General
-
Target
4a972144600d364684e75cdb6e34d74cba51661f6872bbc3e41c25425fff3ebb
-
Size
372KB
-
Sample
220712-pzkvmsddg6
-
MD5
76dcea66375fd47b13e624efdd11d888
-
SHA1
6690c6f0c0f68a1da2b0fba75c25503ca9a9d1e0
-
SHA256
4a972144600d364684e75cdb6e34d74cba51661f6872bbc3e41c25425fff3ebb
-
SHA512
73b686abde3a0e6260e13e6921b75377ab8fa15739f959160dfb82a4b7ced928d01cf7e45d97727046bf8075b233d16c13756bf422f9e95cc35c4ec81453a619
Static task
static1
Behavioral task
behavioral1
Sample
4a972144600d364684e75cdb6e34d74cba51661f6872bbc3e41c25425fff3ebb.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
4a972144600d364684e75cdb6e34d74cba51661f6872bbc3e41c25425fff3ebb.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-790309383-526510583-3802439154-1000\Recovery+kyjul.txt
http://prest54538hnksjn4kjfwdbhwere.hotchunman.com/613FEDD7B78B74A
http://b4youfred5485jgsa3453f.italazudda.com/613FEDD7B78B74A
http://5rport45vcdef345adfkksawe.bematvocal.at/613FEDD7B78B74A
http://fwgrhsao3aoml7ej.onion/613FEDD7B78B74A
http://fwgrhsao3aoml7ej.ONION/613FEDD7B78B74A
Extracted
C:\$Recycle.Bin\S-1-5-21-1809750270-3141839489-3074374771-1000\Recovery+mhxrt.txt
http://prest54538hnksjn4kjfwdbhwere.hotchunman.com/D3BFEB03B997036
http://b4youfred5485jgsa3453f.italazudda.com/D3BFEB03B997036
http://5rport45vcdef345adfkksawe.bematvocal.at/D3BFEB03B997036
http://fwgrhsao3aoml7ej.onion/D3BFEB03B997036
http://fwgrhsao3aoml7ej.ONION/D3BFEB03B997036
Targets
-
-
Target
4a972144600d364684e75cdb6e34d74cba51661f6872bbc3e41c25425fff3ebb
-
Size
372KB
-
MD5
76dcea66375fd47b13e624efdd11d888
-
SHA1
6690c6f0c0f68a1da2b0fba75c25503ca9a9d1e0
-
SHA256
4a972144600d364684e75cdb6e34d74cba51661f6872bbc3e41c25425fff3ebb
-
SHA512
73b686abde3a0e6260e13e6921b75377ab8fa15739f959160dfb82a4b7ced928d01cf7e45d97727046bf8075b233d16c13756bf422f9e95cc35c4ec81453a619
Score10/10-
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-