General
-
Target
3921cb707f4e47deafff47d53d066217f4fe97546f7427ecb2c0fca1ce015a3a
-
Size
410KB
-
Sample
220625-wb2ltaeabl
-
MD5
80dc3c416941c3d8955fd132d29d2500
-
SHA1
5800d69fbb28e74b7683bdfcc2d230095e44e996
-
SHA256
3921cb707f4e47deafff47d53d066217f4fe97546f7427ecb2c0fca1ce015a3a
-
SHA512
ac0434782766d7ff161818133c6a5d5f4819f03abd93fdd38b40aa3dcb2332a63ba88f09ff6245ceb28cc9517713df7072048e384bc7236b3fa8047a19252247
Static task
static1
Behavioral task
behavioral1
Sample
3921cb707f4e47deafff47d53d066217f4fe97546f7427ecb2c0fca1ce015a3a.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3921cb707f4e47deafff47d53d066217f4fe97546f7427ecb2c0fca1ce015a3a.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-1083475884-596052423-1669053738-1000\RECOVERoutwt.txt
http://kkr4hbwdklf234bfl84uoqleflqwrfqwuelfh.brazabaya.com/228D5240A2F4AE2A
http://974gfbjhb23hbfkyfaby3byqlyuebvly5q254y.mendilobo.com/228D5240A2F4AE2A
http://a64gfdsjhb4htbiwaysbdvukyft5q.zobodine.at/228D5240A2F4AE2A
http://k7tlx3ghr3m4n2tu.onion/228D5240A2F4AE2A
Extracted
C:\$Recycle.Bin\S-1-5-21-3751123196-3323558407-1869646069-1000\RECOVERnlxbd.txt
http://kkr4hbwdklf234bfl84uoqleflqwrfqwuelfh.brazabaya.com/39F1AA9E73F6D5A
http://974gfbjhb23hbfkyfaby3byqlyuebvly5q254y.mendilobo.com/39F1AA9E73F6D5A
http://a64gfdsjhb4htbiwaysbdvukyft5q.zobodine.at/39F1AA9E73F6D5A
http://k7tlx3ghr3m4n2tu.onion/39F1AA9E73F6D5A
Targets
-
-
Target
3921cb707f4e47deafff47d53d066217f4fe97546f7427ecb2c0fca1ce015a3a
-
Size
410KB
-
MD5
80dc3c416941c3d8955fd132d29d2500
-
SHA1
5800d69fbb28e74b7683bdfcc2d230095e44e996
-
SHA256
3921cb707f4e47deafff47d53d066217f4fe97546f7427ecb2c0fca1ce015a3a
-
SHA512
ac0434782766d7ff161818133c6a5d5f4819f03abd93fdd38b40aa3dcb2332a63ba88f09ff6245ceb28cc9517713df7072048e384bc7236b3fa8047a19252247
Score10/10-
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-