General

  • Target

    43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b

  • Size

    410KB

  • Sample

    220707-1qdkrafcg3

  • MD5

    56815047f7f330dcb598899915d6606e

  • SHA1

    8f20faecf7448606c2601bc03f94a6ed4d7c960b

  • SHA256

    43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b

  • SHA512

    fbc69c4cb808840209bec0ac52cf29e0442fc80c72dea460ced3dc0ef6e035fef7da9dbd21b8fd1ebebfdf43b02184c65ee73995473fc075bb6ad2de113fba03

Score
10/10

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-1819626980-2277161760-1023733287-1000\RECOVERaduws.txt

Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com What's the matter with your files? Your data was secured using a strong encryption with RSA4096. Use the link down below to find additional information on the encryption keys using RSA4096:https://en.wikipedia.org/wiki/RSA_(cryptosystem) What exactly that means? It means that on a structural level your files have been transformed. You won't be able to use, read, see or work with them anymore. In other words they are useless, however, there is a possibility to restore them with our help. What exactly happened to your files? *** Two personal RSA4096 keys were generated for your PC/Laptop; one key is public, another key is private. *** All your data and files were encrypted by the means of the public key, which you received over the web. *** In order to decrypt your data and gain access to your computer you need a private key and a decryption software, which can be found on one of our secret servers. What should you do next? There are several options for you to consider: 1. You can wait for a while until the price of a private key will raise, so you will have to pay twice as much to access your files or 2. You can start getting BitCoins right now and get access to your data quite fast. In case you have valuable files, we advise you to act fast as there is no other option rather than paying in order to get back your data. In order to obtain specific instructions, please access your personal homepage by choosing one of the few addresses down below: http://kkr4hbwdklf234bfl84uoqleflqwrfqwuelfh.brazabaya.com/37E76456ECB79F http://974gfbjhb23hbfkyfaby3byqlyuebvly5q254y.mendilobo.com/37E76456ECB79F http://a64gfdsjhb4htbiwaysbdvukyft5q.zobodine.at/37E76456ECB79F If you can't access your personal homepage or the addresses are not working, complete the following steps: 1. Download TOR Browser - http://www.torproject.org/projects/torbrowser.html.en 2. Install TOR Browser 3. Open TOR Browser 4. Insert the following link in the address bar: k7tlx3ghr3m4n2tu.onion/37E76456ECB79F 5. Follow the steps on your screen IMPORTANT INFORMATION Your personal homepages: http://kkr4hbwdklf234bfl84uoqleflqwrfqwuelfh.brazabaya.com/37E76456ECB79F http://974gfbjhb23hbfkyfaby3byqlyuebvly5q254y.mendilobo.com/37E76456ECB79F http://a64gfdsjhb4htbiwaysbdvukyft5q.zobodine.at/37E76456ECB79F Your personal page Tor-Browser k7tlx3ghr3m4n2tu.onion/37E76456ECB79F Your personal identification ID: 37E76456ECB79F
URLs

http://kkr4hbwdklf234bfl84uoqleflqwrfqwuelfh.brazabaya.com/37E76456ECB79F

http://974gfbjhb23hbfkyfaby3byqlyuebvly5q254y.mendilobo.com/37E76456ECB79F

http://a64gfdsjhb4htbiwaysbdvukyft5q.zobodine.at/37E76456ECB79F

http://k7tlx3ghr3m4n2tu.onion/37E76456ECB79F

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-1809750270-3141839489-3074374771-1000\RECOVERgmtxs.txt

Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com What's the matter with your files? Your data was secured using a strong encryption with RSA4096. Use the link down below to find additional information on the encryption keys using RSA4096:https://en.wikipedia.org/wiki/RSA_(cryptosystem) What exactly that means? It means that on a structural level your files have been transformed. You won't be able to use, read, see or work with them anymore. In other words they are useless, however, there is a possibility to restore them with our help. What exactly happened to your files? *** Two personal RSA4096 keys were generated for your PC/Laptop; one key is public, another key is private. *** All your data and files were encrypted by the means of the public key, which you received over the web. *** In order to decrypt your data and gain access to your computer you need a private key and a decryption software, which can be found on one of our secret servers. What should you do next? There are several options for you to consider: 1. You can wait for a while until the price of a private key will raise, so you will have to pay twice as much to access your files or 2. You can start getting BitCoins right now and get access to your data quite fast. In case you have valuable files, we advise you to act fast as there is no other option rather than paying in order to get back your data. In order to obtain specific instructions, please access your personal homepage by choosing one of the few addresses down below: http://kkr4hbwdklf234bfl84uoqleflqwrfqwuelfh.brazabaya.com/C438AF99CDA8E12A http://974gfbjhb23hbfkyfaby3byqlyuebvly5q254y.mendilobo.com/C438AF99CDA8E12A http://a64gfdsjhb4htbiwaysbdvukyft5q.zobodine.at/C438AF99CDA8E12A If you can't access your personal homepage or the addresses are not working, complete the following steps: 1. Download TOR Browser - http://www.torproject.org/projects/torbrowser.html.en 2. Install TOR Browser 3. Open TOR Browser 4. Insert the following link in the address bar: k7tlx3ghr3m4n2tu.onion/C438AF99CDA8E12A 5. Follow the steps on your screen IMPORTANT INFORMATION Your personal homepages: http://kkr4hbwdklf234bfl84uoqleflqwrfqwuelfh.brazabaya.com/C438AF99CDA8E12A http://974gfbjhb23hbfkyfaby3byqlyuebvly5q254y.mendilobo.com/C438AF99CDA8E12A http://a64gfdsjhb4htbiwaysbdvukyft5q.zobodine.at/C438AF99CDA8E12A Your personal page Tor-Browser k7tlx3ghr3m4n2tu.onion/C438AF99CDA8E12A Your personal identification ID: C438AF99CDA8E12A
URLs

http://kkr4hbwdklf234bfl84uoqleflqwrfqwuelfh.brazabaya.com/C438AF99CDA8E12A

http://974gfbjhb23hbfkyfaby3byqlyuebvly5q254y.mendilobo.com/C438AF99CDA8E12A

http://a64gfdsjhb4htbiwaysbdvukyft5q.zobodine.at/C438AF99CDA8E12A

http://k7tlx3ghr3m4n2tu.onion/C438AF99CDA8E12A

Targets

    • Target

      43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b

    • Size

      410KB

    • MD5

      56815047f7f330dcb598899915d6606e

    • SHA1

      8f20faecf7448606c2601bc03f94a6ed4d7c960b

    • SHA256

      43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b

    • SHA512

      fbc69c4cb808840209bec0ac52cf29e0442fc80c72dea460ced3dc0ef6e035fef7da9dbd21b8fd1ebebfdf43b02184c65ee73995473fc075bb6ad2de113fba03

    Score
    10/10
    • suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon

      suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks