General
-
Target
2625381f7c386a2ca581b1b249bb922bc8aeca37a5d3f8a37b771741ef8fc8e1
-
Size
424KB
-
Sample
221022-lslxkscdbn
-
MD5
74d5c545888561be891363d16ceae294
-
SHA1
127f4c1da282b56c1d5e3f05944315147f024992
-
SHA256
2625381f7c386a2ca581b1b249bb922bc8aeca37a5d3f8a37b771741ef8fc8e1
-
SHA512
2faa671ca7e9e6f458772761146020f834c8dc42af4a30e12fd71cf2106ea23811fa10213d2416a7eb3830db9f85158d12475e5bfc3a7ff278dea8e04cf5d308
-
SSDEEP
6144:C2QDnUrp63iAY4zSDQzxIvT2ok+IQGH02JCIoXbftChXW3AxfulDGgB:CdDUrp61uW0TlLIQGUbNblCJxfS6
Static task
static1
Behavioral task
behavioral1
Sample
2625381f7c386a2ca581b1b249bb922bc8aeca37a5d3f8a37b771741ef8fc8e1.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2625381f7c386a2ca581b1b249bb922bc8aeca37a5d3f8a37b771741ef8fc8e1.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\_RECoVERY_+mjsxg.txt
teslacrypt
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/39949531A6C685B3
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/39949531A6C685B3
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/39949531A6C685B3
http://xlowfznrg4wf7dli.ONION/39949531A6C685B3
Targets
-
-
Target
2625381f7c386a2ca581b1b249bb922bc8aeca37a5d3f8a37b771741ef8fc8e1
-
Size
424KB
-
MD5
74d5c545888561be891363d16ceae294
-
SHA1
127f4c1da282b56c1d5e3f05944315147f024992
-
SHA256
2625381f7c386a2ca581b1b249bb922bc8aeca37a5d3f8a37b771741ef8fc8e1
-
SHA512
2faa671ca7e9e6f458772761146020f834c8dc42af4a30e12fd71cf2106ea23811fa10213d2416a7eb3830db9f85158d12475e5bfc3a7ff278dea8e04cf5d308
-
SSDEEP
6144:C2QDnUrp63iAY4zSDQzxIvT2ok+IQGH02JCIoXbftChXW3AxfulDGgB:CdDUrp61uW0TlLIQGUbNblCJxfS6
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-