General
-
Target
61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f
-
Size
344KB
-
Sample
220730-ysybtsfafq
-
MD5
2bba3e4d34098cc1ffbb8ddd8cd64086
-
SHA1
e353968444ce29d8a23a24506ed9f68604c6ad15
-
SHA256
61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f
-
SHA512
35a9a77d93070a60ee8dfb4150754da61b59641df4b619f44ce94933ddb43d6d88ab1ad612a50541d15e7dc5711922d42b31a5accaf33ab8b9f8dad2eee4cc0e
Static task
static1
Behavioral task
behavioral1
Sample
61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f.exe
Resource
win10v2004-20220721-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-3762437355-3468409815-1164039494-1000\Recovery+fhanx.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/4D553F50B1428D
http://tes543berda73i48fsdfsd.keratadze.at/4D553F50B1428D
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/4D553F50B1428D
http://xlowfznrg4wf7dli.ONION/4D553F50B1428D
Extracted
C:\$Recycle.Bin\S-1-5-21-1101907861-274115917-2188613224-1000\Recovery+vikuv.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/13D51CDE2F1E29D0
http://tes543berda73i48fsdfsd.keratadze.at/13D51CDE2F1E29D0
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/13D51CDE2F1E29D0
http://xlowfznrg4wf7dli.ONION/13D51CDE2F1E29D0
Targets
-
-
Target
61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f
-
Size
344KB
-
MD5
2bba3e4d34098cc1ffbb8ddd8cd64086
-
SHA1
e353968444ce29d8a23a24506ed9f68604c6ad15
-
SHA256
61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f
-
SHA512
35a9a77d93070a60ee8dfb4150754da61b59641df4b619f44ce94933ddb43d6d88ab1ad612a50541d15e7dc5711922d42b31a5accaf33ab8b9f8dad2eee4cc0e
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-