General
-
Target
7bce43bdf63001d494253e9f3ba29134917a44233c339eb5eb872c92190bb698
-
Size
424KB
-
Sample
221023-eylensgch8
-
MD5
42ff22493f094600f2daa6a2984861a3
-
SHA1
f992b95f7330bcd6416df64b24267cf979b7a151
-
SHA256
7bce43bdf63001d494253e9f3ba29134917a44233c339eb5eb872c92190bb698
-
SHA512
49626857c01ac1122c19308d3584eac685c4093063f540fe7974427b602a71e7fd23046d3a281671c17b0425fe4e777747154696e99129dd153c703897345267
-
SSDEEP
12288:iL2WjWgDhrhjxaRaDz7z4HMLzskGWoXblCJxfS6:iDXpVx7f7dLoMorOR1
Static task
static1
Behavioral task
behavioral1
Sample
7bce43bdf63001d494253e9f3ba29134917a44233c339eb5eb872c92190bb698.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
7bce43bdf63001d494253e9f3ba29134917a44233c339eb5eb872c92190bb698.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-2891029575-1462575-1165213807-1000\_RECoVERY_+fmfxa.txt
teslacrypt
http://yyre45dbvn2nhbefbmh.begumvelic.at/BF77228D1B30C7DA
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/BF77228D1B30C7DA
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/BF77228D1B30C7DA
http://xlowfznrg4wf7dli.ONION/BF77228D1B30C7DA
Targets
-
-
Target
7bce43bdf63001d494253e9f3ba29134917a44233c339eb5eb872c92190bb698
-
Size
424KB
-
MD5
42ff22493f094600f2daa6a2984861a3
-
SHA1
f992b95f7330bcd6416df64b24267cf979b7a151
-
SHA256
7bce43bdf63001d494253e9f3ba29134917a44233c339eb5eb872c92190bb698
-
SHA512
49626857c01ac1122c19308d3584eac685c4093063f540fe7974427b602a71e7fd23046d3a281671c17b0425fe4e777747154696e99129dd153c703897345267
-
SSDEEP
12288:iL2WjWgDhrhjxaRaDz7z4HMLzskGWoXblCJxfS6:iDXpVx7f7dLoMorOR1
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-