General
-
Target
222e2c1e3ad219e24f2a4362a5a0d5d269f23d84c5b85632e171401b70b01346
-
Size
360KB
-
Sample
221020-sck4nsadcl
-
MD5
bb42ac7cdc834ba9abb5b4b90025f022
-
SHA1
3c75d402cca4de4898ac07888900ee7560b9536e
-
SHA256
222e2c1e3ad219e24f2a4362a5a0d5d269f23d84c5b85632e171401b70b01346
-
SHA512
d8ea171111608ddf2d028eec2c1a379e12e2dcd2e54258eb5911108e4f37a71bdf5b51b62599a867fe6d5e219ec79da0765120dc60a92d09f7ee7f2c2e015f0f
-
SSDEEP
6144:IqZbqZToxIizLBZ6R56VkGM4ceLJ5vs5JGJceO/QCErIiuNAvwu:IqZb8oR3D6R5QHXZJy/Q50imAvB
Static task
static1
Behavioral task
behavioral1
Sample
222e2c1e3ad219e24f2a4362a5a0d5d269f23d84c5b85632e171401b70b01346.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
222e2c1e3ad219e24f2a4362a5a0d5d269f23d84c5b85632e171401b70b01346.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-2292972927-2705560509-2768824231-1000\_RECOVERY_+kfeba.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/D5A639323289BEB
http://tes543berda73i48fsdfsd.keratadze.at/D5A639323289BEB
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/D5A639323289BEB
http://xlowfznrg4wf7dli.ONION/D5A639323289BEB
Extracted
C:\$Recycle.Bin\S-1-5-21-2629973501-4017243118-3254762364-1000\_RECOVERY_+rujvp.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/38595B95B895DD8E
http://tes543berda73i48fsdfsd.keratadze.at/38595B95B895DD8E
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/38595B95B895DD8E
http://xlowfznrg4wf7dli.ONION/38595B95B895DD8E
Targets
-
-
Target
222e2c1e3ad219e24f2a4362a5a0d5d269f23d84c5b85632e171401b70b01346
-
Size
360KB
-
MD5
bb42ac7cdc834ba9abb5b4b90025f022
-
SHA1
3c75d402cca4de4898ac07888900ee7560b9536e
-
SHA256
222e2c1e3ad219e24f2a4362a5a0d5d269f23d84c5b85632e171401b70b01346
-
SHA512
d8ea171111608ddf2d028eec2c1a379e12e2dcd2e54258eb5911108e4f37a71bdf5b51b62599a867fe6d5e219ec79da0765120dc60a92d09f7ee7f2c2e015f0f
-
SSDEEP
6144:IqZbqZToxIizLBZ6R56VkGM4ceLJ5vs5JGJceO/QCErIiuNAvwu:IqZb8oR3D6R5QHXZJy/Q50imAvB
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Adds Run key to start application
-