General
-
Target
cbb69a74a9f8ec04cb71f5857eb55b6ed399dbf92ed6ed2de0738c3b5f9a2b43
-
Size
424KB
-
Sample
221024-ftcseaeef7
-
MD5
bc5293fc4535b15ad670c8a58d9d2560
-
SHA1
4ec663d224d029b3fba0ae701522439c26395c87
-
SHA256
cbb69a74a9f8ec04cb71f5857eb55b6ed399dbf92ed6ed2de0738c3b5f9a2b43
-
SHA512
a0ff20a077fc6f8fcff1c3321acf8ff954896764bd71923065a93a197c715d9fd044958434a026d3461fcf273f3fc69523ddb985b70033c780a1eae4e492c707
-
SSDEEP
12288:amM+X6gSTFp6q5ePiWkO1AeV5WhtblCJxfS6:5Mq6gSTLj5f5O5u5OR1
Static task
static1
Behavioral task
behavioral1
Sample
cbb69a74a9f8ec04cb71f5857eb55b6ed399dbf92ed6ed2de0738c3b5f9a2b43.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cbb69a74a9f8ec04cb71f5857eb55b6ed399dbf92ed6ed2de0738c3b5f9a2b43.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-2629973501-4017243118-3254762364-1000\_RECoVERY_+ipcup.txt
teslacrypt
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/D7F3113805C70F0
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/D7F3113805C70F0
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/D7F3113805C70F0
http://xlowfznrg4wf7dli.ONION/D7F3113805C70F0
Targets
-
-
Target
cbb69a74a9f8ec04cb71f5857eb55b6ed399dbf92ed6ed2de0738c3b5f9a2b43
-
Size
424KB
-
MD5
bc5293fc4535b15ad670c8a58d9d2560
-
SHA1
4ec663d224d029b3fba0ae701522439c26395c87
-
SHA256
cbb69a74a9f8ec04cb71f5857eb55b6ed399dbf92ed6ed2de0738c3b5f9a2b43
-
SHA512
a0ff20a077fc6f8fcff1c3321acf8ff954896764bd71923065a93a197c715d9fd044958434a026d3461fcf273f3fc69523ddb985b70033c780a1eae4e492c707
-
SSDEEP
12288:amM+X6gSTFp6q5ePiWkO1AeV5WhtblCJxfS6:5Mq6gSTLj5f5O5u5OR1
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-