General
-
Target
5a48d53f00afd3a50f06138ba37ca6bb5ff38011801879bdb94215ab8bfdf634
-
Size
328KB
-
Sample
220802-epln3sabf5
-
MD5
452e6b32cf0172170701558e2333d016
-
SHA1
a9aa39a0765947e12a1475a59740c6de5bb5e7ec
-
SHA256
5a48d53f00afd3a50f06138ba37ca6bb5ff38011801879bdb94215ab8bfdf634
-
SHA512
993b3147e0e45444c6f38f917e2bb92d8c63097b1276e6087df19d7396bc06e07d2bd1e9a823649a1d4a1e4037b7845bc8ca7205d8ace8dae07a298116a850e3
Static task
static1
Behavioral task
behavioral1
Sample
5a48d53f00afd3a50f06138ba37ca6bb5ff38011801879bdb94215ab8bfdf634.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
5a48d53f00afd3a50f06138ba37ca6bb5ff38011801879bdb94215ab8bfdf634.exe
Resource
win10v2004-20220721-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-3762437355-3468409815-1164039494-1000\Recovery+okdnr.txt
teslacrypt
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/BBE25A1B3739428
http://kkd47eh4hdjshb5t.angortra.at/BBE25A1B3739428
http://ytrest84y5i456hghadefdsd.pontogrot.com/BBE25A1B3739428
http://xlowfznrg4wf7dli.ONION/BBE25A1B3739428
Extracted
C:\$Recycle.Bin\S-1-5-21-1101907861-274115917-2188613224-1000\Recovery+kxfwl.txt
teslacrypt
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/4150836BEA36A73A
http://kkd47eh4hdjshb5t.angortra.at/4150836BEA36A73A
http://ytrest84y5i456hghadefdsd.pontogrot.com/4150836BEA36A73A
http://xlowfznrg4wf7dli.ONION/4150836BEA36A73A
Targets
-
-
Target
5a48d53f00afd3a50f06138ba37ca6bb5ff38011801879bdb94215ab8bfdf634
-
Size
328KB
-
MD5
452e6b32cf0172170701558e2333d016
-
SHA1
a9aa39a0765947e12a1475a59740c6de5bb5e7ec
-
SHA256
5a48d53f00afd3a50f06138ba37ca6bb5ff38011801879bdb94215ab8bfdf634
-
SHA512
993b3147e0e45444c6f38f917e2bb92d8c63097b1276e6087df19d7396bc06e07d2bd1e9a823649a1d4a1e4037b7845bc8ca7205d8ace8dae07a298116a850e3
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Adds Run key to start application
-