General
-
Target
558ba87d092b229387b364e03e054a8849d6b0939e60650e7f708b989194ef25
-
Size
340KB
-
Sample
220725-s58qfacfc8
-
MD5
25c064f5adc5d3d48b173d45fdbcb5eb
-
SHA1
49479988acd79dff1fb8f7df46e40971d8491d57
-
SHA256
558ba87d092b229387b364e03e054a8849d6b0939e60650e7f708b989194ef25
-
SHA512
3475341de78c3862c98183eec0fb9501be07d326b1def1a6113dbba0143986de24676530fa7a374b547775cff8d91a3bb1cf5a9b870c12dbc49d3c47d03f4665
Static task
static1
Behavioral task
behavioral1
Sample
558ba87d092b229387b364e03e054a8849d6b0939e60650e7f708b989194ef25.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
558ba87d092b229387b364e03e054a8849d6b0939e60650e7f708b989194ef25.exe
Resource
win10v2004-20220721-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-335065374-4263250628-1829373619-1000\Recovery+cxkjh.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/23BF97A730EFC9E6
http://tes543berda73i48fsdfsd.keratadze.at/23BF97A730EFC9E6
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/23BF97A730EFC9E6
http://xlowfznrg4wf7dli.ONION/23BF97A730EFC9E6
Extracted
C:\$Recycle.Bin\S-1-5-21-1101907861-274115917-2188613224-1000\Recovery+ukmij.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/E8455FD5307614A8
http://tes543berda73i48fsdfsd.keratadze.at/E8455FD5307614A8
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/E8455FD5307614A8
http://xlowfznrg4wf7dli.ONION/E8455FD5307614A8
Targets
-
-
Target
558ba87d092b229387b364e03e054a8849d6b0939e60650e7f708b989194ef25
-
Size
340KB
-
MD5
25c064f5adc5d3d48b173d45fdbcb5eb
-
SHA1
49479988acd79dff1fb8f7df46e40971d8491d57
-
SHA256
558ba87d092b229387b364e03e054a8849d6b0939e60650e7f708b989194ef25
-
SHA512
3475341de78c3862c98183eec0fb9501be07d326b1def1a6113dbba0143986de24676530fa7a374b547775cff8d91a3bb1cf5a9b870c12dbc49d3c47d03f4665
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Adds Run key to start application
-