General
-
Target
4f292888693babedc7ebc4f904a2a898dd9d128c0213bf472a50c405fb3b4fc5
-
Size
344KB
-
Sample
220720-spbqrsghc5
-
MD5
3403d7a8943208af02fcfdc6f78cbfc5
-
SHA1
7a0ed12ec4df575dd2b5e6105d3febe5aa10bdfe
-
SHA256
4f292888693babedc7ebc4f904a2a898dd9d128c0213bf472a50c405fb3b4fc5
-
SHA512
d9d7ed904dfdfb80fff705a50f00a01728a469e40f4aad2ee7f74dd45882775db04b2976a70d747f5b43feba7412d54adde1644ed908de3f600c100852ad2196
Static task
static1
Behavioral task
behavioral1
Sample
4f292888693babedc7ebc4f904a2a898dd9d128c0213bf472a50c405fb3b4fc5.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
4f292888693babedc7ebc4f904a2a898dd9d128c0213bf472a50c405fb3b4fc5.exe
Resource
win10v2004-20220718-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-4084403625-2215941253-1760665084-1000\_RECOVERY_+ussdw.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/A6C19862CEE3C6FE
http://tes543berda73i48fsdfsd.keratadze.at/A6C19862CEE3C6FE
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/A6C19862CEE3C6FE
http://xlowfznrg4wf7dli.ONION/A6C19862CEE3C6FE
Extracted
C:\$Recycle.Bin\S-1-5-21-2783062828-828903012-4218294845-1000\_RECOVERY_+dexld.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/14F361DAB091E6
http://tes543berda73i48fsdfsd.keratadze.at/14F361DAB091E6
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/14F361DAB091E6
http://xlowfznrg4wf7dli.ONION/14F361DAB091E6
Targets
-
-
Target
4f292888693babedc7ebc4f904a2a898dd9d128c0213bf472a50c405fb3b4fc5
-
Size
344KB
-
MD5
3403d7a8943208af02fcfdc6f78cbfc5
-
SHA1
7a0ed12ec4df575dd2b5e6105d3febe5aa10bdfe
-
SHA256
4f292888693babedc7ebc4f904a2a898dd9d128c0213bf472a50c405fb3b4fc5
-
SHA512
d9d7ed904dfdfb80fff705a50f00a01728a469e40f4aad2ee7f74dd45882775db04b2976a70d747f5b43feba7412d54adde1644ed908de3f600c100852ad2196
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-