teslacrypt | 2a6c227ceff0945758512a6accce28c415b753d661f93336b149d99d3a15a08f

General

Target

2a6c227ceff0945758512a6accce28c415b753d661f93336b149d99d3a15a08f
Size

392KB
Sample

220615-gcbz8abed6
MD5

160885e1ebd0a3c3224d5e6bfccb75a4
SHA1

eb164a66286b60967bc0995de839f754d7b67a73
SHA256

2a6c227ceff0945758512a6accce28c415b753d661f93336b149d99d3a15a08f
SHA512

7a157198332a59956cba3835783d435d5cdfb4751462d0a1d6c5e87d8b774005746658ab56da6ca3eaa7d1b481844c871188977a13f44ede64a2c845d15572bf

Score

10^/10

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-1083475884-596052423-1669053738-1000\Recovery+xevqx.txt

Family

teslacrypt

Ransom Note

NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA-4096. More information about the encryption keys using RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA-4096 KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/2729A6B6D1E7B2B7 2. http://kkd47eh4hdjshb5t.angortra.at/2729A6B6D1E7B2B7 3. http://ytrest84y5i456hghadefdsd.pontogrot.com/2729A6B6D1E7B2B7 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/2729A6B6D1E7B2B7 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://tt54rfdjhb34rfbnknaerg.milerteddy.com/2729A6B6D1E7B2B7 http://kkd47eh4hdjshb5t.angortra.at/2729A6B6D1E7B2B7 http://ytrest84y5i456hghadefdsd.pontogrot.com/2729A6B6D1E7B2B7 *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/2729A6B6D1E7B2B7

URLs

http://tt54rfdjhb34rfbnknaerg.milerteddy.com/2729A6B6D1E7B2B7

http://kkd47eh4hdjshb5t.angortra.at/2729A6B6D1E7B2B7

http://ytrest84y5i456hghadefdsd.pontogrot.com/2729A6B6D1E7B2B7

http://xlowfznrg4wf7dli.ONION/2729A6B6D1E7B2B7

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-1081944012-3634099177-1681222835-1000\Recovery+wiguy.txt

Family

teslacrypt

Ransom Note

NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA-4096. More information about the encryption keys using RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA-4096 KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/17C5482BBDD286EA 2. http://kkd47eh4hdjshb5t.angortra.at/17C5482BBDD286EA 3. http://ytrest84y5i456hghadefdsd.pontogrot.com/17C5482BBDD286EA If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/17C5482BBDD286EA 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://tt54rfdjhb34rfbnknaerg.milerteddy.com/17C5482BBDD286EA http://kkd47eh4hdjshb5t.angortra.at/17C5482BBDD286EA http://ytrest84y5i456hghadefdsd.pontogrot.com/17C5482BBDD286EA *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/17C5482BBDD286EA

URLs

http://tt54rfdjhb34rfbnknaerg.milerteddy.com/17C5482BBDD286EA

http://kkd47eh4hdjshb5t.angortra.at/17C5482BBDD286EA

http://ytrest84y5i456hghadefdsd.pontogrot.com/17C5482BBDD286EA

http://xlowfznrg4wf7dli.ONION/17C5482BBDD286EA

Targets

- Target
  
  2a6c227ceff0945758512a6accce28c415b753d661f93336b149d99d3a15a08f
- Size
  
  392KB
- MD5
  
  160885e1ebd0a3c3224d5e6bfccb75a4
- SHA1
  
  eb164a66286b60967bc0995de839f754d7b67a73
- SHA256
  
  2a6c227ceff0945758512a6accce28c415b753d661f93336b149d99d3a15a08f
- SHA512
  
  7a157198332a59956cba3835783d435d5cdfb4751462d0a1d6c5e87d8b774005746658ab56da6ca3eaa7d1b481844c871188977a13f44ede64a2c845d15572bf
Score

10^/10

teslacrypt persistence ransomware suricata
- TeslaCrypt, AlphaCrypt
  Ransomware based on CryptoLocker. Shut down by the developers in 2016.
  ransomware teslacrypt
- suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
  suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
  suricata
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2