General
-
Target
ea5d8e3d92e5002b075f573e43fef7ff356ab1bfb7e6e638d0f39fa318a0dc2e
-
Size
424KB
-
Sample
221024-kfrrmaffek
-
MD5
3c34bab015acf45fa967c6791c7d3008
-
SHA1
809cae36f97ec02da41be75e94d09ff109bd7702
-
SHA256
ea5d8e3d92e5002b075f573e43fef7ff356ab1bfb7e6e638d0f39fa318a0dc2e
-
SHA512
107ecba2cc00bac27b0be70433ce31e65f2be13a24f465ffcf697782e12108fc3797dd6bf15c474ebcf24ba3484da8f578080f8f26c196949ed44387c2a47a18
-
SSDEEP
6144:GVA8n+saFT1r1Xu0MUHbhgD1fbVaQaYBK58vgVz8G8xypctxTmroXbftChXW3Ax4:GXJa71e01hqf8y46GYicnblCJxfS6
Static task
static1
Behavioral task
behavioral1
Sample
ea5d8e3d92e5002b075f573e43fef7ff356ab1bfb7e6e638d0f39fa318a0dc2e.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
ea5d8e3d92e5002b075f573e43fef7ff356ab1bfb7e6e638d0f39fa318a0dc2e.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-2891029575-1462575-1165213807-1000\_RECoVERY_+sbqkl.txt
teslacrypt
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/8B158BF975474E6
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/8B158BF975474E6
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/8B158BF975474E6
http://xlowfznrg4wf7dli.ONION/8B158BF975474E6
Targets
-
-
Target
ea5d8e3d92e5002b075f573e43fef7ff356ab1bfb7e6e638d0f39fa318a0dc2e
-
Size
424KB
-
MD5
3c34bab015acf45fa967c6791c7d3008
-
SHA1
809cae36f97ec02da41be75e94d09ff109bd7702
-
SHA256
ea5d8e3d92e5002b075f573e43fef7ff356ab1bfb7e6e638d0f39fa318a0dc2e
-
SHA512
107ecba2cc00bac27b0be70433ce31e65f2be13a24f465ffcf697782e12108fc3797dd6bf15c474ebcf24ba3484da8f578080f8f26c196949ed44387c2a47a18
-
SSDEEP
6144:GVA8n+saFT1r1Xu0MUHbhgD1fbVaQaYBK58vgVz8G8xypctxTmroXbftChXW3Ax4:GXJa71e01hqf8y46GYicnblCJxfS6
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-