General
-
Target
72ebc64f86ef3c07e200b7b575c87baec6b150340b58dc948d4c15390a7a52a5
-
Size
424KB
-
Sample
221022-geg91sbaa3
-
MD5
325f660b6e6802581315052c0d9b190c
-
SHA1
48b6692d89e64f513a48b51dc84bf14cb535b84b
-
SHA256
72ebc64f86ef3c07e200b7b575c87baec6b150340b58dc948d4c15390a7a52a5
-
SHA512
bdf1800aaa75effe7faeaf65fc253588253333408d7f623b923dd741b4778512f666e0b26fecdda3a51b1e3fa27c377f4a7d77ab37bfbd1c1612c5d4a497939d
-
SSDEEP
12288:Zj6qMoki2//HuarKqen05/QexvmBG3zbblCJxfS6:ZjPQ/HdQoq2fOR1
Static task
static1
Behavioral task
behavioral1
Sample
72ebc64f86ef3c07e200b7b575c87baec6b150340b58dc948d4c15390a7a52a5.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
72ebc64f86ef3c07e200b7b575c87baec6b150340b58dc948d4c15390a7a52a5.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\_RECoVERY_+dfaer.txt
teslacrypt
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/F3E1CB5427CBCA2A
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/F3E1CB5427CBCA2A
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/F3E1CB5427CBCA2A
http://xlowfznrg4wf7dli.ONION/F3E1CB5427CBCA2A
Targets
-
-
Target
72ebc64f86ef3c07e200b7b575c87baec6b150340b58dc948d4c15390a7a52a5
-
Size
424KB
-
MD5
325f660b6e6802581315052c0d9b190c
-
SHA1
48b6692d89e64f513a48b51dc84bf14cb535b84b
-
SHA256
72ebc64f86ef3c07e200b7b575c87baec6b150340b58dc948d4c15390a7a52a5
-
SHA512
bdf1800aaa75effe7faeaf65fc253588253333408d7f623b923dd741b4778512f666e0b26fecdda3a51b1e3fa27c377f4a7d77ab37bfbd1c1612c5d4a497939d
-
SSDEEP
12288:Zj6qMoki2//HuarKqen05/QexvmBG3zbblCJxfS6:ZjPQ/HdQoq2fOR1
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-