General
-
Target
ede4b8fdfba8799bc09ba2bc4b0f5f2ba6a7d52276e59fc1b7ef2a13d948c11f
-
Size
424KB
-
Sample
221022-g66fxsbcgk
-
MD5
61f88d5d87776f2d58197cb87af5e8e7
-
SHA1
38642269bb87d098131a8cd59b75ea2cb52e937d
-
SHA256
ede4b8fdfba8799bc09ba2bc4b0f5f2ba6a7d52276e59fc1b7ef2a13d948c11f
-
SHA512
aad32e93939e49586760395dd5c8eacec0e179fd43c85344fff1d7e396d66b3314cc936b2e6cf02219214a65ad03a60847d96a696d9f65f41fb9c434cd765832
-
SSDEEP
6144:Yg696TSBF7DRiH9Pyn65fNkKJXXj8p8HmHorKspEJihalpr70PoXbftChXW3Axfg:g96kNqmMNTFQaEorEJ4E5blCJxfS6
Static task
static1
Behavioral task
behavioral1
Sample
ede4b8fdfba8799bc09ba2bc4b0f5f2ba6a7d52276e59fc1b7ef2a13d948c11f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ede4b8fdfba8799bc09ba2bc4b0f5f2ba6a7d52276e59fc1b7ef2a13d948c11f.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\_RECoVERY_+eapvh.txt
teslacrypt
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/AA83CF933096218
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/AA83CF933096218
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/AA83CF933096218
http://xlowfznrg4wf7dli.ONION/AA83CF933096218
Targets
-
-
Target
ede4b8fdfba8799bc09ba2bc4b0f5f2ba6a7d52276e59fc1b7ef2a13d948c11f
-
Size
424KB
-
MD5
61f88d5d87776f2d58197cb87af5e8e7
-
SHA1
38642269bb87d098131a8cd59b75ea2cb52e937d
-
SHA256
ede4b8fdfba8799bc09ba2bc4b0f5f2ba6a7d52276e59fc1b7ef2a13d948c11f
-
SHA512
aad32e93939e49586760395dd5c8eacec0e179fd43c85344fff1d7e396d66b3314cc936b2e6cf02219214a65ad03a60847d96a696d9f65f41fb9c434cd765832
-
SSDEEP
6144:Yg696TSBF7DRiH9Pyn65fNkKJXXj8p8HmHorKspEJihalpr70PoXbftChXW3Axfg:g96kNqmMNTFQaEorEJ4E5blCJxfS6
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-