General
-
Target
79ba3129456095cb130aab3b2fc6e840a6c12b7af06b4120013c6899321ef627
-
Size
424KB
-
Sample
221023-eb2hdagbg8
-
MD5
d313ccc04176d6084de172cb8aa91a3a
-
SHA1
1c661ef24338246e08f8266c4b4a5a877de33138
-
SHA256
79ba3129456095cb130aab3b2fc6e840a6c12b7af06b4120013c6899321ef627
-
SHA512
5a74833990e3a1bd0db33d782e1197b59dc0ea01aee90cf71dd64c9801967655d4e5e454e055c119f99d6fdcd0c143bab5c86b238e4d36a1370d0c48071e079c
-
SSDEEP
12288:BtTSCpL5xUCSss7sgHi10WtdCW083blCJxfS6:TTSUHUCS/diqW2gOR1
Static task
static1
Behavioral task
behavioral1
Sample
79ba3129456095cb130aab3b2fc6e840a6c12b7af06b4120013c6899321ef627.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
79ba3129456095cb130aab3b2fc6e840a6c12b7af06b4120013c6899321ef627.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-2295526160-1155304984-640977766-1000\_RECoVERY_+llque.txt
teslacrypt
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/EC37E023CE20441B
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/EC37E023CE20441B
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/EC37E023CE20441B
http://xlowfznrg4wf7dli.ONION/EC37E023CE20441B
Targets
-
-
Target
79ba3129456095cb130aab3b2fc6e840a6c12b7af06b4120013c6899321ef627
-
Size
424KB
-
MD5
d313ccc04176d6084de172cb8aa91a3a
-
SHA1
1c661ef24338246e08f8266c4b4a5a877de33138
-
SHA256
79ba3129456095cb130aab3b2fc6e840a6c12b7af06b4120013c6899321ef627
-
SHA512
5a74833990e3a1bd0db33d782e1197b59dc0ea01aee90cf71dd64c9801967655d4e5e454e055c119f99d6fdcd0c143bab5c86b238e4d36a1370d0c48071e079c
-
SSDEEP
12288:BtTSCpL5xUCSss7sgHi10WtdCW083blCJxfS6:TTSUHUCS/diqW2gOR1
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-