General
-
Target
5c38e38a7f28797ecbf438a7f4023dcfaaccd3f400d02a2a543740a7fe03b9d6
-
Size
328KB
-
Sample
220801-spfpqaafc6
-
MD5
6b3bb6ab30945def63d16d3b85184511
-
SHA1
f5b3ddf276d663b1a59cd66a981c1c79e6fcb991
-
SHA256
5c38e38a7f28797ecbf438a7f4023dcfaaccd3f400d02a2a543740a7fe03b9d6
-
SHA512
aacaf7e117e1e77b965b3175914b5388fe78fa2cb910cdfb568eb556f2240b16474a27215e1d925ab58ec0ba496635e0fb9aadb0e157343e195297b08c4f32fe
Static task
static1
Behavioral task
behavioral1
Sample
5c38e38a7f28797ecbf438a7f4023dcfaaccd3f400d02a2a543740a7fe03b9d6.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
5c38e38a7f28797ecbf438a7f4023dcfaaccd3f400d02a2a543740a7fe03b9d6.exe
Resource
win10v2004-20220721-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-4084403625-2215941253-1760665084-1000\Recovery+odyfe.txt
teslacrypt
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/94C07E2CC3F426FC
http://kkd47eh4hdjshb5t.angortra.at/94C07E2CC3F426FC
http://ytrest84y5i456hghadefdsd.pontogrot.com/94C07E2CC3F426FC
http://xlowfznrg4wf7dli.ONION/94C07E2CC3F426FC
Extracted
C:\$Recycle.Bin\S-1-5-21-2372564722-193526734-2636556182-1000\Recovery+hidcb.txt
teslacrypt
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/89A6D1D4C9D15249
http://kkd47eh4hdjshb5t.angortra.at/89A6D1D4C9D15249
http://ytrest84y5i456hghadefdsd.pontogrot.com/89A6D1D4C9D15249
http://xlowfznrg4wf7dli.ONION/89A6D1D4C9D15249
Targets
-
-
Target
5c38e38a7f28797ecbf438a7f4023dcfaaccd3f400d02a2a543740a7fe03b9d6
-
Size
328KB
-
MD5
6b3bb6ab30945def63d16d3b85184511
-
SHA1
f5b3ddf276d663b1a59cd66a981c1c79e6fcb991
-
SHA256
5c38e38a7f28797ecbf438a7f4023dcfaaccd3f400d02a2a543740a7fe03b9d6
-
SHA512
aacaf7e117e1e77b965b3175914b5388fe78fa2cb910cdfb568eb556f2240b16474a27215e1d925ab58ec0ba496635e0fb9aadb0e157343e195297b08c4f32fe
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Adds Run key to start application
-