General
-
Target
8f236eac10488a8498785458219778998a29433fd1a2ff0b98ccbb9d7cc9ed0d
-
Size
424KB
-
Sample
221023-lel1eshed4
-
MD5
e384658bd4a76b34bc458f25c064a99c
-
SHA1
89b61393358caee1c2b834b8947d5fa1145df352
-
SHA256
8f236eac10488a8498785458219778998a29433fd1a2ff0b98ccbb9d7cc9ed0d
-
SHA512
0191c95252a83c477b43ded6484ff7aed2fa86fa95b2c6065abfe22e1312ce85e4bde7afe7704f913bf5290b7eda9e104987f91d1373a1272776aa196b02556d
-
SSDEEP
12288:Q8DHMRGy57LfvdOkoy3ATY5r4TblCJxfS6:Q8IT9FOGrwOR1
Static task
static1
Behavioral task
behavioral1
Sample
8f236eac10488a8498785458219778998a29433fd1a2ff0b98ccbb9d7cc9ed0d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8f236eac10488a8498785458219778998a29433fd1a2ff0b98ccbb9d7cc9ed0d.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-2629973501-4017243118-3254762364-1000\_RECoVERY_+itesm.txt
teslacrypt
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/D23D207936A2D7E6
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/D23D207936A2D7E6
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/D23D207936A2D7E6
http://xlowfznrg4wf7dli.ONION/D23D207936A2D7E6
Targets
-
-
Target
8f236eac10488a8498785458219778998a29433fd1a2ff0b98ccbb9d7cc9ed0d
-
Size
424KB
-
MD5
e384658bd4a76b34bc458f25c064a99c
-
SHA1
89b61393358caee1c2b834b8947d5fa1145df352
-
SHA256
8f236eac10488a8498785458219778998a29433fd1a2ff0b98ccbb9d7cc9ed0d
-
SHA512
0191c95252a83c477b43ded6484ff7aed2fa86fa95b2c6065abfe22e1312ce85e4bde7afe7704f913bf5290b7eda9e104987f91d1373a1272776aa196b02556d
-
SSDEEP
12288:Q8DHMRGy57LfvdOkoy3ATY5r4TblCJxfS6:Q8IT9FOGrwOR1
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-