General
-
Target
4e65ca34a5a64250ec4769367c06dd386383426a737d2084ee9cc77aa333d1c5
-
Size
424KB
-
Sample
220720-wbrfvadghp
-
MD5
45a49c947e5d71f66290c22900480076
-
SHA1
c3fee5818241af687af9a505d1d0876a22147859
-
SHA256
4e65ca34a5a64250ec4769367c06dd386383426a737d2084ee9cc77aa333d1c5
-
SHA512
e0c434ad274d591eb34d1c228cb557e368ab1ca33ed9a96fb38c457ecda2ef6d50ac3d0514dcbe6d7b55a17e0298ff37c47f22f17135a9a82fe1d7bc7186fe4b
Static task
static1
Behavioral task
behavioral1
Sample
4e65ca34a5a64250ec4769367c06dd386383426a737d2084ee9cc77aa333d1c5.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
4e65ca34a5a64250ec4769367c06dd386383426a737d2084ee9cc77aa333d1c5.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-4084403625-2215941253-1760665084-1000\_RECoVERY_+wfumn.txt
teslacrypt
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/90A655D1E053568F
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/90A655D1E053568F
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/90A655D1E053568F
http://xlowfznrg4wf7dli.ONION/90A655D1E053568F
Extracted
C:\$Recycle.Bin\S-1-5-21-1809750270-3141839489-3074374771-1000\_RECoVERY_+scxcp.txt
teslacrypt
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/9D5873B23CB1FD1
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/9D5873B23CB1FD1
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/9D5873B23CB1FD1
http://xlowfznrg4wf7dli.ONION/9D5873B23CB1FD1
Targets
-
-
Target
4e65ca34a5a64250ec4769367c06dd386383426a737d2084ee9cc77aa333d1c5
-
Size
424KB
-
MD5
45a49c947e5d71f66290c22900480076
-
SHA1
c3fee5818241af687af9a505d1d0876a22147859
-
SHA256
4e65ca34a5a64250ec4769367c06dd386383426a737d2084ee9cc77aa333d1c5
-
SHA512
e0c434ad274d591eb34d1c228cb557e368ab1ca33ed9a96fb38c457ecda2ef6d50ac3d0514dcbe6d7b55a17e0298ff37c47f22f17135a9a82fe1d7bc7186fe4b
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Adds Run key to start application
-