General
-
Target
5e90b0042516378587887492a531d8e4b51d980db077bc1667c96119729c4f11
-
Size
332KB
-
Sample
220731-ymle3sdhd6
-
MD5
4aa08e4766abef7fa2cc773b92dab8c5
-
SHA1
08981143807da8646bb7f5ae81e9081898a8d850
-
SHA256
5e90b0042516378587887492a531d8e4b51d980db077bc1667c96119729c4f11
-
SHA512
455210513993d12902b32375844f0008ffb262c82e30e26650b5c72c7ff7d6e9c674737a717a116ab2f8b5646b67779e17c59e6cbc06458721d5a74bfe32bb08
Static task
static1
Behavioral task
behavioral1
Sample
5e90b0042516378587887492a531d8e4b51d980db077bc1667c96119729c4f11.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
5e90b0042516378587887492a531d8e4b51d980db077bc1667c96119729c4f11.exe
Resource
win10v2004-20220721-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-3762437355-3468409815-1164039494-1000\_RECOVERY_+coepe.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/6AC5DE547F53A72
http://tes543berda73i48fsdfsd.keratadze.at/6AC5DE547F53A72
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/6AC5DE547F53A72
http://xlowfznrg4wf7dli.ONION/6AC5DE547F53A72
Extracted
C:\$Recycle.Bin\S-1-5-21-1101907861-274115917-2188613224-1000\_RECOVERY_+vjjdy.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/5E2253315786DEE1
http://tes543berda73i48fsdfsd.keratadze.at/5E2253315786DEE1
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/5E2253315786DEE1
http://xlowfznrg4wf7dli.ONION/5E2253315786DEE1
Targets
-
-
Target
5e90b0042516378587887492a531d8e4b51d980db077bc1667c96119729c4f11
-
Size
332KB
-
MD5
4aa08e4766abef7fa2cc773b92dab8c5
-
SHA1
08981143807da8646bb7f5ae81e9081898a8d850
-
SHA256
5e90b0042516378587887492a531d8e4b51d980db077bc1667c96119729c4f11
-
SHA512
455210513993d12902b32375844f0008ffb262c82e30e26650b5c72c7ff7d6e9c674737a717a116ab2f8b5646b67779e17c59e6cbc06458721d5a74bfe32bb08
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Adds Run key to start application
-