General
-
Target
578af05fee137a6797e4ed0d2b3f1d4abb038cdb163cce1db68f1908fea2654f
-
Size
361KB
-
Sample
220724-1n4ddshff2
-
MD5
27898a045a3ca345434a46fcbebbc68b
-
SHA1
cf409ce23924599df8b20c18c63ff76c5e0ea102
-
SHA256
578af05fee137a6797e4ed0d2b3f1d4abb038cdb163cce1db68f1908fea2654f
-
SHA512
7e8c2107a82280197ec9354a535c66739864f09668d20232236497d6449cce36b45a8a15ebce87eafe8f3f160109cd4404322f4e6e060e98b19b6ab45ffba0c3
Static task
static1
Behavioral task
behavioral1
Sample
578af05fee137a6797e4ed0d2b3f1d4abb038cdb163cce1db68f1908fea2654f.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
578af05fee137a6797e4ed0d2b3f1d4abb038cdb163cce1db68f1908fea2654f.exe
Resource
win10v2004-20220721-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-3762437355-3468409815-1164039494-1000\_RECoVERY_+ushfk.txt
teslacrypt
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/7A1FE86A5989154A
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/7A1FE86A5989154A
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/7A1FE86A5989154A
http://xlowfznrg4wf7dli.ONION/7A1FE86A5989154A
Extracted
C:\$Recycle.Bin\S-1-5-21-1101907861-274115917-2188613224-1000\_RECoVERY_+mesal.txt
teslacrypt
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/FE122C2F982D8F53
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/FE122C2F982D8F53
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/FE122C2F982D8F53
http://xlowfznrg4wf7dli.ONION/FE122C2F982D8F53
Targets
-
-
Target
578af05fee137a6797e4ed0d2b3f1d4abb038cdb163cce1db68f1908fea2654f
-
Size
361KB
-
MD5
27898a045a3ca345434a46fcbebbc68b
-
SHA1
cf409ce23924599df8b20c18c63ff76c5e0ea102
-
SHA256
578af05fee137a6797e4ed0d2b3f1d4abb038cdb163cce1db68f1908fea2654f
-
SHA512
7e8c2107a82280197ec9354a535c66739864f09668d20232236497d6449cce36b45a8a15ebce87eafe8f3f160109cd4404322f4e6e060e98b19b6ab45ffba0c3
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-