General
-
Target
c25d9f0022af773f3be74d32ae7a5bd541441a698f1e52ec355468fe40ccecd3
-
Size
424KB
-
Sample
221022-gxftxabccp
-
MD5
3d8c71de5e7c266362fbb2d1af145c63
-
SHA1
153332bb8a81a6e796847b205f38cbb2da69b710
-
SHA256
c25d9f0022af773f3be74d32ae7a5bd541441a698f1e52ec355468fe40ccecd3
-
SHA512
7a34d2d72d2b390d18f45eb8cbbf2daa67ba2470397f714dbc0e5f680bcb32a9b65fb81103a859a7378a97e30acfa134990467f3a35d95e8a2699ee0eb044f7d
-
SSDEEP
6144:zwLTYUfBg4Xu/6M8ijCVJLjg3KOQWREfxn9C2hMYhE03moXbftChXW3AxfulDGgB:zglK4XuiQaYR+n9CuLhEknblCJxfS6
Static task
static1
Behavioral task
behavioral1
Sample
c25d9f0022af773f3be74d32ae7a5bd541441a698f1e52ec355468fe40ccecd3.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
c25d9f0022af773f3be74d32ae7a5bd541441a698f1e52ec355468fe40ccecd3.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\_RECoVERY_+dfyjj.txt
teslacrypt
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/A2E1497BB516713
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/A2E1497BB516713
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/A2E1497BB516713
http://xlowfznrg4wf7dli.ONION/A2E1497BB516713
Targets
-
-
Target
c25d9f0022af773f3be74d32ae7a5bd541441a698f1e52ec355468fe40ccecd3
-
Size
424KB
-
MD5
3d8c71de5e7c266362fbb2d1af145c63
-
SHA1
153332bb8a81a6e796847b205f38cbb2da69b710
-
SHA256
c25d9f0022af773f3be74d32ae7a5bd541441a698f1e52ec355468fe40ccecd3
-
SHA512
7a34d2d72d2b390d18f45eb8cbbf2daa67ba2470397f714dbc0e5f680bcb32a9b65fb81103a859a7378a97e30acfa134990467f3a35d95e8a2699ee0eb044f7d
-
SSDEEP
6144:zwLTYUfBg4Xu/6M8ijCVJLjg3KOQWREfxn9C2hMYhE03moXbftChXW3AxfulDGgB:zglK4XuiQaYR+n9CuLhEknblCJxfS6
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-