General
-
Target
54d500de350673efadd60703fb93c93bb157b1559d52c684b053c112ec0e4af6
-
Size
392KB
-
Sample
220725-wgkkgshag6
-
MD5
1f9fad0c31af765a2f6555ea2207b53f
-
SHA1
f250ad322fe76e0b2ce8b490c1bf008e324e6136
-
SHA256
54d500de350673efadd60703fb93c93bb157b1559d52c684b053c112ec0e4af6
-
SHA512
1006c34d73704b8cb007d49819e76d96f1482c32b0d375ed647e25505f3193123ac77a23c686694f81312ba143868c5f9c1bd949e466feec7c2fee4bf0316bb5
Static task
static1
Behavioral task
behavioral1
Sample
54d500de350673efadd60703fb93c93bb157b1559d52c684b053c112ec0e4af6.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
54d500de350673efadd60703fb93c93bb157b1559d52c684b053c112ec0e4af6.exe
Resource
win10v2004-20220721-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-4084403625-2215941253-1760665084-1000\Recovery+atbkg.txt
teslacrypt
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/FD7F2F59B14BE985
http://kkd47eh4hdjshb5t.angortra.at/FD7F2F59B14BE985
http://ytrest84y5i456hghadefdsd.pontogrot.com/FD7F2F59B14BE985
http://xlowfznrg4wf7dli.ONION/FD7F2F59B14BE985
Extracted
C:\$Recycle.Bin\S-1-5-21-1101907861-274115917-2188613224-1000\Recovery+sojso.txt
teslacrypt
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/3E88ABB9FE8CD2B
http://kkd47eh4hdjshb5t.angortra.at/3E88ABB9FE8CD2B
http://ytrest84y5i456hghadefdsd.pontogrot.com/3E88ABB9FE8CD2B
http://xlowfznrg4wf7dli.ONION/3E88ABB9FE8CD2B
Targets
-
-
Target
54d500de350673efadd60703fb93c93bb157b1559d52c684b053c112ec0e4af6
-
Size
392KB
-
MD5
1f9fad0c31af765a2f6555ea2207b53f
-
SHA1
f250ad322fe76e0b2ce8b490c1bf008e324e6136
-
SHA256
54d500de350673efadd60703fb93c93bb157b1559d52c684b053c112ec0e4af6
-
SHA512
1006c34d73704b8cb007d49819e76d96f1482c32b0d375ed647e25505f3193123ac77a23c686694f81312ba143868c5f9c1bd949e466feec7c2fee4bf0316bb5
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-