General
-
Target
5b0f4f543457499cdd2025270dce5f0077d4e998165e581a37566a7717d0ae2b
-
Size
388KB
-
Sample
220802-bl8snachb8
-
MD5
8c682c25f38b176d8cb6e493c32f3e35
-
SHA1
454a1e9d603a4c7b2ecdfa96da88e50e93ea7d27
-
SHA256
5b0f4f543457499cdd2025270dce5f0077d4e998165e581a37566a7717d0ae2b
-
SHA512
d5a3ee9f81baea8df7d27dcae9963737594a74caf1fb3910bfd848afecdabab550c2a5a1f8f09d0eecf25be1dece608994152f4b895e4c372c153859361a016b
Static task
static1
Behavioral task
behavioral1
Sample
5b0f4f543457499cdd2025270dce5f0077d4e998165e581a37566a7717d0ae2b.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
5b0f4f543457499cdd2025270dce5f0077d4e998165e581a37566a7717d0ae2b.exe
Resource
win10v2004-20220721-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-4084403625-2215941253-1760665084-1000\Recovery+nubhl.txt
teslacrypt
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/59AF8567A1D256AB
http://kkd47eh4hdjshb5t.angortra.at/59AF8567A1D256AB
http://ytrest84y5i456hghadefdsd.pontogrot.com/59AF8567A1D256AB
http://xlowfznrg4wf7dli.ONION/59AF8567A1D256AB
Extracted
C:\$Recycle.Bin\S-1-5-21-2372564722-193526734-2636556182-1000\Recovery+fryqv.txt
teslacrypt
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/D2FCE422CD917BC3
http://kkd47eh4hdjshb5t.angortra.at/D2FCE422CD917BC3
http://ytrest84y5i456hghadefdsd.pontogrot.com/D2FCE422CD917BC3
http://xlowfznrg4wf7dli.ONION/D2FCE422CD917BC3
Targets
-
-
Target
5b0f4f543457499cdd2025270dce5f0077d4e998165e581a37566a7717d0ae2b
-
Size
388KB
-
MD5
8c682c25f38b176d8cb6e493c32f3e35
-
SHA1
454a1e9d603a4c7b2ecdfa96da88e50e93ea7d27
-
SHA256
5b0f4f543457499cdd2025270dce5f0077d4e998165e581a37566a7717d0ae2b
-
SHA512
d5a3ee9f81baea8df7d27dcae9963737594a74caf1fb3910bfd848afecdabab550c2a5a1f8f09d0eecf25be1dece608994152f4b895e4c372c153859361a016b
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-