General
-
Target
2625cc29c9f8339ae8ab7fcdca6521e683165c91746d11c10abaf9b6c33be4ed
-
Size
384KB
-
Sample
220616-lgjm3scfhn
-
MD5
1d78eac82da5a6372217e8a997f1a9c8
-
SHA1
fc32674653486fa3c81e0c76c53b6ab311a704db
-
SHA256
2625cc29c9f8339ae8ab7fcdca6521e683165c91746d11c10abaf9b6c33be4ed
-
SHA512
b20af242231874645e1b69f563191b8746424a258299c10fd6f356bfb7f0064e28c77bcb78a448dac2719805e355477f8f55bd31e3141a0e16c52307382cf050
Static task
static1
Behavioral task
behavioral1
Sample
2625cc29c9f8339ae8ab7fcdca6521e683165c91746d11c10abaf9b6c33be4ed.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
2625cc29c9f8339ae8ab7fcdca6521e683165c91746d11c10abaf9b6c33be4ed.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-1083475884-596052423-1669053738-1000\Recovery+esmag.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/1BD89EE7DB66F0E5
http://tes543berda73i48fsdfsd.keratadze.at/1BD89EE7DB66F0E5
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/1BD89EE7DB66F0E5
http://xlowfznrg4wf7dli.ONION/1BD89EE7DB66F0E5
Extracted
C:\$Recycle.Bin\S-1-5-21-2632097139-1792035885-811742494-1000\Recovery+cugus.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/916C2BCE3C5DD8D9
http://tes543berda73i48fsdfsd.keratadze.at/916C2BCE3C5DD8D9
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/916C2BCE3C5DD8D9
http://xlowfznrg4wf7dli.ONION/916C2BCE3C5DD8D9
Targets
-
-
Target
2625cc29c9f8339ae8ab7fcdca6521e683165c91746d11c10abaf9b6c33be4ed
-
Size
384KB
-
MD5
1d78eac82da5a6372217e8a997f1a9c8
-
SHA1
fc32674653486fa3c81e0c76c53b6ab311a704db
-
SHA256
2625cc29c9f8339ae8ab7fcdca6521e683165c91746d11c10abaf9b6c33be4ed
-
SHA512
b20af242231874645e1b69f563191b8746424a258299c10fd6f356bfb7f0064e28c77bcb78a448dac2719805e355477f8f55bd31e3141a0e16c52307382cf050
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-