General
-
Target
8ccb96147d6198c9166b9619bfdc67b6f8a8e71318015e3679c6d5b9706f99a7
-
Size
404KB
-
Sample
221023-kvtjrshdd3
-
MD5
eabd3a0897cd161d8ba35caea23d0556
-
SHA1
45216a4e48ef209fa244ec2425486db671d55530
-
SHA256
8ccb96147d6198c9166b9619bfdc67b6f8a8e71318015e3679c6d5b9706f99a7
-
SHA512
40e614c115727609b9ffc5b7ab9ec0c9f4b7162814aded05a3d817510d588ffbe58df419d493f57897df24fe4028ae2d651c21f9be25522badef1770dcbeff51
-
SSDEEP
6144:KhgE/69rEIaB8sa1h5kPxnrHBdoeevcQ91R1pQcy4p/FFf2qecRJA6mJOl:wgwGDLsaJkpnroeevca1jNtFFHRJoOl
Static task
static1
Behavioral task
behavioral1
Sample
8ccb96147d6198c9166b9619bfdc67b6f8a8e71318015e3679c6d5b9706f99a7.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8ccb96147d6198c9166b9619bfdc67b6f8a8e71318015e3679c6d5b9706f99a7.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-2629973501-4017243118-3254762364-1000\_RECoVERY_+mumww.txt
teslacrypt
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/47234799E3A39C7F
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/47234799E3A39C7F
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/47234799E3A39C7F
http://xlowfznrg4wf7dli.ONION/47234799E3A39C7F
Targets
-
-
Target
8ccb96147d6198c9166b9619bfdc67b6f8a8e71318015e3679c6d5b9706f99a7
-
Size
404KB
-
MD5
eabd3a0897cd161d8ba35caea23d0556
-
SHA1
45216a4e48ef209fa244ec2425486db671d55530
-
SHA256
8ccb96147d6198c9166b9619bfdc67b6f8a8e71318015e3679c6d5b9706f99a7
-
SHA512
40e614c115727609b9ffc5b7ab9ec0c9f4b7162814aded05a3d817510d588ffbe58df419d493f57897df24fe4028ae2d651c21f9be25522badef1770dcbeff51
-
SSDEEP
6144:KhgE/69rEIaB8sa1h5kPxnrHBdoeevcQ91R1pQcy4p/FFf2qecRJA6mJOl:wgwGDLsaJkpnroeevca1jNtFFHRJoOl
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-