General
-
Target
5c66409676c106af99f24e3d199148c759c66b16f53511741c509bed0414ac8a
-
Size
332KB
-
Sample
220801-r3yl1saffj
-
MD5
6474dc000199add9c42df4733aeec2f3
-
SHA1
9dc04f8b70f028b20ccc5cd540c68834d0dae790
-
SHA256
5c66409676c106af99f24e3d199148c759c66b16f53511741c509bed0414ac8a
-
SHA512
4e983ac9d6bb40aa99bdb506c9013e791c9fa11f584521c88e07fc35b7033e9010727e231de6121e1335ff327d7337d6582898b81a6ef125fbf006b60a425b40
Static task
static1
Behavioral task
behavioral1
Sample
5c66409676c106af99f24e3d199148c759c66b16f53511741c509bed0414ac8a.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
5c66409676c106af99f24e3d199148c759c66b16f53511741c509bed0414ac8a.exe
Resource
win10v2004-20220721-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-3762437355-3468409815-1164039494-1000\_RECOVERY_+xorsp.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/6033E21D6CB2FD4
http://tes543berda73i48fsdfsd.keratadze.at/6033E21D6CB2FD4
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/6033E21D6CB2FD4
http://xlowfznrg4wf7dli.ONION/6033E21D6CB2FD4
Extracted
C:\$Recycle.Bin\S-1-5-21-1101907861-274115917-2188613224-1000\_RECOVERY_+omoqr.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/1FAA17B8F307AB5
http://tes543berda73i48fsdfsd.keratadze.at/1FAA17B8F307AB5
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/1FAA17B8F307AB5
http://xlowfznrg4wf7dli.ONION/1FAA17B8F307AB5
Targets
-
-
Target
5c66409676c106af99f24e3d199148c759c66b16f53511741c509bed0414ac8a
-
Size
332KB
-
MD5
6474dc000199add9c42df4733aeec2f3
-
SHA1
9dc04f8b70f028b20ccc5cd540c68834d0dae790
-
SHA256
5c66409676c106af99f24e3d199148c759c66b16f53511741c509bed0414ac8a
-
SHA512
4e983ac9d6bb40aa99bdb506c9013e791c9fa11f584521c88e07fc35b7033e9010727e231de6121e1335ff327d7337d6582898b81a6ef125fbf006b60a425b40
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Adds Run key to start application
-