General
-
Target
57829520d9161ecb5ccdbf320c40615bd13ec7a514f4d34d3f95534013ebcbfd
-
Size
369KB
-
Sample
220724-1wb9wahhf9
-
MD5
9009f09c28c128032a54dd758c608fb0
-
SHA1
023c1cd36ae7eaf17824e08b70f32641f8b8098a
-
SHA256
57829520d9161ecb5ccdbf320c40615bd13ec7a514f4d34d3f95534013ebcbfd
-
SHA512
606b5deaa9969ae04cf4a94e766d72eb295551ccd3fadd8c9a22c7e1be98a0f03c66116599c0a1518f35aa59685bd276c89499c300b3806ef7a0b0e2013e9347
Static task
static1
Behavioral task
behavioral1
Sample
57829520d9161ecb5ccdbf320c40615bd13ec7a514f4d34d3f95534013ebcbfd.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
57829520d9161ecb5ccdbf320c40615bd13ec7a514f4d34d3f95534013ebcbfd.exe
Resource
win10v2004-20220721-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-3762437355-3468409815-1164039494-1000\_RECoVERY_+urjue.txt
teslacrypt
http://yyre45dbvn2nhbefbmh.begumvelic.at/81FABDED4350C48D
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/81FABDED4350C48D
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/81FABDED4350C48D
http://xlowfznrg4wf7dli.ONION/81FABDED4350C48D
Extracted
C:\$Recycle.Bin\S-1-5-21-1101907861-274115917-2188613224-1000\_RECoVERY_+pdjby.txt
teslacrypt
http://yyre45dbvn2nhbefbmh.begumvelic.at/D1843F413023CB2D
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/D1843F413023CB2D
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/D1843F413023CB2D
http://xlowfznrg4wf7dli.ONION/D1843F413023CB2D
Targets
-
-
Target
57829520d9161ecb5ccdbf320c40615bd13ec7a514f4d34d3f95534013ebcbfd
-
Size
369KB
-
MD5
9009f09c28c128032a54dd758c608fb0
-
SHA1
023c1cd36ae7eaf17824e08b70f32641f8b8098a
-
SHA256
57829520d9161ecb5ccdbf320c40615bd13ec7a514f4d34d3f95534013ebcbfd
-
SHA512
606b5deaa9969ae04cf4a94e766d72eb295551ccd3fadd8c9a22c7e1be98a0f03c66116599c0a1518f35aa59685bd276c89499c300b3806ef7a0b0e2013e9347
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-