General
-
Target
3e7affe327ebbf84f56bccd753c86122e0a1f0e8bf941547bfbcec775ab3ab94
-
Size
608KB
-
Sample
220701-h5gxlsheer
-
MD5
6a1dd1d327f60aee8509df877c8dc38c
-
SHA1
a2246029749e47a2532b016f80f5132f431e712f
-
SHA256
3e7affe327ebbf84f56bccd753c86122e0a1f0e8bf941547bfbcec775ab3ab94
-
SHA512
c29b9159c1bcb40db1a29cb3d91fc46e5b633db5e09ef52e8996a1d0e9900c153e6b68a7da680747215dbf0b03d34a1259fd17b90da01ff7c45cf1c4abedeaf3
Static task
static1
Behavioral task
behavioral1
Sample
3e7affe327ebbf84f56bccd753c86122e0a1f0e8bf941547bfbcec775ab3ab94.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3e7affe327ebbf84f56bccd753c86122e0a1f0e8bf941547bfbcec775ab3ab94.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-2277218442-1199762539-2004043321-1000\RECOVER+vnwgo.TXT
http://akdfrefdkm45tf33fsdfsdf.yamenswash.com/623DB21EC12B8DB
http://p4fhmjnsdfbm4w4fdsc.avowvoice.com/623DB21EC12B8DB
http://nn54djhfnrnm4dnjnerfsd.replylaten.at/623DB21EC12B8DB
http://fwgrhsao3aoml7ej.onion/623DB21EC12B8DB
Extracted
C:\$Recycle.Bin\S-1-5-21-3751123196-3323558407-1869646069-1000\RECOVER+mutxf.TXT
http://akdfrefdkm45tf33fsdfsdf.yamenswash.com/E54D105C443947B1
http://p4fhmjnsdfbm4w4fdsc.avowvoice.com/E54D105C443947B1
http://nn54djhfnrnm4dnjnerfsd.replylaten.at/E54D105C443947B1
http://fwgrhsao3aoml7ej.onion/E54D105C443947B1
Targets
-
-
Target
3e7affe327ebbf84f56bccd753c86122e0a1f0e8bf941547bfbcec775ab3ab94
-
Size
608KB
-
MD5
6a1dd1d327f60aee8509df877c8dc38c
-
SHA1
a2246029749e47a2532b016f80f5132f431e712f
-
SHA256
3e7affe327ebbf84f56bccd753c86122e0a1f0e8bf941547bfbcec775ab3ab94
-
SHA512
c29b9159c1bcb40db1a29cb3d91fc46e5b633db5e09ef52e8996a1d0e9900c153e6b68a7da680747215dbf0b03d34a1259fd17b90da01ff7c45cf1c4abedeaf3
Score10/10-
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-