General
-
Target
5df9fc49473625410126f85b33807aed8e0eccd2e0bee457249b93166902af50
-
Size
388KB
-
Sample
220731-1pvsmsagfl
-
MD5
726ef9ecbca2050a2495cef5ca9c8562
-
SHA1
ae03be4b1486880d1011802e4204569263a7d5f5
-
SHA256
5df9fc49473625410126f85b33807aed8e0eccd2e0bee457249b93166902af50
-
SHA512
9ceffc6e18376ba6ac3514def4468feb63a16d6d675cf2d0c66463fc8612b025ac5074a210f4c180e71dd03897c21f574c53cbc0e15009fa28d3c498360e9958
Static task
static1
Behavioral task
behavioral1
Sample
5df9fc49473625410126f85b33807aed8e0eccd2e0bee457249b93166902af50.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
5df9fc49473625410126f85b33807aed8e0eccd2e0bee457249b93166902af50.exe
Resource
win10v2004-20220722-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-3762437355-3468409815-1164039494-1000\Recovery+xgoks.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/4F13126A877D198
http://tes543berda73i48fsdfsd.keratadze.at/4F13126A877D198
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/4F13126A877D198
http://xlowfznrg4wf7dli.ONION/4F13126A877D198
Extracted
C:\$Recycle.Bin\S-1-5-21-3463845317-933582289-45817732-1000\Recovery+qspcn.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/BDA0BADDEAF3D69B
http://tes543berda73i48fsdfsd.keratadze.at/BDA0BADDEAF3D69B
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/BDA0BADDEAF3D69B
http://xlowfznrg4wf7dli.ONION/BDA0BADDEAF3D69B
Targets
-
-
Target
5df9fc49473625410126f85b33807aed8e0eccd2e0bee457249b93166902af50
-
Size
388KB
-
MD5
726ef9ecbca2050a2495cef5ca9c8562
-
SHA1
ae03be4b1486880d1011802e4204569263a7d5f5
-
SHA256
5df9fc49473625410126f85b33807aed8e0eccd2e0bee457249b93166902af50
-
SHA512
9ceffc6e18376ba6ac3514def4468feb63a16d6d675cf2d0c66463fc8612b025ac5074a210f4c180e71dd03897c21f574c53cbc0e15009fa28d3c498360e9958
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-