General
-
Target
ca04eefe38697f6406b489562fc163d26f08169e18d11bb18dcb75ba713827be
-
Size
428KB
-
Sample
221024-aszmwsded4
-
MD5
bbef617aa4842cc8c85ef7dfc686239c
-
SHA1
e8672962fd43d169f5d375d6afaa01dd70f3b129
-
SHA256
ca04eefe38697f6406b489562fc163d26f08169e18d11bb18dcb75ba713827be
-
SHA512
24353a0d67c2782943861c11b40b8b923f99d0cefbd2ef0770b6b13fc68724a3d49cc93404b7cc5e5bb0904791905c0049d5c8ef8a0a9ef866dd06585775e74f
-
SSDEEP
12288:FGWf3BWLqi/f3xF7PxqViWValazc5ICyPFblCJxfS6:7BSqi/fxWiWVQqJOR1
Static task
static1
Behavioral task
behavioral1
Sample
ca04eefe38697f6406b489562fc163d26f08169e18d11bb18dcb75ba713827be.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ca04eefe38697f6406b489562fc163d26f08169e18d11bb18dcb75ba713827be.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-2891029575-1462575-1165213807-1000\_RECoVERY_+flqxs.txt
teslacrypt
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/C3FE775A84F913D
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/C3FE775A84F913D
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/C3FE775A84F913D
http://xlowfznrg4wf7dli.ONION/C3FE775A84F913D
Targets
-
-
Target
ca04eefe38697f6406b489562fc163d26f08169e18d11bb18dcb75ba713827be
-
Size
428KB
-
MD5
bbef617aa4842cc8c85ef7dfc686239c
-
SHA1
e8672962fd43d169f5d375d6afaa01dd70f3b129
-
SHA256
ca04eefe38697f6406b489562fc163d26f08169e18d11bb18dcb75ba713827be
-
SHA512
24353a0d67c2782943861c11b40b8b923f99d0cefbd2ef0770b6b13fc68724a3d49cc93404b7cc5e5bb0904791905c0049d5c8ef8a0a9ef866dd06585775e74f
-
SSDEEP
12288:FGWf3BWLqi/f3xF7PxqViWValazc5ICyPFblCJxfS6:7BSqi/fxWiWVQqJOR1
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-