General
-
Target
4da541578caf4cc3336ffb6fef30997deb1f7f6ab9bb38a2be58e014cc7b58a3
-
Size
367KB
-
Sample
220720-y775ksaegn
-
MD5
4730bcca5ec3e6a057604dc02d289236
-
SHA1
fe421fa51dc1ca9133189f6afe7bd410238971b7
-
SHA256
4da541578caf4cc3336ffb6fef30997deb1f7f6ab9bb38a2be58e014cc7b58a3
-
SHA512
f84d3c59fa448db14ef6f247adc9f1785a5f9149701e6faa9aeb64298a30245694faf4aa428e0396b4dd418a164c7564a9de7ab20c1ae669497422ee187b1584
Static task
static1
Behavioral task
behavioral1
Sample
4da541578caf4cc3336ffb6fef30997deb1f7f6ab9bb38a2be58e014cc7b58a3.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
4da541578caf4cc3336ffb6fef30997deb1f7f6ab9bb38a2be58e014cc7b58a3.exe
Resource
win10v2004-20220718-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-3440072777-2118400376-1759599358-1000\_RECOVERY_+ctmct.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/312DA1BF2D82C13
http://tes543berda73i48fsdfsd.keratadze.at/312DA1BF2D82C13
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/312DA1BF2D82C13
http://xlowfznrg4wf7dli.ONION/312DA1BF2D82C13
Extracted
C:\$Recycle.Bin\S-1-5-21-1178428168-2939480073-3055857545-1000\_RECOVERY_+onyen.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/B064C9F15FDF52C6
http://tes543berda73i48fsdfsd.keratadze.at/B064C9F15FDF52C6
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/B064C9F15FDF52C6
http://xlowfznrg4wf7dli.ONION/B064C9F15FDF52C6
Targets
-
-
Target
4da541578caf4cc3336ffb6fef30997deb1f7f6ab9bb38a2be58e014cc7b58a3
-
Size
367KB
-
MD5
4730bcca5ec3e6a057604dc02d289236
-
SHA1
fe421fa51dc1ca9133189f6afe7bd410238971b7
-
SHA256
4da541578caf4cc3336ffb6fef30997deb1f7f6ab9bb38a2be58e014cc7b58a3
-
SHA512
f84d3c59fa448db14ef6f247adc9f1785a5f9149701e6faa9aeb64298a30245694faf4aa428e0396b4dd418a164c7564a9de7ab20c1ae669497422ee187b1584
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-