General
-
Target
5415c6c499d5791b1fab865ed585fbc9fa53a9bb8e007996613f87c03fe9737d
-
Size
369KB
-
Sample
220725-y5bnladef8
-
MD5
801007e070cb6f865d032d7ea4f1993a
-
SHA1
7db8b3711c6560bba07467981284502aaf28e58e
-
SHA256
5415c6c499d5791b1fab865ed585fbc9fa53a9bb8e007996613f87c03fe9737d
-
SHA512
3c7681973d54e58558a3f673a8882117926dfdc166d304444e8e234a1505f4c23fcc87a48b67235241d9b5f99db507e493f0f6db1fa3aebdd19c7f1e437637bf
Static task
static1
Behavioral task
behavioral1
Sample
5415c6c499d5791b1fab865ed585fbc9fa53a9bb8e007996613f87c03fe9737d.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
5415c6c499d5791b1fab865ed585fbc9fa53a9bb8e007996613f87c03fe9737d.exe
Resource
win10v2004-20220721-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-4084403625-2215941253-1760665084-1000\_RECOVERY_+dvbru.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/9B23B0552B3EA490
http://tes543berda73i48fsdfsd.keratadze.at/9B23B0552B3EA490
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/9B23B0552B3EA490
http://xlowfznrg4wf7dli.ONION/9B23B0552B3EA490
Extracted
C:\$Recycle.Bin\S-1-5-21-2372564722-193526734-2636556182-1000\_RECOVERY_+ldnsn.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/EF2A6E9142F9DDA
http://tes543berda73i48fsdfsd.keratadze.at/EF2A6E9142F9DDA
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/EF2A6E9142F9DDA
http://xlowfznrg4wf7dli.ONION/EF2A6E9142F9DDA
Targets
-
-
Target
5415c6c499d5791b1fab865ed585fbc9fa53a9bb8e007996613f87c03fe9737d
-
Size
369KB
-
MD5
801007e070cb6f865d032d7ea4f1993a
-
SHA1
7db8b3711c6560bba07467981284502aaf28e58e
-
SHA256
5415c6c499d5791b1fab865ed585fbc9fa53a9bb8e007996613f87c03fe9737d
-
SHA512
3c7681973d54e58558a3f673a8882117926dfdc166d304444e8e234a1505f4c23fcc87a48b67235241d9b5f99db507e493f0f6db1fa3aebdd19c7f1e437637bf
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-