General
-
Target
67733a26f813e0384bf4a727fcd6af8253e88ea7a13f45e6b6d3ba78cfcede0c
-
Size
424KB
-
Sample
221022-sgj26seabq
-
MD5
c9489c311cef8e2fd8b25202625f8300
-
SHA1
fc8278fc91cfe0adb178db023a05be60da51a877
-
SHA256
67733a26f813e0384bf4a727fcd6af8253e88ea7a13f45e6b6d3ba78cfcede0c
-
SHA512
d7429ceb069e6f2069ef49550764ca8f69c6a147516fb43c3a00a5792332d404cc69f59f4402609de7da4b7d159bfc790af09d62cbbc1e46245e42af3cff6c29
-
SSDEEP
12288:HL2WjWgDhrhjxaRaDz7z4HMLzskGWoXblCJxfS6:HDXpVx7f7dLoMorOR1
Static task
static1
Behavioral task
behavioral1
Sample
67733a26f813e0384bf4a727fcd6af8253e88ea7a13f45e6b6d3ba78cfcede0c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
67733a26f813e0384bf4a727fcd6af8253e88ea7a13f45e6b6d3ba78cfcede0c.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\_RECoVERY_+tuurs.txt
teslacrypt
http://yyre45dbvn2nhbefbmh.begumvelic.at/2D2795B38D7B076
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/2D2795B38D7B076
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/2D2795B38D7B076
http://xlowfznrg4wf7dli.ONION/2D2795B38D7B076
Targets
-
-
Target
67733a26f813e0384bf4a727fcd6af8253e88ea7a13f45e6b6d3ba78cfcede0c
-
Size
424KB
-
MD5
c9489c311cef8e2fd8b25202625f8300
-
SHA1
fc8278fc91cfe0adb178db023a05be60da51a877
-
SHA256
67733a26f813e0384bf4a727fcd6af8253e88ea7a13f45e6b6d3ba78cfcede0c
-
SHA512
d7429ceb069e6f2069ef49550764ca8f69c6a147516fb43c3a00a5792332d404cc69f59f4402609de7da4b7d159bfc790af09d62cbbc1e46245e42af3cff6c29
-
SSDEEP
12288:HL2WjWgDhrhjxaRaDz7z4HMLzskGWoXblCJxfS6:HDXpVx7f7dLoMorOR1
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-