General
-
Target
09f36ab633d5ecc1b59034f35d11bf3bd3507c780f9afea683dce83627c2a444
-
Size
424KB
-
Sample
221022-h4zq2abfck
-
MD5
77524130a695886729d39028a0540b30
-
SHA1
5282ecada34607c247d9579abf6e8afc37ec45f8
-
SHA256
09f36ab633d5ecc1b59034f35d11bf3bd3507c780f9afea683dce83627c2a444
-
SHA512
ac1775c2155c498ec411ba39d0d1a9a4488b1047e2939fbd1ec5eb62788fb1f77ece800ca22435601459d4332f0e8577a091efe7d6b60689c292d837451da140
-
SSDEEP
12288:XqEXeMVG+C7QP2sFZ1u2iW4ZJSPhgYblCJxfS6:aEXeCG+uOLFDId2PhggOR1
Static task
static1
Behavioral task
behavioral1
Sample
09f36ab633d5ecc1b59034f35d11bf3bd3507c780f9afea683dce83627c2a444.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
09f36ab633d5ecc1b59034f35d11bf3bd3507c780f9afea683dce83627c2a444.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\_RECoVERY_+dijgx.txt
teslacrypt
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/E05325F9A1797090
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/E05325F9A1797090
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/E05325F9A1797090
http://xlowfznrg4wf7dli.ONION/E05325F9A1797090
Targets
-
-
Target
09f36ab633d5ecc1b59034f35d11bf3bd3507c780f9afea683dce83627c2a444
-
Size
424KB
-
MD5
77524130a695886729d39028a0540b30
-
SHA1
5282ecada34607c247d9579abf6e8afc37ec45f8
-
SHA256
09f36ab633d5ecc1b59034f35d11bf3bd3507c780f9afea683dce83627c2a444
-
SHA512
ac1775c2155c498ec411ba39d0d1a9a4488b1047e2939fbd1ec5eb62788fb1f77ece800ca22435601459d4332f0e8577a091efe7d6b60689c292d837451da140
-
SSDEEP
12288:XqEXeMVG+C7QP2sFZ1u2iW4ZJSPhgYblCJxfS6:aEXeCG+uOLFDId2PhggOR1
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-