General
-
Target
bc411cd472d250a249ab09422632950b8f69efdff9cc316cd223a7e41df5cb35
-
Size
424KB
-
Sample
221023-zxyc3acfhr
-
MD5
5bf4fb0a44f3a28b8075d38d0a5434ea
-
SHA1
32b731cf212bc10d5b92d4ecf8729b0f14d40d30
-
SHA256
bc411cd472d250a249ab09422632950b8f69efdff9cc316cd223a7e41df5cb35
-
SHA512
ca1afc74968099d291db42dc18dc433204f4808cdfba66de8f5e838c547e12bd196047e8eee364772cdfeeb769525a30cb7e68f95fb4e9664b105aa54a45b167
-
SSDEEP
6144:WlgxzBDqFbm4BwEaOufP6WJbWruNHTIwoMjJUZs6Cxa+OkkhdAq99oXbftChXW3d:GAVUnICWJK6lTwhsRoMq9MblCJxfS6
Static task
static1
Behavioral task
behavioral1
Sample
bc411cd472d250a249ab09422632950b8f69efdff9cc316cd223a7e41df5cb35.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
bc411cd472d250a249ab09422632950b8f69efdff9cc316cd223a7e41df5cb35.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-2295526160-1155304984-640977766-1000\_RECoVERY_+nlweq.txt
teslacrypt
http://yyre45dbvn2nhbefbmh.begumvelic.at/1548C5BB600E168
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/1548C5BB600E168
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/1548C5BB600E168
http://xlowfznrg4wf7dli.ONION/1548C5BB600E168
Targets
-
-
Target
bc411cd472d250a249ab09422632950b8f69efdff9cc316cd223a7e41df5cb35
-
Size
424KB
-
MD5
5bf4fb0a44f3a28b8075d38d0a5434ea
-
SHA1
32b731cf212bc10d5b92d4ecf8729b0f14d40d30
-
SHA256
bc411cd472d250a249ab09422632950b8f69efdff9cc316cd223a7e41df5cb35
-
SHA512
ca1afc74968099d291db42dc18dc433204f4808cdfba66de8f5e838c547e12bd196047e8eee364772cdfeeb769525a30cb7e68f95fb4e9664b105aa54a45b167
-
SSDEEP
6144:WlgxzBDqFbm4BwEaOufP6WJbWruNHTIwoMjJUZs6Cxa+OkkhdAq99oXbftChXW3d:GAVUnICWJK6lTwhsRoMq9MblCJxfS6
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-