076a8e23cabaa758f6a9c954482539af9d268205ea8c59b66238b9b1633f
Static task
static1
Behavioral task
behavioral1
Sample
2f0810867bfe800a8b8028b43570a6ee4147c611deadf90a51167590bb7a2e04.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
2f0810867bfe800a8b8028b43570a6ee4147c611deadf90a51167590bb7a2e04.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-2277218442-1199762539-2004043321-1000\Recovery+nvgbs.txt
http://prest54538hnksjn4kjfwdbhwere.hotchunman.com/3D7199477E9449CB
http://b4youfred5485jgsa3453f.italazudda.com/3D7199477E9449CB
http://5rport45vcdef345adfkksawe.bematvocal.at/3D7199477E9449CB
http://fwgrhsao3aoml7ej.onion/3D7199477E9449CB
http://fwgrhsao3aoml7ej.ONION/3D7199477E9449CB
Extracted
C:\$Recycle.Bin\S-1-5-21-2632097139-1792035885-811742494-1000\Recovery+pguwy.txt
http://prest54538hnksjn4kjfwdbhwere.hotchunman.com/6CD94D8E257E9055
http://b4youfred5485jgsa3453f.italazudda.com/6CD94D8E257E9055
http://5rport45vcdef345adfkksawe.bematvocal.at/6CD94D8E257E9055
http://fwgrhsao3aoml7ej.onion/6CD94D8E257E9055
http://fwgrhsao3aoml7ej.ONION/6CD94D8E257E9055
Targets
-
-
Target
2f0810867bfe800a8b8028b43570a6ee4147c611deadf90a51167590bb7a2e04
-
Size
372KB
-
MD5
6de3b59f26dda2c66e22365020580483
-
SHA1
60ca0323a0fa7f0846e4250b2915590546b6b224
-
SHA256
2f0810867bfe800a8b8028b43570a6ee4147c611deadf90a51167590bb7a2e04
-
SHA512
3eac93a917aedc5a4b3ea4f69b8ab6099fe8bffc2de9dc43b1e5d5f4dce7e01e95d4076a8e23cabaa758f6a9c954482539af9d268205ea8c59b66238b9b1633f
Score10/10-
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-