General
-
Target
3ef5a3250c0f99b2e0dca03b2c3123c0d34c51d9649d9488ebc081600a9f4118
-
Size
372KB
-
Sample
220701-ek8caabbfp
-
MD5
6512c1c93671ce88e6ad8df5d9e7b24c
-
SHA1
69abb4516bf4cc174fc22e7850dda8659eec9b6a
-
SHA256
3ef5a3250c0f99b2e0dca03b2c3123c0d34c51d9649d9488ebc081600a9f4118
-
SHA512
d8bc59194b389385262ac5862b042280d3cf1d66c0cdd0353a6047ff51db65982fbe0d77c81416e52b6be33cbe3b956223799041cc7741a32cb97a38a559259d
Static task
static1
Behavioral task
behavioral1
Sample
3ef5a3250c0f99b2e0dca03b2c3123c0d34c51d9649d9488ebc081600a9f4118.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3ef5a3250c0f99b2e0dca03b2c3123c0d34c51d9649d9488ebc081600a9f4118.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-1083475884-596052423-1669053738-1000\Recovery+njauv.txt
http://prest54538hnksjn4kjfwdbhwere.hotchunman.com/727680722742E5BA
http://b4youfred5485jgsa3453f.italazudda.com/727680722742E5BA
http://5rport45vcdef345adfkksawe.bematvocal.at/727680722742E5BA
http://fwgrhsao3aoml7ej.onion/727680722742E5BA
http://fwgrhsao3aoml7ej.ONION/727680722742E5BA
Extracted
C:\$Recycle.Bin\S-1-5-21-2632097139-1792035885-811742494-1000\Recovery+sxwtg.txt
http://prest54538hnksjn4kjfwdbhwere.hotchunman.com/35BB65B1272E10A7
http://b4youfred5485jgsa3453f.italazudda.com/35BB65B1272E10A7
http://5rport45vcdef345adfkksawe.bematvocal.at/35BB65B1272E10A7
http://fwgrhsao3aoml7ej.onion/35BB65B1272E10A7
http://fwgrhsao3aoml7ej.ONION/35BB65B1272E10A7
Targets
-
-
Target
3ef5a3250c0f99b2e0dca03b2c3123c0d34c51d9649d9488ebc081600a9f4118
-
Size
372KB
-
MD5
6512c1c93671ce88e6ad8df5d9e7b24c
-
SHA1
69abb4516bf4cc174fc22e7850dda8659eec9b6a
-
SHA256
3ef5a3250c0f99b2e0dca03b2c3123c0d34c51d9649d9488ebc081600a9f4118
-
SHA512
d8bc59194b389385262ac5862b042280d3cf1d66c0cdd0353a6047ff51db65982fbe0d77c81416e52b6be33cbe3b956223799041cc7741a32cb97a38a559259d
Score10/10-
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-