General
-
Target
4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72
-
Size
352KB
-
Sample
220719-ylt1tsbba4
-
MD5
730889ba766d40cf3db888f550785d06
-
SHA1
44cd570d3232530b21d3e6afd7586d812ac3e858
-
SHA256
4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72
-
SHA512
922417af1d141685956cb6d064b1abf843cdc823755e136af2f78087dcf9390553c477a618ca83c10dc5e75fe3eac50f9e1472e61667487fb6f70a3f58df89ba
Static task
static1
Behavioral task
behavioral1
Sample
4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72.exe
Resource
win10v2004-20220718-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-3762437355-3468409815-1164039494-1000\Recovery+btmso.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/A5EF151D10E9FF8A
http://tes543berda73i48fsdfsd.keratadze.at/A5EF151D10E9FF8A
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/A5EF151D10E9FF8A
http://xlowfznrg4wf7dli.ONION/A5EF151D10E9FF8A
Extracted
C:\$Recycle.Bin\S-1-5-21-2783062828-828903012-4218294845-1000\Recovery+dyiqu.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/6182194AF92AEF6
http://tes543berda73i48fsdfsd.keratadze.at/6182194AF92AEF6
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/6182194AF92AEF6
http://xlowfznrg4wf7dli.ONION/6182194AF92AEF6
Targets
-
-
Target
4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72
-
Size
352KB
-
MD5
730889ba766d40cf3db888f550785d06
-
SHA1
44cd570d3232530b21d3e6afd7586d812ac3e858
-
SHA256
4fd4f478b4d17316ab10a2a496caee51402bead71c92c48e83ed333d8ac09c72
-
SHA512
922417af1d141685956cb6d064b1abf843cdc823755e136af2f78087dcf9390553c477a618ca83c10dc5e75fe3eac50f9e1472e61667487fb6f70a3f58df89ba
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-