3b246faa7e4b2a8550aa619f4da893db83721aacf62b46e5863644a5249aa87e

General

Target
Ransomware.TeslaCrypt.zip
Size 479KB
Sample260803-rdcm9aaf58
SHA256 3b246faa7e4b2a8550aa619f4da893db83721aacf62b46e5863644a5249aa87e
MD5 f755a44bbb97e9ba70bf38f1bdc67722
SHA1 f70331eb64fd893047f263623ffb1e74e6fe4187
SHA512 f8ce666ae273e6c5cd57447189a8cf0e53c7704cf269fa120068f21e6faf6c89e2e75f37aee43cac83f4534790c5c6f1827621684034ef3eb7e94d7ee1ac365e
SSDEEP 6144:xQAq0svy/pQhk1NBePvxGNWeOyqYAGfr/H/h60BHtzbprAvNGTG/fi5QCIq3h11Z:LyKoUlWeOP8HXrINZ/2uJUgVu
TLSH
T1EFA4233DB4A231B8A9F131B479DC1E44C93596C9B73895AC0B390EED55FAA31F00A793
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  3372c1edab46837f1e973164fa2d726c5c5e17bcb888828ccd7c4dfcc234a370
- Size 284KB
- SHA256 3372c1edab46837f1e973164fa2d726c5c5e17bcb888828ccd7c4dfcc234a370
- MD5 209a288c68207d57e0ce6e60ebf60729
- SHA1 e654d39cd13414b5151e8cf0d8f5b166dddd45cb
- SHA512 ce4a7e42738154183fc53702f0841dfd4ad1eb0567b13cc1ff0909f1d330e9cd2fb994375efc6f02e7eddaaae1f465ff93458412143266afdaff1c6bf6477fc3
- SSDEEP 3072:rYXT8PUsMNL8V4tD2My/JAAbQoM29wlV58lbNnolY7VgsYiVTPtiTu/q:rowUsML8g2j0o9wb0bNoaKsYImui
- TLSH
  T1C3549D02B7EBC0F3E86744744666D3BB467E2D432739D2C7AB503E1AEA311D26638716
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery persistence ransomware
- Renames multiple (3451) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
behavioral1
- Target
  51B4EF5DC9D26B7A26E214CEE90598631E2EAA67
- Size 257KB
- SHA256 9b462800f1bef019d7ec00098682d3ea7fc60e6721555f616399228e4e3ad122
- MD5 6e080aa085293bb9fbdcc9015337d309
- SHA1 51b4ef5dc9d26b7a26e214cee90598631e2eaa67
- SHA512 4e173fb5287c7ea8ff116099ec1a0599b37f743f8b798368319b5960af38e742124223dfd209457665b701e9efc6e76071fa2513322b232ac50ddad21fcebe77
- SSDEEP 6144:xy+als+0nIycigV5cbEo6dZbBODPIsjQ/UFsYW:xy+aCFnIycigVSbObBODTMUd
- TLSH
  T1FB44C01BB64394F4C1E78A744F9FE3B95526EE9B8430E576AEE93E177833291248C031
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  E906FA3D51E86A61741B3499145A114E9BFB7C56
- Size 261KB
- SHA256 afaba2400552c7032a5c4c6e6151df374d0e98dc67204066281e30e6699dbd18
- MD5 6d3d62a4cff19b4f2cc7ce9027c33be8
- SHA1 e906fa3d51e86a61741b3499145a114e9bfb7c56
- SHA512 973643639cb02491b86d5b264ee8118a67d8a83453307aea95de2f4c6aa55819d37730c41dc3338116ebe86f9a4f2bba7d9537ea744ae08b9755f05c15153fad
- SSDEEP 6144:93g0BQG+aZiycigV5bbEo6dZbBODPIsjQ/UFsYWo:93g0OGjZiycigVRbObBODTMUdj
- TLSH
  T1AB44C01EB64394F4C2EB8B744B5FF3B91511ED9A8470E97AAEE93E577833691208C031
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3