General
-
Target
7d50b7c066565f1890c4195364429381a58ccb6f14896f2eb8c20fc9fbc8ded6
-
Size
360KB
-
Sample
221023-fbv62agde8
-
MD5
8db6d3fbe634d9fcf41f15400d1f343c
-
SHA1
bd3b9ca039850d187da1642121362ab743cf4f57
-
SHA256
7d50b7c066565f1890c4195364429381a58ccb6f14896f2eb8c20fc9fbc8ded6
-
SHA512
c671f3d4e95cb8984e185f628e1b47d639473747598037021de420ec2d0cfeafb95e22d3993782a0568e7b7776ef68d7bb02636cfdac296c2c70f4a8ca93630b
-
SSDEEP
6144:NtILdB9ojzO5uGer3GiNRmoVyQEMOrAixeQzuorZ3P:LKOPO5uRlAQ+z5FP
Static task
static1
Behavioral task
behavioral1
Sample
7d50b7c066565f1890c4195364429381a58ccb6f14896f2eb8c20fc9fbc8ded6.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
7d50b7c066565f1890c4195364429381a58ccb6f14896f2eb8c20fc9fbc8ded6.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\_ReCoVeRy_+rntjn.txt
teslacrypt
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/8BD5D26044D4D724
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/8BD5D26044D4D724
http://yyre45dbvn2nhbefbmh.begumvelic.at/8BD5D26044D4D724
http://xlowfznrg4wf7dli.ONION/8BD5D26044D4D724
Targets
-
-
Target
7d50b7c066565f1890c4195364429381a58ccb6f14896f2eb8c20fc9fbc8ded6
-
Size
360KB
-
MD5
8db6d3fbe634d9fcf41f15400d1f343c
-
SHA1
bd3b9ca039850d187da1642121362ab743cf4f57
-
SHA256
7d50b7c066565f1890c4195364429381a58ccb6f14896f2eb8c20fc9fbc8ded6
-
SHA512
c671f3d4e95cb8984e185f628e1b47d639473747598037021de420ec2d0cfeafb95e22d3993782a0568e7b7776ef68d7bb02636cfdac296c2c70f4a8ca93630b
-
SSDEEP
6144:NtILdB9ojzO5uGer3GiNRmoVyQEMOrAixeQzuorZ3P:LKOPO5uRlAQ+z5FP
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-