General
-
Target
af4fa6e25172a4b6afb6600e1870848a45ea40e39c9954d22c78aa16001b2cff
-
Size
424KB
-
Sample
221023-wdtnzsbfdq
-
MD5
90a30dfa5221fb4209aa56666e689cbf
-
SHA1
7cdf5848ea7c7292696d6bae10f13efc80bd3606
-
SHA256
af4fa6e25172a4b6afb6600e1870848a45ea40e39c9954d22c78aa16001b2cff
-
SHA512
6dc85c74e3261e7ec7d3c96de80452d1ecf097e1cc7f89ae8cbf42bf5e6b850129d306415d8817d18e23c2207920eb29e7fd5d28abe59d5dfde6ef4cc7313e51
-
SSDEEP
12288:2y8abnEX/hUUn3Q7DTw+ZA3StJSvblCJxfS6:J5DEX/hnSwYACTOOR1
Static task
static1
Behavioral task
behavioral1
Sample
af4fa6e25172a4b6afb6600e1870848a45ea40e39c9954d22c78aa16001b2cff.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
af4fa6e25172a4b6afb6600e1870848a45ea40e39c9954d22c78aa16001b2cff.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-2629973501-4017243118-3254762364-1000\_RECoVERY_+ukmrk.txt
teslacrypt
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/3AC62A577FF2DAD
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/3AC62A577FF2DAD
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/3AC62A577FF2DAD
http://xlowfznrg4wf7dli.ONION/3AC62A577FF2DAD
Targets
-
-
Target
af4fa6e25172a4b6afb6600e1870848a45ea40e39c9954d22c78aa16001b2cff
-
Size
424KB
-
MD5
90a30dfa5221fb4209aa56666e689cbf
-
SHA1
7cdf5848ea7c7292696d6bae10f13efc80bd3606
-
SHA256
af4fa6e25172a4b6afb6600e1870848a45ea40e39c9954d22c78aa16001b2cff
-
SHA512
6dc85c74e3261e7ec7d3c96de80452d1ecf097e1cc7f89ae8cbf42bf5e6b850129d306415d8817d18e23c2207920eb29e7fd5d28abe59d5dfde6ef4cc7313e51
-
SSDEEP
12288:2y8abnEX/hUUn3Q7DTw+ZA3StJSvblCJxfS6:J5DEX/hnSwYACTOOR1
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-