General
-
Target
112895b420d604979ba6b78c756063f0c17146097a41795d0922c2a173415c7e
-
Size
428KB
-
Sample
221022-jvn4lsbghp
-
MD5
5199b690874c0baa375855e37789569e
-
SHA1
ce65f46da270330e66da4fa879932f091f01fcc9
-
SHA256
112895b420d604979ba6b78c756063f0c17146097a41795d0922c2a173415c7e
-
SHA512
0fab6da9d104884a4300317e9a00ee909995ce7bd6afb76bfdcd220543591ebc66c572c819029dfe30729538dd18930da95b34192a36da4509cdce0d85b2dbfb
-
SSDEEP
12288:RGWf3BWLqi/f3xF7PxqViWValazc5ICyPFblCJxfS6:PBSqi/fxWiWVQqJOR1
Static task
static1
Behavioral task
behavioral1
Sample
112895b420d604979ba6b78c756063f0c17146097a41795d0922c2a173415c7e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
112895b420d604979ba6b78c756063f0c17146097a41795d0922c2a173415c7e.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-2295526160-1155304984-640977766-1000\_RECoVERY_+dccdg.txt
teslacrypt
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/B0025B82F3E31CC
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/B0025B82F3E31CC
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/B0025B82F3E31CC
http://xlowfznrg4wf7dli.ONION/B0025B82F3E31CC
Targets
-
-
Target
112895b420d604979ba6b78c756063f0c17146097a41795d0922c2a173415c7e
-
Size
428KB
-
MD5
5199b690874c0baa375855e37789569e
-
SHA1
ce65f46da270330e66da4fa879932f091f01fcc9
-
SHA256
112895b420d604979ba6b78c756063f0c17146097a41795d0922c2a173415c7e
-
SHA512
0fab6da9d104884a4300317e9a00ee909995ce7bd6afb76bfdcd220543591ebc66c572c819029dfe30729538dd18930da95b34192a36da4509cdce0d85b2dbfb
-
SSDEEP
12288:RGWf3BWLqi/f3xF7PxqViWValazc5ICyPFblCJxfS6:PBSqi/fxWiWVQqJOR1
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-