General
-
Target
29fbd319a328c973a59092cb75c1200877cf1c9e6e3e10bc8ee604705fdafcb1
-
Size
405KB
-
Sample
220615-jb5l9afgc8
-
MD5
774c4cf1497fc76ee617a20d8cc75de8
-
SHA1
324e2b60c97abc9382af6d592482484bef878a2c
-
SHA256
29fbd319a328c973a59092cb75c1200877cf1c9e6e3e10bc8ee604705fdafcb1
-
SHA512
3921b696a0934fec306870266ede1f735e78b674941bc2e3ce2aad37fb0eec15eaed03b745258d1e5839ef82bb9a6c7188245a0f59adfdf0b423a22269a0b398
Static task
static1
Behavioral task
behavioral1
Sample
29fbd319a328c973a59092cb75c1200877cf1c9e6e3e10bc8ee604705fdafcb1.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
29fbd319a328c973a59092cb75c1200877cf1c9e6e3e10bc8ee604705fdafcb1.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-1081944012-3634099177-1681222835-1000\_RECoVERY_+mrevc.txt
teslacrypt
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/F3E1BCDD3B0E12B
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/F3E1BCDD3B0E12B
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/F3E1BCDD3B0E12B
http://xlowfznrg4wf7dli.ONION/F3E1BCDD3B0E12B
Targets
-
-
Target
29fbd319a328c973a59092cb75c1200877cf1c9e6e3e10bc8ee604705fdafcb1
-
Size
405KB
-
MD5
774c4cf1497fc76ee617a20d8cc75de8
-
SHA1
324e2b60c97abc9382af6d592482484bef878a2c
-
SHA256
29fbd319a328c973a59092cb75c1200877cf1c9e6e3e10bc8ee604705fdafcb1
-
SHA512
3921b696a0934fec306870266ede1f735e78b674941bc2e3ce2aad37fb0eec15eaed03b745258d1e5839ef82bb9a6c7188245a0f59adfdf0b423a22269a0b398
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-