General
-
Target
7ffc71cf20cf0e0e4985b41663d03d4c12537a1d751b1d4c06cfb63ca6e61dde
-
Size
424KB
-
Sample
221023-gjcv4aggfm
-
MD5
7d5a9f62895e77a67c910788d841e997
-
SHA1
666e0ca8ad9a45b61890ccd7fd99c84a57fc7dd6
-
SHA256
7ffc71cf20cf0e0e4985b41663d03d4c12537a1d751b1d4c06cfb63ca6e61dde
-
SHA512
274bf9344b8f51fa8fc4c75360811b8fe6dbb8c01e118a58efbabcc2fe57edab309aa41b58894d00900565be871ff59db9da320fbf4b5551f55762401b0d9e53
-
SSDEEP
12288:mmM+X6gSTFp6q5ePiWkO1AeV5WhtblCJxfS6:FMq6gSTLj5f5O5u5OR1
Static task
static1
Behavioral task
behavioral1
Sample
7ffc71cf20cf0e0e4985b41663d03d4c12537a1d751b1d4c06cfb63ca6e61dde.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
7ffc71cf20cf0e0e4985b41663d03d4c12537a1d751b1d4c06cfb63ca6e61dde.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-2295526160-1155304984-640977766-1000\_RECoVERY_+ejngr.txt
teslacrypt
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/4B3DA31B3389251
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/4B3DA31B3389251
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/4B3DA31B3389251
http://xlowfznrg4wf7dli.ONION/4B3DA31B3389251
Targets
-
-
Target
7ffc71cf20cf0e0e4985b41663d03d4c12537a1d751b1d4c06cfb63ca6e61dde
-
Size
424KB
-
MD5
7d5a9f62895e77a67c910788d841e997
-
SHA1
666e0ca8ad9a45b61890ccd7fd99c84a57fc7dd6
-
SHA256
7ffc71cf20cf0e0e4985b41663d03d4c12537a1d751b1d4c06cfb63ca6e61dde
-
SHA512
274bf9344b8f51fa8fc4c75360811b8fe6dbb8c01e118a58efbabcc2fe57edab309aa41b58894d00900565be871ff59db9da320fbf4b5551f55762401b0d9e53
-
SSDEEP
12288:mmM+X6gSTFp6q5ePiWkO1AeV5WhtblCJxfS6:FMq6gSTLj5f5O5u5OR1
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-