General
-
Target
959e00c0c76312f723b4a88fcf8862adfbcb9fa7e1a6cae713a0d5c2a54d68f9
-
Size
424KB
-
Sample
221023-m8jmtshhf3
-
MD5
f5e9a3d66d35d6c1c6f2b8c99614c8f0
-
SHA1
fadaa7d740e8e0564e93ba5cfe7183bf8e145c3f
-
SHA256
959e00c0c76312f723b4a88fcf8862adfbcb9fa7e1a6cae713a0d5c2a54d68f9
-
SHA512
eab27f6961fa582bf5a188fe0746f27adf3b01655a72f5af514181db2c9669a732e76cbd400f05b5b59dd026f22f7a56c8198316fb4223bbf0b8eda5c2cdc731
-
SSDEEP
12288:bmJqaEwQLysD/XDz3qzRdW1DzHpblCJxfS6:bgMLyWDbkElOR1
Static task
static1
Behavioral task
behavioral1
Sample
959e00c0c76312f723b4a88fcf8862adfbcb9fa7e1a6cae713a0d5c2a54d68f9.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
959e00c0c76312f723b4a88fcf8862adfbcb9fa7e1a6cae713a0d5c2a54d68f9.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-2295526160-1155304984-640977766-1000\_RECoVERY_+oxraf.txt
teslacrypt
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/1AD3B6EA4C99F69A
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/1AD3B6EA4C99F69A
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/1AD3B6EA4C99F69A
http://xlowfznrg4wf7dli.ONION/1AD3B6EA4C99F69A
Targets
-
-
Target
959e00c0c76312f723b4a88fcf8862adfbcb9fa7e1a6cae713a0d5c2a54d68f9
-
Size
424KB
-
MD5
f5e9a3d66d35d6c1c6f2b8c99614c8f0
-
SHA1
fadaa7d740e8e0564e93ba5cfe7183bf8e145c3f
-
SHA256
959e00c0c76312f723b4a88fcf8862adfbcb9fa7e1a6cae713a0d5c2a54d68f9
-
SHA512
eab27f6961fa582bf5a188fe0746f27adf3b01655a72f5af514181db2c9669a732e76cbd400f05b5b59dd026f22f7a56c8198316fb4223bbf0b8eda5c2cdc731
-
SSDEEP
12288:bmJqaEwQLysD/XDz3qzRdW1DzHpblCJxfS6:bgMLyWDbkElOR1
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-