General
-
Target
583431576fc175e19758774ec8b2893431aafe9a58c025406f22281b60f1aef0
-
Size
424KB
-
Sample
221022-f8r6msbagm
-
MD5
c6665caa8d5455b1643bc72fe55b0ade
-
SHA1
eac5cb2ca1661c2f282393d0cdc52d8bfc1dea42
-
SHA256
583431576fc175e19758774ec8b2893431aafe9a58c025406f22281b60f1aef0
-
SHA512
921412255db2b5b5a076f773468f63c56411f06bb249121160e8695ea9bbc75714e2034a14d79275cb024d18708f7ebf5aad69d780b831384d2cb603fed7255c
-
SSDEEP
12288:eL2WjWgDhrhjxaRaDz7z4HMLzskGWoXblCJxfS6:eDXpVx7f7dLoMorOR1
Static task
static1
Behavioral task
behavioral1
Sample
583431576fc175e19758774ec8b2893431aafe9a58c025406f22281b60f1aef0.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
583431576fc175e19758774ec8b2893431aafe9a58c025406f22281b60f1aef0.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-2891029575-1462575-1165213807-1000\_RECoVERY_+wfjdo.txt
teslacrypt
http://yyre45dbvn2nhbefbmh.begumvelic.at/2781496C72F8D7FF
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/2781496C72F8D7FF
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/2781496C72F8D7FF
http://xlowfznrg4wf7dli.ONION/2781496C72F8D7FF
Targets
-
-
Target
583431576fc175e19758774ec8b2893431aafe9a58c025406f22281b60f1aef0
-
Size
424KB
-
MD5
c6665caa8d5455b1643bc72fe55b0ade
-
SHA1
eac5cb2ca1661c2f282393d0cdc52d8bfc1dea42
-
SHA256
583431576fc175e19758774ec8b2893431aafe9a58c025406f22281b60f1aef0
-
SHA512
921412255db2b5b5a076f773468f63c56411f06bb249121160e8695ea9bbc75714e2034a14d79275cb024d18708f7ebf5aad69d780b831384d2cb603fed7255c
-
SSDEEP
12288:eL2WjWgDhrhjxaRaDz7z4HMLzskGWoXblCJxfS6:eDXpVx7f7dLoMorOR1
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-