General
-
Target
07d786c92884ec850f027c69105a9873af40f9b7a791125c7027e93535a8a4a6
-
Size
424KB
-
Sample
221022-cnzs7saba8
-
MD5
ba9fc3bdca857bc4e0f9a4803c1c0dee
-
SHA1
605bfe3a0212da3231e0c4a74a4ac2e07bf3f6d2
-
SHA256
07d786c92884ec850f027c69105a9873af40f9b7a791125c7027e93535a8a4a6
-
SHA512
687c453a2a2111fdd2da657f3135dc2eeb7b665a64f68bbb51f7137c3d2f1309b94ce068d71abecaa645c66ab846834c273fefa3f27bde5530480f308e68cae3
-
SSDEEP
6144:Cg696TSBF7DRiH9Pyn65fNkKJXXj8p8HmHorKspEJihalpr70PoXbftChXW3Axfg:i96kNqmMNTFQaEorEJ4E5blCJxfS6
Static task
static1
Behavioral task
behavioral1
Sample
07d786c92884ec850f027c69105a9873af40f9b7a791125c7027e93535a8a4a6.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
07d786c92884ec850f027c69105a9873af40f9b7a791125c7027e93535a8a4a6.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\_RECoVERY_+wrolr.txt
teslacrypt
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/6618CE45086559F
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/6618CE45086559F
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/6618CE45086559F
http://xlowfznrg4wf7dli.ONION/6618CE45086559F
Targets
-
-
Target
07d786c92884ec850f027c69105a9873af40f9b7a791125c7027e93535a8a4a6
-
Size
424KB
-
MD5
ba9fc3bdca857bc4e0f9a4803c1c0dee
-
SHA1
605bfe3a0212da3231e0c4a74a4ac2e07bf3f6d2
-
SHA256
07d786c92884ec850f027c69105a9873af40f9b7a791125c7027e93535a8a4a6
-
SHA512
687c453a2a2111fdd2da657f3135dc2eeb7b665a64f68bbb51f7137c3d2f1309b94ce068d71abecaa645c66ab846834c273fefa3f27bde5530480f308e68cae3
-
SSDEEP
6144:Cg696TSBF7DRiH9Pyn65fNkKJXXj8p8HmHorKspEJihalpr70PoXbftChXW3Axfg:i96kNqmMNTFQaEorEJ4E5blCJxfS6
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-