General
-
Target
c704efe7c23661b448713dd573999023d9d729a16da659cde648297484b827ab
-
Size
424KB
-
Sample
221023-3wd5ksddb9
-
MD5
51b36dc6c3c23b77aa2955f374b3e155
-
SHA1
d9d7282b349cfb23d1115c9eed0d0458952d7d00
-
SHA256
c704efe7c23661b448713dd573999023d9d729a16da659cde648297484b827ab
-
SHA512
58814cdd42bdb698f1d02aa425dbe22643f89dc4836db3a8f385a698b4a6e598d037aff7b776b598fc71295317bbd613ad0a8a91050c331a21e281fa3521d154
-
SSDEEP
6144:8sPAYJDo2magV+8GUEmGM41DwAHQmjdN1AUL0yogLpWPoXbftChXW3AxfulDGgB:Xp808fEmLqDwAJjpA+E+blCJxfS6
Static task
static1
Behavioral task
behavioral1
Sample
c704efe7c23661b448713dd573999023d9d729a16da659cde648297484b827ab.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c704efe7c23661b448713dd573999023d9d729a16da659cde648297484b827ab.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-2629973501-4017243118-3254762364-1000\_RECoVERY_+ngydn.txt
teslacrypt
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/973FDC73AB1D811D
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/973FDC73AB1D811D
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/973FDC73AB1D811D
http://xlowfznrg4wf7dli.ONION/973FDC73AB1D811D
Targets
-
-
Target
c704efe7c23661b448713dd573999023d9d729a16da659cde648297484b827ab
-
Size
424KB
-
MD5
51b36dc6c3c23b77aa2955f374b3e155
-
SHA1
d9d7282b349cfb23d1115c9eed0d0458952d7d00
-
SHA256
c704efe7c23661b448713dd573999023d9d729a16da659cde648297484b827ab
-
SHA512
58814cdd42bdb698f1d02aa425dbe22643f89dc4836db3a8f385a698b4a6e598d037aff7b776b598fc71295317bbd613ad0a8a91050c331a21e281fa3521d154
-
SSDEEP
6144:8sPAYJDo2magV+8GUEmGM41DwAHQmjdN1AUL0yogLpWPoXbftChXW3AxfulDGgB:Xp808fEmLqDwAJjpA+E+blCJxfS6
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-