General
-
Target
4caa7a9e899522e38c33118ef2330da52a4d3d6bab1a576542c05deb1231654a
-
Size
428KB
-
Sample
220712-f7dlvsffe4
-
MD5
173634aad22b23dc3717ea91bb49127d
-
SHA1
6f368671b55931634f8920c1dddb7b3791fcac89
-
SHA256
4caa7a9e899522e38c33118ef2330da52a4d3d6bab1a576542c05deb1231654a
-
SHA512
bdeffbbe4ef788c99cab417fa6e073315ffad47403a1e32c95b451dde38e56791ebc502287bf44e50ebc5603648109534e60d397dc2484ef1f1eca937a94069e
Static task
static1
Behavioral task
behavioral1
Sample
4caa7a9e899522e38c33118ef2330da52a4d3d6bab1a576542c05deb1231654a.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
4caa7a9e899522e38c33118ef2330da52a4d3d6bab1a576542c05deb1231654a.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-2277218442-1199762539-2004043321-1000\_RECoVERY_+pbiku.txt
teslacrypt
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/7A1DDEAE22FAD065
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/7A1DDEAE22FAD065
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/7A1DDEAE22FAD065
http://xlowfznrg4wf7dli.ONION/7A1DDEAE22FAD065
Extracted
C:\$Recycle.Bin\S-1-5-21-3751123196-3323558407-1869646069-1000\_RECoVERY_+doyes.txt
teslacrypt
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/94F71ED6861E8E8D
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/94F71ED6861E8E8D
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/94F71ED6861E8E8D
http://xlowfznrg4wf7dli.ONION/94F71ED6861E8E8D
Targets
-
-
Target
4caa7a9e899522e38c33118ef2330da52a4d3d6bab1a576542c05deb1231654a
-
Size
428KB
-
MD5
173634aad22b23dc3717ea91bb49127d
-
SHA1
6f368671b55931634f8920c1dddb7b3791fcac89
-
SHA256
4caa7a9e899522e38c33118ef2330da52a4d3d6bab1a576542c05deb1231654a
-
SHA512
bdeffbbe4ef788c99cab417fa6e073315ffad47403a1e32c95b451dde38e56791ebc502287bf44e50ebc5603648109534e60d397dc2484ef1f1eca937a94069e
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Adds Run key to start application
-