General
-
Target
543144026b1a0c1bbfea07c5af4b9e5654c6eb3416f7ac70d676c6c8682bacbb
-
Size
368KB
-
Sample
220725-yrxc5sche2
-
MD5
0d3571a8ca8ef2fede9e3e11b8761582
-
SHA1
f2b0416e2afe93050816f62646ecae6080a9e559
-
SHA256
543144026b1a0c1bbfea07c5af4b9e5654c6eb3416f7ac70d676c6c8682bacbb
-
SHA512
1474d517cf92cd4dcec62bb656ae918f383fd4e146dd951c9613e7cb300870e32606c3607872bb17d84e2de5c13d23bf51bc16e8f2f576acd4bae9fe3e2b661c
Static task
static1
Behavioral task
behavioral1
Sample
543144026b1a0c1bbfea07c5af4b9e5654c6eb3416f7ac70d676c6c8682bacbb.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
543144026b1a0c1bbfea07c5af4b9e5654c6eb3416f7ac70d676c6c8682bacbb.exe
Resource
win10v2004-20220721-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-3762437355-3468409815-1164039494-1000\_RECoVERY_+gmkad.txt
teslacrypt
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/6357AFB260F5AAC6
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/6357AFB260F5AAC6
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/6357AFB260F5AAC6
http://xlowfznrg4wf7dli.ONION/6357AFB260F5AAC6
Extracted
C:\$Recycle.Bin\S-1-5-21-1101907861-274115917-2188613224-1000\_RECoVERY_+tepye.txt
teslacrypt
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/F17D8283F1CC45
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/F17D8283F1CC45
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/F17D8283F1CC45
http://xlowfznrg4wf7dli.ONION/F17D8283F1CC45
Targets
-
-
Target
543144026b1a0c1bbfea07c5af4b9e5654c6eb3416f7ac70d676c6c8682bacbb
-
Size
368KB
-
MD5
0d3571a8ca8ef2fede9e3e11b8761582
-
SHA1
f2b0416e2afe93050816f62646ecae6080a9e559
-
SHA256
543144026b1a0c1bbfea07c5af4b9e5654c6eb3416f7ac70d676c6c8682bacbb
-
SHA512
1474d517cf92cd4dcec62bb656ae918f383fd4e146dd951c9613e7cb300870e32606c3607872bb17d84e2de5c13d23bf51bc16e8f2f576acd4bae9fe3e2b661c
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-