Extracted

Extracted

• • Target

    dcdc778ea843b2a8adbaf661df9bcf2b_JaffaCakes118

  • Size

    373KB

  • MD5

    dcdc778ea843b2a8adbaf661df9bcf2b

  • SHA1

    f609790c27853d16cd0b4d145a56a6a8f5712f90

  • SHA256

    f09e5f8878752c555825aaf133b735b67f42a83f2034013dd0fee7d679fcea00

  • SHA512

    b3f6440cde12dfd2e414d5cd95dbdfc5c49a1cd84e2f47301bd234d7401ad7a9041bd3207d9e564fa81c610074919eb316723027962b952286e944ab27c5b0c6

  • SSDEEP

    6144:lXxVVly0Av8Q2z6Zz8t5iHcTNNVMoaJHuVPsRJL+BzO0RCaqeI4d/IYqSYA:hyX2I7QSHu2UnCzeBFIYqfA

  Score

  10^/10

  teslacryptdefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer

  • TeslaCrypt, AlphaCrypt

    Ransomware based on CryptoLocker. Shut down by the developers in 2016.

    ransomwareteslacrypt

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (308) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Suspicious use of SetThreadContext

  behavioral1behavioral2