General
-
Target
43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b
-
Size
410KB
-
Sample
220707-1qdkrafcg3
-
MD5
56815047f7f330dcb598899915d6606e
-
SHA1
8f20faecf7448606c2601bc03f94a6ed4d7c960b
-
SHA256
43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b
-
SHA512
fbc69c4cb808840209bec0ac52cf29e0442fc80c72dea460ced3dc0ef6e035fef7da9dbd21b8fd1ebebfdf43b02184c65ee73995473fc075bb6ad2de113fba03
Static task
static1
Behavioral task
behavioral1
Sample
43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-1819626980-2277161760-1023733287-1000\RECOVERaduws.txt
http://kkr4hbwdklf234bfl84uoqleflqwrfqwuelfh.brazabaya.com/37E76456ECB79F
http://974gfbjhb23hbfkyfaby3byqlyuebvly5q254y.mendilobo.com/37E76456ECB79F
http://a64gfdsjhb4htbiwaysbdvukyft5q.zobodine.at/37E76456ECB79F
http://k7tlx3ghr3m4n2tu.onion/37E76456ECB79F
Extracted
C:\$Recycle.Bin\S-1-5-21-1809750270-3141839489-3074374771-1000\RECOVERgmtxs.txt
http://kkr4hbwdklf234bfl84uoqleflqwrfqwuelfh.brazabaya.com/C438AF99CDA8E12A
http://974gfbjhb23hbfkyfaby3byqlyuebvly5q254y.mendilobo.com/C438AF99CDA8E12A
http://a64gfdsjhb4htbiwaysbdvukyft5q.zobodine.at/C438AF99CDA8E12A
http://k7tlx3ghr3m4n2tu.onion/C438AF99CDA8E12A
Targets
-
-
Target
43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b
-
Size
410KB
-
MD5
56815047f7f330dcb598899915d6606e
-
SHA1
8f20faecf7448606c2601bc03f94a6ed4d7c960b
-
SHA256
43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b
-
SHA512
fbc69c4cb808840209bec0ac52cf29e0442fc80c72dea460ced3dc0ef6e035fef7da9dbd21b8fd1ebebfdf43b02184c65ee73995473fc075bb6ad2de113fba03
Score10/10-
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-