General
-
Target
556863463343e0d0ffcebdefbf72f27be647650a70f06650ce0219b732cd2300
-
Size
392KB
-
Sample
220725-tlnrlahfdj
-
MD5
3b1d8817c3b53cd294686d8a7932e57d
-
SHA1
b79bb02b9741147b9c84d50500abf834927ba1a5
-
SHA256
556863463343e0d0ffcebdefbf72f27be647650a70f06650ce0219b732cd2300
-
SHA512
5c576fa03c99b44b768adcdbf21a4c455bc554640900c52846449d6e749e4542d2f630618b1e37a04e59a1fbc3cd16477e5fae2037b883f8c713c42b2526e38e
Static task
static1
Behavioral task
behavioral1
Sample
556863463343e0d0ffcebdefbf72f27be647650a70f06650ce0219b732cd2300.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
556863463343e0d0ffcebdefbf72f27be647650a70f06650ce0219b732cd2300.exe
Resource
win10v2004-20220721-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-3440072777-2118400376-1759599358-1000\Recovery+okeqr.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/D990C349E6FEA933
http://tes543berda73i48fsdfsd.keratadze.at/D990C349E6FEA933
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/D990C349E6FEA933
http://xlowfznrg4wf7dli.ONION/D990C349E6FEA933
Extracted
C:\$Recycle.Bin\S-1-5-21-1101907861-274115917-2188613224-1000\Recovery+kapyh.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/D4809953CA16933
http://tes543berda73i48fsdfsd.keratadze.at/D4809953CA16933
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/D4809953CA16933
http://xlowfznrg4wf7dli.ONION/D4809953CA16933
Targets
-
-
Target
556863463343e0d0ffcebdefbf72f27be647650a70f06650ce0219b732cd2300
-
Size
392KB
-
MD5
3b1d8817c3b53cd294686d8a7932e57d
-
SHA1
b79bb02b9741147b9c84d50500abf834927ba1a5
-
SHA256
556863463343e0d0ffcebdefbf72f27be647650a70f06650ce0219b732cd2300
-
SHA512
5c576fa03c99b44b768adcdbf21a4c455bc554640900c52846449d6e749e4542d2f630618b1e37a04e59a1fbc3cd16477e5fae2037b883f8c713c42b2526e38e
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-