General

  • Target

    3921cb707f4e47deafff47d53d066217f4fe97546f7427ecb2c0fca1ce015a3a

  • Size

    410KB

  • Sample

    220625-wb2ltaeabl

  • MD5

    80dc3c416941c3d8955fd132d29d2500

  • SHA1

    5800d69fbb28e74b7683bdfcc2d230095e44e996

  • SHA256

    3921cb707f4e47deafff47d53d066217f4fe97546f7427ecb2c0fca1ce015a3a

  • SHA512

    ac0434782766d7ff161818133c6a5d5f4819f03abd93fdd38b40aa3dcb2332a63ba88f09ff6245ceb28cc9517713df7072048e384bc7236b3fa8047a19252247

Score
10/10

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-1083475884-596052423-1669053738-1000\RECOVERoutwt.txt

Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com What's the matter with your files? Your data was secured using a strong encryption with RSA4096. Use the link down below to find additional information on the encryption keys using RSA4096:https://en.wikipedia.org/wiki/RSA_(cryptosystem) What exactly that means? It means that on a structural level your files have been transformed. You won't be able to use, read, see or work with them anymore. In other words they are useless, however, there is a possibility to restore them with our help. What exactly happened to your files? *** Two personal RSA4096 keys were generated for your PC/Laptop; one key is public, another key is private. *** All your data and files were encrypted by the means of the public key, which you received over the web. *** In order to decrypt your data and gain access to your computer you need a private key and a decryption software, which can be found on one of our secret servers. What should you do next? There are several options for you to consider: 1. You can wait for a while until the price of a private key will raise, so you will have to pay twice as much to access your files or 2. You can start getting BitCoins right now and get access to your data quite fast. In case you have valuable files, we advise you to act fast as there is no other option rather than paying in order to get back your data. In order to obtain specific instructions, please access your personal homepage by choosing one of the few addresses down below: http://kkr4hbwdklf234bfl84uoqleflqwrfqwuelfh.brazabaya.com/228D5240A2F4AE2A http://974gfbjhb23hbfkyfaby3byqlyuebvly5q254y.mendilobo.com/228D5240A2F4AE2A http://a64gfdsjhb4htbiwaysbdvukyft5q.zobodine.at/228D5240A2F4AE2A If you can't access your personal homepage or the addresses are not working, complete the following steps: 1. Download TOR Browser - http://www.torproject.org/projects/torbrowser.html.en 2. Install TOR Browser 3. Open TOR Browser 4. Insert the following link in the address bar: k7tlx3ghr3m4n2tu.onion/228D5240A2F4AE2A 5. Follow the steps on your screen IMPORTANT INFORMATION Your personal homepages: http://kkr4hbwdklf234bfl84uoqleflqwrfqwuelfh.brazabaya.com/228D5240A2F4AE2A http://974gfbjhb23hbfkyfaby3byqlyuebvly5q254y.mendilobo.com/228D5240A2F4AE2A http://a64gfdsjhb4htbiwaysbdvukyft5q.zobodine.at/228D5240A2F4AE2A Your personal page Tor-Browser k7tlx3ghr3m4n2tu.onion/228D5240A2F4AE2A Your personal identification ID: 228D5240A2F4AE2A
URLs

http://kkr4hbwdklf234bfl84uoqleflqwrfqwuelfh.brazabaya.com/228D5240A2F4AE2A

http://974gfbjhb23hbfkyfaby3byqlyuebvly5q254y.mendilobo.com/228D5240A2F4AE2A

http://a64gfdsjhb4htbiwaysbdvukyft5q.zobodine.at/228D5240A2F4AE2A

http://k7tlx3ghr3m4n2tu.onion/228D5240A2F4AE2A

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-3751123196-3323558407-1869646069-1000\RECOVERnlxbd.txt

Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com What's the matter with your files? Your data was secured using a strong encryption with RSA4096. Use the link down below to find additional information on the encryption keys using RSA4096:https://en.wikipedia.org/wiki/RSA_(cryptosystem) What exactly that means? It means that on a structural level your files have been transformed. You won't be able to use, read, see or work with them anymore. In other words they are useless, however, there is a possibility to restore them with our help. What exactly happened to your files? *** Two personal RSA4096 keys were generated for your PC/Laptop; one key is public, another key is private. *** All your data and files were encrypted by the means of the public key, which you received over the web. *** In order to decrypt your data and gain access to your computer you need a private key and a decryption software, which can be found on one of our secret servers. What should you do next? There are several options for you to consider: 1. You can wait for a while until the price of a private key will raise, so you will have to pay twice as much to access your files or 2. You can start getting BitCoins right now and get access to your data quite fast. In case you have valuable files, we advise you to act fast as there is no other option rather than paying in order to get back your data. In order to obtain specific instructions, please access your personal homepage by choosing one of the few addresses down below: http://kkr4hbwdklf234bfl84uoqleflqwrfqwuelfh.brazabaya.com/39F1AA9E73F6D5A http://974gfbjhb23hbfkyfaby3byqlyuebvly5q254y.mendilobo.com/39F1AA9E73F6D5A http://a64gfdsjhb4htbiwaysbdvukyft5q.zobodine.at/39F1AA9E73F6D5A If you can't access your personal homepage or the addresses are not working, complete the following steps: 1. Download TOR Browser - http://www.torproject.org/projects/torbrowser.html.en 2. Install TOR Browser 3. Open TOR Browser 4. Insert the following link in the address bar: k7tlx3ghr3m4n2tu.onion/39F1AA9E73F6D5A 5. Follow the steps on your screen IMPORTANT INFORMATION Your personal homepages: http://kkr4hbwdklf234bfl84uoqleflqwrfqwuelfh.brazabaya.com/39F1AA9E73F6D5A http://974gfbjhb23hbfkyfaby3byqlyuebvly5q254y.mendilobo.com/39F1AA9E73F6D5A http://a64gfdsjhb4htbiwaysbdvukyft5q.zobodine.at/39F1AA9E73F6D5A Your personal page Tor-Browser k7tlx3ghr3m4n2tu.onion/39F1AA9E73F6D5A Your personal identification ID: 39F1AA9E73F6D5A
URLs

http://kkr4hbwdklf234bfl84uoqleflqwrfqwuelfh.brazabaya.com/39F1AA9E73F6D5A

http://974gfbjhb23hbfkyfaby3byqlyuebvly5q254y.mendilobo.com/39F1AA9E73F6D5A

http://a64gfdsjhb4htbiwaysbdvukyft5q.zobodine.at/39F1AA9E73F6D5A

http://k7tlx3ghr3m4n2tu.onion/39F1AA9E73F6D5A

Targets

    • Target

      3921cb707f4e47deafff47d53d066217f4fe97546f7427ecb2c0fca1ce015a3a

    • Size

      410KB

    • MD5

      80dc3c416941c3d8955fd132d29d2500

    • SHA1

      5800d69fbb28e74b7683bdfcc2d230095e44e996

    • SHA256

      3921cb707f4e47deafff47d53d066217f4fe97546f7427ecb2c0fca1ce015a3a

    • SHA512

      ac0434782766d7ff161818133c6a5d5f4819f03abd93fdd38b40aa3dcb2332a63ba88f09ff6245ceb28cc9517713df7072048e384bc7236b3fa8047a19252247

    Score
    10/10
    • suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon

      suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks