General

  • Target

    45c91234b6ad5955140973834c39a8cf2e4e6b7f1b3900a85a4903ba40f82cc5

  • Size

    396KB

  • Sample

    220707-mxtcwsfha6

  • MD5

    369c33b9e8e9839f9f6299d969d6017f

  • SHA1

    dfe0698639787b5554bc8fe6e3851e1800b1f15a

  • SHA256

    45c91234b6ad5955140973834c39a8cf2e4e6b7f1b3900a85a4903ba40f82cc5

  • SHA512

    cc4b33a6aa8c83d9b3d696eedd386b39941ed3ccbd5cd73b011d2f21ff6f9f59e586a5956ba60eb728c3a0e4f7e3509d9822b09e01d360f1447c1071764cce25

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-790309383-526510583-3802439154-1000\RECOVERqxlyk.txt

Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com What's the matter with your files? Your data was secured using a strong encryption with RSA4096. Use the link down below to find additional information on the encryption keys using RSA4096:https://en.wikipedia.org/wiki/RSA_(cryptosystem) What exactly that means? It means that on a structural level your files have been transformed. You won't be able to use, read, see or work with them anymore. In other words they are useless, however, there is a possibility to restore them with our help. What exactly happened to your files? *** Two personal RSA4096 keys were generated for your PC/Laptop; one key is public, another key is private. *** All your data and files were encrypted by the means of the public key, which you received over the web. *** In order to decrypt your data and gain access to your computer you need a private key and a decryption software, which can be found on one of our secret servers. What should you do next? There are several options for you to consider: 1. You can wait for a while until the price of a private key will raise, so you will have to pay twice as much to access your files or 2. You can start getting BitCoins right now and get access to your data quite fast. In case you have valuable files, we advise you to act fast as there is no other option rather than paying in order to get back your data. In order to obtain specific instructions, please access your personal homepage by choosing one of the few addresses down below: http://h5nuwefkuh134ljngkasdbasfg.corolbugan.com/7EF3D1BA88DEEA2 http://p54dhkus4tlkfashdb6vjetgsdfg.greetingshere.at/7EF3D1BA88DEEA2 http://f4dsbjhb45wfiuqeib4fkqeg.meccaledgy.at/7EF3D1BA88DEEA2 If you can't access your personal homepage or the addresses are not working, complete the following steps: 1 Download TOR Browser - http://www.torproject.org/projects/torbrowser.html.en 2 Install TOR Browser 3 Open TOR Browser 4 Insert the following link in the address bar: k7tlx3ghr3m4n2tu.onion/7EF3D1BA88DEEA2 5 Follow the steps on your screen IMPORTANT INFORMATION Your personal homepages: http://h5nuwefkuh134ljngkasdbasfg.corolbugan.com/7EF3D1BA88DEEA2 http://p54dhkus4tlkfashdb6vjetgsdfg.greetingshere.at/7EF3D1BA88DEEA2 http://f4dsbjhb45wfiuqeib4fkqeg.meccaledgy.at/7EF3D1BA88DEEA2 Your personal page Tor-Browser k7tlx3ghr3m4n2tu.onion/7EF3D1BA88DEEA2 Your personal identification ID: 7EF3D1BA88DEEA2
URLs

http://h5nuwefkuh134ljngkasdbasfg.corolbugan.com/7EF3D1BA88DEEA2

http://p54dhkus4tlkfashdb6vjetgsdfg.greetingshere.at/7EF3D1BA88DEEA2

http://f4dsbjhb45wfiuqeib4fkqeg.meccaledgy.at/7EF3D1BA88DEEA2

http://k7tlx3ghr3m4n2tu.onion/7EF3D1BA88DEEA2

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-2632097139-1792035885-811742494-1000\RECOVERwfpto.txt

Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com What's the matter with your files? Your data was secured using a strong encryption with RSA4096. Use the link down below to find additional information on the encryption keys using RSA4096:https://en.wikipedia.org/wiki/RSA_(cryptosystem) What exactly that means? It means that on a structural level your files have been transformed. You won't be able to use, read, see or work with them anymore. In other words they are useless, however, there is a possibility to restore them with our help. What exactly happened to your files? *** Two personal RSA4096 keys were generated for your PC/Laptop; one key is public, another key is private. *** All your data and files were encrypted by the means of the public key, which you received over the web. *** In order to decrypt your data and gain access to your computer you need a private key and a decryption software, which can be found on one of our secret servers. What should you do next? There are several options for you to consider: 1. You can wait for a while until the price of a private key will raise, so you will have to pay twice as much to access your files or 2. You can start getting BitCoins right now and get access to your data quite fast. In case you have valuable files, we advise you to act fast as there is no other option rather than paying in order to get back your data. In order to obtain specific instructions, please access your personal homepage by choosing one of the few addresses down below: http://h5nuwefkuh134ljngkasdbasfg.corolbugan.com/3B6B8DAC725D355 http://p54dhkus4tlkfashdb6vjetgsdfg.greetingshere.at/3B6B8DAC725D355 http://f4dsbjhb45wfiuqeib4fkqeg.meccaledgy.at/3B6B8DAC725D355 If you can't access your personal homepage or the addresses are not working, complete the following steps: 1 Download TOR Browser - http://www.torproject.org/projects/torbrowser.html.en 2 Install TOR Browser 3 Open TOR Browser 4 Insert the following link in the address bar: k7tlx3ghr3m4n2tu.onion/3B6B8DAC725D355 5 Follow the steps on your screen IMPORTANT INFORMATION Your personal homepages: http://h5nuwefkuh134ljngkasdbasfg.corolbugan.com/3B6B8DAC725D355 http://p54dhkus4tlkfashdb6vjetgsdfg.greetingshere.at/3B6B8DAC725D355 http://f4dsbjhb45wfiuqeib4fkqeg.meccaledgy.at/3B6B8DAC725D355 Your personal page Tor-Browser k7tlx3ghr3m4n2tu.onion/3B6B8DAC725D355 Your personal identification ID: 3B6B8DAC725D355
URLs

http://h5nuwefkuh134ljngkasdbasfg.corolbugan.com/3B6B8DAC725D355

http://p54dhkus4tlkfashdb6vjetgsdfg.greetingshere.at/3B6B8DAC725D355

http://f4dsbjhb45wfiuqeib4fkqeg.meccaledgy.at/3B6B8DAC725D355

http://k7tlx3ghr3m4n2tu.onion/3B6B8DAC725D355

Targets

    • Target

      45c91234b6ad5955140973834c39a8cf2e4e6b7f1b3900a85a4903ba40f82cc5

    • Size

      396KB

    • MD5

      369c33b9e8e9839f9f6299d969d6017f

    • SHA1

      dfe0698639787b5554bc8fe6e3851e1800b1f15a

    • SHA256

      45c91234b6ad5955140973834c39a8cf2e4e6b7f1b3900a85a4903ba40f82cc5

    • SHA512

      cc4b33a6aa8c83d9b3d696eedd386b39941ed3ccbd5cd73b011d2f21ff6f9f59e586a5956ba60eb728c3a0e4f7e3509d9822b09e01d360f1447c1071764cce25

    • suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon

      suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

File Deletion

2
T1107

Modify Registry

2
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Impact

Inhibit System Recovery

2
T1490

Tasks