General
-
Target
7e9dc695fa671680871d62dd8521b4833fcbfc00a4e5da792083b38c7870d7cd
-
Size
424KB
-
Sample
221023-f5qhmsgeg5
-
MD5
7c40b634eede572b07ff7a01b58241e3
-
SHA1
4100efcc1336945fad2de3dac21faa7056b1ba4c
-
SHA256
7e9dc695fa671680871d62dd8521b4833fcbfc00a4e5da792083b38c7870d7cd
-
SHA512
0b04c3e70b67cb6c5c2e3dcdc3c47efd1bfbbb8f12411577b6217cceb7359307485257ce017456865f12886018888904316aa51c2fe2c0451dc4b93dda046d3a
-
SSDEEP
12288:EmM+X6gSTFp6q5ePiWkO1AeV5WhtblCJxfS6:zMq6gSTLj5f5O5u5OR1
Static task
static1
Behavioral task
behavioral1
Sample
7e9dc695fa671680871d62dd8521b4833fcbfc00a4e5da792083b38c7870d7cd.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
7e9dc695fa671680871d62dd8521b4833fcbfc00a4e5da792083b38c7870d7cd.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-2295526160-1155304984-640977766-1000\_RECoVERY_+wvedb.txt
teslacrypt
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/DF9513C188DF97B3
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/DF9513C188DF97B3
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/DF9513C188DF97B3
http://xlowfznrg4wf7dli.ONION/DF9513C188DF97B3
Targets
-
-
Target
7e9dc695fa671680871d62dd8521b4833fcbfc00a4e5da792083b38c7870d7cd
-
Size
424KB
-
MD5
7c40b634eede572b07ff7a01b58241e3
-
SHA1
4100efcc1336945fad2de3dac21faa7056b1ba4c
-
SHA256
7e9dc695fa671680871d62dd8521b4833fcbfc00a4e5da792083b38c7870d7cd
-
SHA512
0b04c3e70b67cb6c5c2e3dcdc3c47efd1bfbbb8f12411577b6217cceb7359307485257ce017456865f12886018888904316aa51c2fe2c0451dc4b93dda046d3a
-
SSDEEP
12288:EmM+X6gSTFp6q5ePiWkO1AeV5WhtblCJxfS6:zMq6gSTLj5f5O5u5OR1
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-