General
-
Target
c134a0ac2809efa669ab3e69597873916f629aca0581664159c4d101a6adc609
-
Size
328KB
-
Sample
221023-2a17jsdag6
-
MD5
77b3d8d5850b5735e58db6fc281f763f
-
SHA1
cd4813d5533f1894f8b6ece019c577f46d5fa4ec
-
SHA256
c134a0ac2809efa669ab3e69597873916f629aca0581664159c4d101a6adc609
-
SHA512
728f6691a97153a1159f2fcdc2fb7257fe38eef2a3b900ae1d44ad8235f943a015fc74b27839a0d1bca7aba7af10e19a785b3795571310c1a11711b23a20fd2f
-
SSDEEP
6144:F4MKA86q6kcKPqCAOFPmvSNQgstAw/u5jp2hnU4ZcRdN1Sgg68:F9x1KNRmKN+/Mk3eBU
Static task
static1
Behavioral task
behavioral1
Sample
c134a0ac2809efa669ab3e69597873916f629aca0581664159c4d101a6adc609.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c134a0ac2809efa669ab3e69597873916f629aca0581664159c4d101a6adc609.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-2295526160-1155304984-640977766-1000\_RECoVERY_+hllwe.txt
teslacrypt
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/F1835DAB642098A3
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/F1835DAB642098A3
http://yyre45dbvn2nhbefbmh.begumvelic.at/F1835DAB642098A3
http://xlowfznrg4wf7dli.ONION/F1835DAB642098A3
Targets
-
-
Target
c134a0ac2809efa669ab3e69597873916f629aca0581664159c4d101a6adc609
-
Size
328KB
-
MD5
77b3d8d5850b5735e58db6fc281f763f
-
SHA1
cd4813d5533f1894f8b6ece019c577f46d5fa4ec
-
SHA256
c134a0ac2809efa669ab3e69597873916f629aca0581664159c4d101a6adc609
-
SHA512
728f6691a97153a1159f2fcdc2fb7257fe38eef2a3b900ae1d44ad8235f943a015fc74b27839a0d1bca7aba7af10e19a785b3795571310c1a11711b23a20fd2f
-
SSDEEP
6144:F4MKA86q6kcKPqCAOFPmvSNQgstAw/u5jp2hnU4ZcRdN1Sgg68:F9x1KNRmKN+/Mk3eBU
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-