General
-
Target
5bed0b42438cb4bcc5a5dc9a5c441ae97acbb2b09dc80ec9affe06e8589b482a
-
Size
384KB
-
Sample
220801-tnamracdh9
-
MD5
644eaa7c99fcca51c624bff49d8c3050
-
SHA1
69d8df44b7f8b9eeceeb2473757d90f82189a867
-
SHA256
5bed0b42438cb4bcc5a5dc9a5c441ae97acbb2b09dc80ec9affe06e8589b482a
-
SHA512
0c8ee8ba29aac9bd9c9d2cb9ca8dd80bb9eb321d48874a7a3662491038f7611df3f0cb79bca3d84084acfdbd6b5cdb4ca33b2f68dd5f2118ba14227e2639f84a
Static task
static1
Behavioral task
behavioral1
Sample
5bed0b42438cb4bcc5a5dc9a5c441ae97acbb2b09dc80ec9affe06e8589b482a.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
5bed0b42438cb4bcc5a5dc9a5c441ae97acbb2b09dc80ec9affe06e8589b482a.exe
Resource
win10v2004-20220722-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-4084403625-2215941253-1760665084-1000\Recovery+whtwn.txt
teslacrypt
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/E3179BAC255FD9B
http://kkd47eh4hdjshb5t.angortra.at/E3179BAC255FD9B
http://ytrest84y5i456hghadefdsd.pontogrot.com/E3179BAC255FD9B
http://xlowfznrg4wf7dli.ONION/E3179BAC255FD9B
Extracted
C:\$Recycle.Bin\S-1-5-21-3463845317-933582289-45817732-1000\Recovery+chypn.txt
teslacrypt
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/3486332A0E0D2F3
http://kkd47eh4hdjshb5t.angortra.at/3486332A0E0D2F3
http://ytrest84y5i456hghadefdsd.pontogrot.com/3486332A0E0D2F3
http://xlowfznrg4wf7dli.ONION/3486332A0E0D2F3
Targets
-
-
Target
5bed0b42438cb4bcc5a5dc9a5c441ae97acbb2b09dc80ec9affe06e8589b482a
-
Size
384KB
-
MD5
644eaa7c99fcca51c624bff49d8c3050
-
SHA1
69d8df44b7f8b9eeceeb2473757d90f82189a867
-
SHA256
5bed0b42438cb4bcc5a5dc9a5c441ae97acbb2b09dc80ec9affe06e8589b482a
-
SHA512
0c8ee8ba29aac9bd9c9d2cb9ca8dd80bb9eb321d48874a7a3662491038f7611df3f0cb79bca3d84084acfdbd6b5cdb4ca33b2f68dd5f2118ba14227e2639f84a
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-