General
-
Target
885bd1f7da66a6fd57131d75c7074836565fddcc6c9fedf6f7bb71a4544d4906
-
Size
424KB
-
Sample
221023-jnb6gahcdj
-
MD5
823ece0c42f0a1527a81efe1cff9591a
-
SHA1
dc0fc3de6b66447a632d1055fe58d59e2f3c0099
-
SHA256
885bd1f7da66a6fd57131d75c7074836565fddcc6c9fedf6f7bb71a4544d4906
-
SHA512
c651c4641f9edc780b9eee94342eeafb0d074cbe3a196660c9c55e7ba54c653dfe6e9112e329ff6d1361cd43939725ae5d0b708042d28e51c1c99151af45a360
-
SSDEEP
6144:BJOrslDNrfqw5W9RtPLal1tBzAF2Rg/zUZjpMWMl4ZC824UzHoXbftChXW3AxfuJ:BJOrSNr4S77zAJzUZ1azKblCJxfS6
Static task
static1
Behavioral task
behavioral1
Sample
885bd1f7da66a6fd57131d75c7074836565fddcc6c9fedf6f7bb71a4544d4906.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
885bd1f7da66a6fd57131d75c7074836565fddcc6c9fedf6f7bb71a4544d4906.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\_RECoVERY_+ytcth.txt
teslacrypt
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/445EF8D5A976D5C
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/445EF8D5A976D5C
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/445EF8D5A976D5C
http://xlowfznrg4wf7dli.ONION/445EF8D5A976D5C
Targets
-
-
Target
885bd1f7da66a6fd57131d75c7074836565fddcc6c9fedf6f7bb71a4544d4906
-
Size
424KB
-
MD5
823ece0c42f0a1527a81efe1cff9591a
-
SHA1
dc0fc3de6b66447a632d1055fe58d59e2f3c0099
-
SHA256
885bd1f7da66a6fd57131d75c7074836565fddcc6c9fedf6f7bb71a4544d4906
-
SHA512
c651c4641f9edc780b9eee94342eeafb0d074cbe3a196660c9c55e7ba54c653dfe6e9112e329ff6d1361cd43939725ae5d0b708042d28e51c1c99151af45a360
-
SSDEEP
6144:BJOrslDNrfqw5W9RtPLal1tBzAF2Rg/zUZjpMWMl4ZC824UzHoXbftChXW3AxfuJ:BJOrSNr4S77zAJzUZ1azKblCJxfS6
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-