General
-
Target
987b53381225e6a6ceae4ec2f19d51d1beaa00cef55773c92ec31341fd3c8eb9
-
Size
360KB
-
Sample
221023-n3fjnaaba7
-
MD5
dbba8491644acf773a7ade54a01181b0
-
SHA1
60220c18cead8c45b77fc4bc431650e4793a97e6
-
SHA256
987b53381225e6a6ceae4ec2f19d51d1beaa00cef55773c92ec31341fd3c8eb9
-
SHA512
771efbea0cf149bc2448f5f7f4c8c16dfea660ed82035de3a67a090fb39cfe9efeb5f64e1e689bb671fd027a9448bec24e7b3a1f25fd623a5f1a1e2213c79f60
-
SSDEEP
6144:kbxWqS4cQubBuQEFpyPdD6pE7e6iWiSunrany7nZ+f5vSMnb3on:kb4rQ2BuxF7wl4n+y7Z+f5vdon
Static task
static1
Behavioral task
behavioral1
Sample
987b53381225e6a6ceae4ec2f19d51d1beaa00cef55773c92ec31341fd3c8eb9.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
987b53381225e6a6ceae4ec2f19d51d1beaa00cef55773c92ec31341fd3c8eb9.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-2295526160-1155304984-640977766-1000\_ReCoVeRy_+yefej.txt
teslacrypt
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/4C31E6BEDDAF2527
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/4C31E6BEDDAF2527
http://yyre45dbvn2nhbefbmh.begumvelic.at/4C31E6BEDDAF2527
http://xlowfznrg4wf7dli.ONION/4C31E6BEDDAF2527
Targets
-
-
Target
987b53381225e6a6ceae4ec2f19d51d1beaa00cef55773c92ec31341fd3c8eb9
-
Size
360KB
-
MD5
dbba8491644acf773a7ade54a01181b0
-
SHA1
60220c18cead8c45b77fc4bc431650e4793a97e6
-
SHA256
987b53381225e6a6ceae4ec2f19d51d1beaa00cef55773c92ec31341fd3c8eb9
-
SHA512
771efbea0cf149bc2448f5f7f4c8c16dfea660ed82035de3a67a090fb39cfe9efeb5f64e1e689bb671fd027a9448bec24e7b3a1f25fd623a5f1a1e2213c79f60
-
SSDEEP
6144:kbxWqS4cQubBuQEFpyPdD6pE7e6iWiSunrany7nZ+f5vSMnb3on:kb4rQ2BuxF7wl4n+y7Z+f5vdon
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-