General
-
Target
55a0fb17516d2248c86647446e6a2b4b3b0ff8b647cc9d587e93a51a987a4baf
-
Size
384KB
-
Sample
220725-swnnxacbe9
-
MD5
1aeba709a98f81748e955a438ec39aeb
-
SHA1
922fea47571ec0eee7e0d257854627234eef7deb
-
SHA256
55a0fb17516d2248c86647446e6a2b4b3b0ff8b647cc9d587e93a51a987a4baf
-
SHA512
ecef696f68aaff8e1df4232e260d710b276d19439cc237d745f93a12eafb65be71a25784e9f98b2e3fe86530ab07e41ed7fa0aae6745a0e7f759b3cb8c1dcbf7
Static task
static1
Behavioral task
behavioral1
Sample
55a0fb17516d2248c86647446e6a2b4b3b0ff8b647cc9d587e93a51a987a4baf.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
55a0fb17516d2248c86647446e6a2b4b3b0ff8b647cc9d587e93a51a987a4baf.exe
Resource
win10v2004-20220721-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-335065374-4263250628-1829373619-1000\Recovery+dgrbl.txt
teslacrypt
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/C4456CB915A124F
http://kkd47eh4hdjshb5t.angortra.at/C4456CB915A124F
http://ytrest84y5i456hghadefdsd.pontogrot.com/C4456CB915A124F
http://xlowfznrg4wf7dli.ONION/C4456CB915A124F
Extracted
C:\$Recycle.Bin\S-1-5-21-2372564722-193526734-2636556182-1000\Recovery+iyyve.txt
teslacrypt
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/C6DF2EAE57D59EBE
http://kkd47eh4hdjshb5t.angortra.at/C6DF2EAE57D59EBE
http://ytrest84y5i456hghadefdsd.pontogrot.com/C6DF2EAE57D59EBE
http://xlowfznrg4wf7dli.ONION/C6DF2EAE57D59EBE
Targets
-
-
Target
55a0fb17516d2248c86647446e6a2b4b3b0ff8b647cc9d587e93a51a987a4baf
-
Size
384KB
-
MD5
1aeba709a98f81748e955a438ec39aeb
-
SHA1
922fea47571ec0eee7e0d257854627234eef7deb
-
SHA256
55a0fb17516d2248c86647446e6a2b4b3b0ff8b647cc9d587e93a51a987a4baf
-
SHA512
ecef696f68aaff8e1df4232e260d710b276d19439cc237d745f93a12eafb65be71a25784e9f98b2e3fe86530ab07e41ed7fa0aae6745a0e7f759b3cb8c1dcbf7
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-