General
-
Target
2c989ac225ef0e4d1564d1ff5784b79adcaec1df9bd3d9a86c058f1735e6f6fb
-
Size
370KB
-
Sample
220614-18btwabgc4
-
MD5
5b87bfc28ec2960f912670034c28d262
-
SHA1
6e11bd777be114505baa13e357ec12261e4f31f3
-
SHA256
2c989ac225ef0e4d1564d1ff5784b79adcaec1df9bd3d9a86c058f1735e6f6fb
-
SHA512
9d2a06afbac4dbedb27c8ce9c8249560d593d55e0b1ebd19e7c41d6489f827e79e149984c154b334c4f0b206b5b6ade804e37dc5b0bb155425d1cae98024c882
Static task
static1
Behavioral task
behavioral1
Sample
2c989ac225ef0e4d1564d1ff5784b79adcaec1df9bd3d9a86c058f1735e6f6fb.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
2c989ac225ef0e4d1564d1ff5784b79adcaec1df9bd3d9a86c058f1735e6f6fb.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-1083475884-596052423-1669053738-1000\_RECoVERY_+crxdb.txt
teslacrypt
http://yyre45dbvn2nhbefbmh.begumvelic.at/AC712B6990594B59
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/AC712B6990594B59
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/AC712B6990594B59
http://xlowfznrg4wf7dli.ONION/AC712B6990594B59
Targets
-
-
Target
2c989ac225ef0e4d1564d1ff5784b79adcaec1df9bd3d9a86c058f1735e6f6fb
-
Size
370KB
-
MD5
5b87bfc28ec2960f912670034c28d262
-
SHA1
6e11bd777be114505baa13e357ec12261e4f31f3
-
SHA256
2c989ac225ef0e4d1564d1ff5784b79adcaec1df9bd3d9a86c058f1735e6f6fb
-
SHA512
9d2a06afbac4dbedb27c8ce9c8249560d593d55e0b1ebd19e7c41d6489f827e79e149984c154b334c4f0b206b5b6ade804e37dc5b0bb155425d1cae98024c882
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
-
Executes dropped EXE
-
Deletes itself
-
Adds Run key to start application
-