General
-
Target
a4e2cd01d98d9ae848f2ff4a03f64978961c6ad62413698fd48613dacf557dea
-
Size
424KB
-
Sample
221023-se9vtabaaj
-
MD5
416f169b4d316eb3f52682ceba73cbdb
-
SHA1
164f6ddfa7be987bb116269c22a30f26989e9721
-
SHA256
a4e2cd01d98d9ae848f2ff4a03f64978961c6ad62413698fd48613dacf557dea
-
SHA512
054c5e151d97d60cda1e9ee88d1eb275f3f30302ad0f171e404b48f233e551f83afc27995ac2e1ef6eed6c87fb91ccf1de8889401b2327189b859609a43f6577
-
SSDEEP
12288:WmM+X6gSTFp6q5ePiWkO1AeV5WhtblCJxfS6:1Mq6gSTLj5f5O5u5OR1
Static task
static1
Behavioral task
behavioral1
Sample
a4e2cd01d98d9ae848f2ff4a03f64978961c6ad62413698fd48613dacf557dea.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
a4e2cd01d98d9ae848f2ff4a03f64978961c6ad62413698fd48613dacf557dea.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-2891029575-1462575-1165213807-1000\_RECoVERY_+iusqm.txt
teslacrypt
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/9CF19938F6FC31
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/9CF19938F6FC31
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/9CF19938F6FC31
http://xlowfznrg4wf7dli.ONION/9CF19938F6FC31
Targets
-
-
Target
a4e2cd01d98d9ae848f2ff4a03f64978961c6ad62413698fd48613dacf557dea
-
Size
424KB
-
MD5
416f169b4d316eb3f52682ceba73cbdb
-
SHA1
164f6ddfa7be987bb116269c22a30f26989e9721
-
SHA256
a4e2cd01d98d9ae848f2ff4a03f64978961c6ad62413698fd48613dacf557dea
-
SHA512
054c5e151d97d60cda1e9ee88d1eb275f3f30302ad0f171e404b48f233e551f83afc27995ac2e1ef6eed6c87fb91ccf1de8889401b2327189b859609a43f6577
-
SSDEEP
12288:WmM+X6gSTFp6q5ePiWkO1AeV5WhtblCJxfS6:1Mq6gSTLj5f5O5u5OR1
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-