General
-
Target
015df402953cc0156ee91a59523d940b34940580bf4a5543f4fab9efda300801
-
Size
276KB
-
Sample
220523-yx1mraefc9
-
MD5
19ba3ec94baaf9a4ec735de73dd52c76
-
SHA1
7e8ea32bde1e2b3467db0c9ae1dc2dcb0730bce8
-
SHA256
015df402953cc0156ee91a59523d940b34940580bf4a5543f4fab9efda300801
-
SHA512
828d0bc37dbbe027b9aaa14589f1015311be129e5ed751f317d13e31d740f70a80ea235d1b74e1a54aad623f1598e758fc55776dec86a5848873db4e55c0ab9d
Static task
static1
Behavioral task
behavioral1
Sample
015df402953cc0156ee91a59523d940b34940580bf4a5543f4fab9efda300801.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
015df402953cc0156ee91a59523d940b34940580bf4a5543f4fab9efda300801.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-1819626980-2277161760-1023733287-1000\Recovery+cbxoo.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/5298A9A4ABE8E762
http://tes543berda73i48fsdfsd.keratadze.at/5298A9A4ABE8E762
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/5298A9A4ABE8E762
http://xlowfznrg4wf7dli.ONION/5298A9A4ABE8E762
Targets
-
-
Target
015df402953cc0156ee91a59523d940b34940580bf4a5543f4fab9efda300801
-
Size
276KB
-
MD5
19ba3ec94baaf9a4ec735de73dd52c76
-
SHA1
7e8ea32bde1e2b3467db0c9ae1dc2dcb0730bce8
-
SHA256
015df402953cc0156ee91a59523d940b34940580bf4a5543f4fab9efda300801
-
SHA512
828d0bc37dbbe027b9aaa14589f1015311be129e5ed751f317d13e31d740f70a80ea235d1b74e1a54aad623f1598e758fc55776dec86a5848873db4e55c0ab9d
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Deletes itself
-
Drops startup file
-
Adds Run key to start application
-