General
-
Target
5cb0c4b21927d654e5f0b1efe8b8ec80dc693c463b4de29f6b1e591105c584d1
-
Size
369KB
-
Sample
220801-gax5nscad4
-
MD5
5b638a15ecb9b00a6a0aef70de059ff8
-
SHA1
c1ab227d0fe218b1cca7415b02eb78beb6d69e1f
-
SHA256
5cb0c4b21927d654e5f0b1efe8b8ec80dc693c463b4de29f6b1e591105c584d1
-
SHA512
90c90884116058a9de73c95adb92edbf12410b7ef1a92c1436342789c57565d06cb69cceecbde91782a03a7cb6dd13abaa390c68e1a47db34f7ed58d53498b01
Static task
static1
Behavioral task
behavioral1
Sample
5cb0c4b21927d654e5f0b1efe8b8ec80dc693c463b4de29f6b1e591105c584d1.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
5cb0c4b21927d654e5f0b1efe8b8ec80dc693c463b4de29f6b1e591105c584d1.exe
Resource
win10v2004-20220721-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-4084403625-2215941253-1760665084-1000\_RECoVERY_+akfps.txt
teslacrypt
http://yyre45dbvn2nhbefbmh.begumvelic.at/16971B6CFA361E9A
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/16971B6CFA361E9A
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/16971B6CFA361E9A
http://xlowfznrg4wf7dli.ONION/16971B6CFA361E9A
Extracted
C:\$Recycle.Bin\S-1-5-21-2372564722-193526734-2636556182-1000\_RECoVERY_+uglxb.txt
teslacrypt
http://yyre45dbvn2nhbefbmh.begumvelic.at/E2BC1FA9CAD25AE
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/E2BC1FA9CAD25AE
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/E2BC1FA9CAD25AE
http://xlowfznrg4wf7dli.ONION/E2BC1FA9CAD25AE
Targets
-
-
Target
5cb0c4b21927d654e5f0b1efe8b8ec80dc693c463b4de29f6b1e591105c584d1
-
Size
369KB
-
MD5
5b638a15ecb9b00a6a0aef70de059ff8
-
SHA1
c1ab227d0fe218b1cca7415b02eb78beb6d69e1f
-
SHA256
5cb0c4b21927d654e5f0b1efe8b8ec80dc693c463b4de29f6b1e591105c584d1
-
SHA512
90c90884116058a9de73c95adb92edbf12410b7ef1a92c1436342789c57565d06cb69cceecbde91782a03a7cb6dd13abaa390c68e1a47db34f7ed58d53498b01
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-