General
-
Target
08542e15e022761156a80cc3703153ee30b8dc2331771bcb7b01ca190381411c
-
Size
424KB
-
Sample
221022-cpzjtsabgn
-
MD5
fd84da34b45b9d0a42923e804b3d1e51
-
SHA1
33f2082ecec70e4f96b8b9ff70e14f40fb8462f3
-
SHA256
08542e15e022761156a80cc3703153ee30b8dc2331771bcb7b01ca190381411c
-
SHA512
db3761c1afef884555180a5e0438cd0a7fc42351cf0926ad9199a7ded0906d18a7841971af07bd22c917e71afcdcd5b8f38b5eb1084d2a120489ddc263fcfae0
-
SSDEEP
12288:My8abnEX/hUUn3Q7DTw+ZA3StJSvblCJxfS6:X5DEX/hnSwYACTOOR1
Static task
static1
Behavioral task
behavioral1
Sample
08542e15e022761156a80cc3703153ee30b8dc2331771bcb7b01ca190381411c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
08542e15e022761156a80cc3703153ee30b8dc2331771bcb7b01ca190381411c.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\_RECoVERY_+sautj.txt
teslacrypt
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/FFC3349D8A05541
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/FFC3349D8A05541
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/FFC3349D8A05541
http://xlowfznrg4wf7dli.ONION/FFC3349D8A05541
Targets
-
-
Target
08542e15e022761156a80cc3703153ee30b8dc2331771bcb7b01ca190381411c
-
Size
424KB
-
MD5
fd84da34b45b9d0a42923e804b3d1e51
-
SHA1
33f2082ecec70e4f96b8b9ff70e14f40fb8462f3
-
SHA256
08542e15e022761156a80cc3703153ee30b8dc2331771bcb7b01ca190381411c
-
SHA512
db3761c1afef884555180a5e0438cd0a7fc42351cf0926ad9199a7ded0906d18a7841971af07bd22c917e71afcdcd5b8f38b5eb1084d2a120489ddc263fcfae0
-
SSDEEP
12288:My8abnEX/hUUn3Q7DTw+ZA3StJSvblCJxfS6:X5DEX/hnSwYACTOOR1
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-