General
-
Target
580484e4aa95bfa8e5b86b568b57e76625a8fe648bbe1093517281ac8cd0f148
-
Size
384KB
-
Sample
220724-t8tlcsbbe4
-
MD5
6e40ceedbbe126326e9f2c00a6bcea26
-
SHA1
589928e1e8d398a4be6a3e85270bd09bad9104d1
-
SHA256
580484e4aa95bfa8e5b86b568b57e76625a8fe648bbe1093517281ac8cd0f148
-
SHA512
05da4dd8f16ee82988ddec7e5e5c09dbf21da944a72dc464cbd9cdaab6117080bde3409185a37d0d8aff82017b1bc43f77371d4afb899230365f5e6312e4957d
Static task
static1
Behavioral task
behavioral1
Sample
580484e4aa95bfa8e5b86b568b57e76625a8fe648bbe1093517281ac8cd0f148.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
580484e4aa95bfa8e5b86b568b57e76625a8fe648bbe1093517281ac8cd0f148.exe
Resource
win10v2004-20220722-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-3440072777-2118400376-1759599358-1000\Recovery+pmqbl.txt
teslacrypt
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/E748928275D11EF
http://kkd47eh4hdjshb5t.angortra.at/E748928275D11EF
http://ytrest84y5i456hghadefdsd.pontogrot.com/E748928275D11EF
http://xlowfznrg4wf7dli.ONION/E748928275D11EF
Extracted
C:\$Recycle.Bin\S-1-5-21-3463845317-933582289-45817732-1000\Recovery+pieom.txt
teslacrypt
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/F7895A6BFBF13BB2
http://kkd47eh4hdjshb5t.angortra.at/F7895A6BFBF13BB2
http://ytrest84y5i456hghadefdsd.pontogrot.com/F7895A6BFBF13BB2
http://xlowfznrg4wf7dli.ONION/F7895A6BFBF13BB2
Targets
-
-
Target
580484e4aa95bfa8e5b86b568b57e76625a8fe648bbe1093517281ac8cd0f148
-
Size
384KB
-
MD5
6e40ceedbbe126326e9f2c00a6bcea26
-
SHA1
589928e1e8d398a4be6a3e85270bd09bad9104d1
-
SHA256
580484e4aa95bfa8e5b86b568b57e76625a8fe648bbe1093517281ac8cd0f148
-
SHA512
05da4dd8f16ee82988ddec7e5e5c09dbf21da944a72dc464cbd9cdaab6117080bde3409185a37d0d8aff82017b1bc43f77371d4afb899230365f5e6312e4957d
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-