General
-
Target
18df9b798468c239fe3464bb550d69d29ff61bbe7e782f15d7e9cf19811b5d56
-
Size
356KB
-
Sample
221022-ftstmaagg7
-
MD5
33243e0b29de23e7b0e502d430b19687
-
SHA1
dea165f93de851c2e916b5ca849b21f459369dcc
-
SHA256
18df9b798468c239fe3464bb550d69d29ff61bbe7e782f15d7e9cf19811b5d56
-
SHA512
074cc4d64f2d20e423fde5d3dfc3a518b41a0f34eed73cadf3a9a924262e2848dbc8dfce5ffda6da4e3bdd71abeacde6fe83a6e2d626cb6ad71802473810651c
-
SSDEEP
6144:WnuEzhHd/Opk3p1JWsjCLmwRHbN4mjc5SWH6NJBZwb9:+th9NJWsjDwR7NvjcSdNJBZw
Static task
static1
Behavioral task
behavioral1
Sample
18df9b798468c239fe3464bb550d69d29ff61bbe7e782f15d7e9cf19811b5d56.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
18df9b798468c239fe3464bb550d69d29ff61bbe7e782f15d7e9cf19811b5d56.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\_RECoVERY_+bnmvx.txt
teslacrypt
http://yyre45dbvn2nhbefbmh.begumvelic.at/8A94CD3E330C95A
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/8A94CD3E330C95A
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/8A94CD3E330C95A
http://xlowfznrg4wf7dli.ONION/8A94CD3E330C95A
Targets
-
-
Target
18df9b798468c239fe3464bb550d69d29ff61bbe7e782f15d7e9cf19811b5d56
-
Size
356KB
-
MD5
33243e0b29de23e7b0e502d430b19687
-
SHA1
dea165f93de851c2e916b5ca849b21f459369dcc
-
SHA256
18df9b798468c239fe3464bb550d69d29ff61bbe7e782f15d7e9cf19811b5d56
-
SHA512
074cc4d64f2d20e423fde5d3dfc3a518b41a0f34eed73cadf3a9a924262e2848dbc8dfce5ffda6da4e3bdd71abeacde6fe83a6e2d626cb6ad71802473810651c
-
SSDEEP
6144:WnuEzhHd/Opk3p1JWsjCLmwRHbN4mjc5SWH6NJBZwb9:+th9NJWsjDwR7NvjcSdNJBZw
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-