General
-
Target
9708ca827d149b1b4f392cbf2b6f8cea286e4e90dbaff77afcc9fc3adfce9d93
-
Size
500KB
-
Sample
221022-ed9lrsadh7
-
MD5
ba5e80f2d798e241471decd7fea5c32e
-
SHA1
0a94f3a096002197befb9dd5e6611f0fba19cf8d
-
SHA256
9708ca827d149b1b4f392cbf2b6f8cea286e4e90dbaff77afcc9fc3adfce9d93
-
SHA512
ce193d58ff73fccc14e9afcb4a2c55a70f501f563cd0be3be878ee76aee94328f0956b88bf17ad3f585b3da08c2914828d5360f85ff8b0507bc9219733ba98ff
-
SSDEEP
6144:a+5uzIF/dV6GdE98vJwvw8AWLG1qSrX6T26WyJNh:B5uzKdzd7RazYtT6Xh
Static task
static1
Behavioral task
behavioral1
Sample
9708ca827d149b1b4f392cbf2b6f8cea286e4e90dbaff77afcc9fc3adfce9d93.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9708ca827d149b1b4f392cbf2b6f8cea286e4e90dbaff77afcc9fc3adfce9d93.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\_ReCoVeRy_+hykbn.txt
teslacrypt
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/7912CF158DD5D6F2
http://gfkuwflbhsjdabnu4nfukerfqwlfwr4rw.ringbalor.com/7912CF158DD5D6F2
http://oehknf74ohqlfnpq9rhfgcq93g.hateflux.com/7912CF158DD5D6F2
http://xlowfznrg4wf7dli.ONION/7912CF158DD5D6F2
Targets
-
-
Target
9708ca827d149b1b4f392cbf2b6f8cea286e4e90dbaff77afcc9fc3adfce9d93
-
Size
500KB
-
MD5
ba5e80f2d798e241471decd7fea5c32e
-
SHA1
0a94f3a096002197befb9dd5e6611f0fba19cf8d
-
SHA256
9708ca827d149b1b4f392cbf2b6f8cea286e4e90dbaff77afcc9fc3adfce9d93
-
SHA512
ce193d58ff73fccc14e9afcb4a2c55a70f501f563cd0be3be878ee76aee94328f0956b88bf17ad3f585b3da08c2914828d5360f85ff8b0507bc9219733ba98ff
-
SSDEEP
6144:a+5uzIF/dV6GdE98vJwvw8AWLG1qSrX6T26WyJNh:B5uzKdzd7RazYtT6Xh
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-