General
-
Target
b1f38ef79742e99617096f5f5e223972c805a6006af4e29e9ae8bdee6b1a33c5
-
Size
424KB
-
Sample
221023-w2nsmsbga4
-
MD5
7ff229955a92a6ad6937118bcd9c1295
-
SHA1
575d2346161618cde9a2ce04ea3ad762ed01fc64
-
SHA256
b1f38ef79742e99617096f5f5e223972c805a6006af4e29e9ae8bdee6b1a33c5
-
SHA512
e8ebd4a5f572ea6e20b3167cb690c5c207f7ee46d29aff5b05eb6e6baaf5ae2424fb1d73ab55f2b029b368ed9a77b3d6e0f330bf4ee57658f521522ee5e489a4
-
SSDEEP
6144:NWmfUHQSVs1ZYi9Cz3cnPOqURF7T16kCQ4B1oyjqnVhyfVoXbftChXW3AxfulDGq:0mfUHQS0GiGc6R6kXP/nVAcblCJxfS6
Static task
static1
Behavioral task
behavioral1
Sample
b1f38ef79742e99617096f5f5e223972c805a6006af4e29e9ae8bdee6b1a33c5.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b1f38ef79742e99617096f5f5e223972c805a6006af4e29e9ae8bdee6b1a33c5.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-2629973501-4017243118-3254762364-1000\_RECoVERY_+bmhll.txt
teslacrypt
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/6A3A8C95A1C362
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/6A3A8C95A1C362
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/6A3A8C95A1C362
http://xlowfznrg4wf7dli.ONION/6A3A8C95A1C362
Targets
-
-
Target
b1f38ef79742e99617096f5f5e223972c805a6006af4e29e9ae8bdee6b1a33c5
-
Size
424KB
-
MD5
7ff229955a92a6ad6937118bcd9c1295
-
SHA1
575d2346161618cde9a2ce04ea3ad762ed01fc64
-
SHA256
b1f38ef79742e99617096f5f5e223972c805a6006af4e29e9ae8bdee6b1a33c5
-
SHA512
e8ebd4a5f572ea6e20b3167cb690c5c207f7ee46d29aff5b05eb6e6baaf5ae2424fb1d73ab55f2b029b368ed9a77b3d6e0f330bf4ee57658f521522ee5e489a4
-
SSDEEP
6144:NWmfUHQSVs1ZYi9Cz3cnPOqURF7T16kCQ4B1oyjqnVhyfVoXbftChXW3AxfulDGq:0mfUHQS0GiGc6R6kXP/nVAcblCJxfS6
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-