General
-
Target
5ea4a54b8778bef69dcfd4ea080e3fc7077a82797cdaa8ff60ac2214d3485248
-
Size
400KB
-
Sample
221022-gaphjabahn
-
MD5
937f2c33de9e38de79ad30ce7fc74705
-
SHA1
cd58f0511142c588049dee66c3047b88bb57806d
-
SHA256
5ea4a54b8778bef69dcfd4ea080e3fc7077a82797cdaa8ff60ac2214d3485248
-
SHA512
aa3f1635783df2bdaf344129a925e1b4c6e4af7776f7b9c9a04610a775b2760c79177fad8acf3c5c833d28b7bc5dfd058eb86758debd13826afd01d13ea4fdcc
-
SSDEEP
6144:m+5SY2+5yZzoW4Hm7XdTqr1+LC87iiFLd1//KSkl8aIrA6mJOl:lQVbz9qrcb7jtdlkNyoOl
Static task
static1
Behavioral task
behavioral1
Sample
5ea4a54b8778bef69dcfd4ea080e3fc7077a82797cdaa8ff60ac2214d3485248.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
5ea4a54b8778bef69dcfd4ea080e3fc7077a82797cdaa8ff60ac2214d3485248.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\_RECoVERY_+mtmdo.txt
teslacrypt
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/5894C6535838D884
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/5894C6535838D884
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/5894C6535838D884
http://xlowfznrg4wf7dli.ONION/5894C6535838D884
Targets
-
-
Target
5ea4a54b8778bef69dcfd4ea080e3fc7077a82797cdaa8ff60ac2214d3485248
-
Size
400KB
-
MD5
937f2c33de9e38de79ad30ce7fc74705
-
SHA1
cd58f0511142c588049dee66c3047b88bb57806d
-
SHA256
5ea4a54b8778bef69dcfd4ea080e3fc7077a82797cdaa8ff60ac2214d3485248
-
SHA512
aa3f1635783df2bdaf344129a925e1b4c6e4af7776f7b9c9a04610a775b2760c79177fad8acf3c5c833d28b7bc5dfd058eb86758debd13826afd01d13ea4fdcc
-
SSDEEP
6144:m+5SY2+5yZzoW4Hm7XdTqr1+LC87iiFLd1//KSkl8aIrA6mJOl:lQVbz9qrcb7jtdlkNyoOl
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-