General
-
Target
4fa8c1eaa4846a8a06fb2480a746d5526f743cee314f7101db0508577bdd3776
-
Size
384KB
-
Sample
220719-1h5dhaefgp
-
MD5
2d773896a33503e40ee90eae76442d7a
-
SHA1
c53939c63d81399fd478cc0412edfb6c6b3757b0
-
SHA256
4fa8c1eaa4846a8a06fb2480a746d5526f743cee314f7101db0508577bdd3776
-
SHA512
59b92d6288b2a1df9985871f210d20d1a605b5636b9fe167747b3413c7ccf934abeabcc52bf1c54ac5546c53b6e73d1bc251aab622398429a7d28b1d4a9d56e0
Static task
static1
Behavioral task
behavioral1
Sample
4fa8c1eaa4846a8a06fb2480a746d5526f743cee314f7101db0508577bdd3776.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
4fa8c1eaa4846a8a06fb2480a746d5526f743cee314f7101db0508577bdd3776.exe
Resource
win10v2004-20220718-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-3762437355-3468409815-1164039494-1000\Recovery+ncxwu.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/7769290B48C3645
http://tes543berda73i48fsdfsd.keratadze.at/7769290B48C3645
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/7769290B48C3645
http://xlowfznrg4wf7dli.ONION/7769290B48C3645
Extracted
C:\$Recycle.Bin\S-1-5-21-1178428168-2939480073-3055857545-1000\Recovery+yqcoy.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/16E6CFE91AC3B4
http://tes543berda73i48fsdfsd.keratadze.at/16E6CFE91AC3B4
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/16E6CFE91AC3B4
http://xlowfznrg4wf7dli.ONION/16E6CFE91AC3B4
Targets
-
-
Target
4fa8c1eaa4846a8a06fb2480a746d5526f743cee314f7101db0508577bdd3776
-
Size
384KB
-
MD5
2d773896a33503e40ee90eae76442d7a
-
SHA1
c53939c63d81399fd478cc0412edfb6c6b3757b0
-
SHA256
4fa8c1eaa4846a8a06fb2480a746d5526f743cee314f7101db0508577bdd3776
-
SHA512
59b92d6288b2a1df9985871f210d20d1a605b5636b9fe167747b3413c7ccf934abeabcc52bf1c54ac5546c53b6e73d1bc251aab622398429a7d28b1d4a9d56e0
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-