General
-
Target
2729d7b045ba7a4dbab489a1d0dd38735ef4744e90a59c48b55c861a3a84d8c0
-
Size
332KB
-
Sample
220616-ggj7dsdggq
-
MD5
5838bce0041dcbcda08b08f471891d89
-
SHA1
e382ffb84b93947cb840ef4117b874ce75436c5f
-
SHA256
2729d7b045ba7a4dbab489a1d0dd38735ef4744e90a59c48b55c861a3a84d8c0
-
SHA512
aa3da4bda124b0166ad975a44e16260677f49c80716a9589b1338eb277528593262a2eb810dce4919cec2fb47a63ea22317203fb9b51507c20c36111d2a10c94
Static task
static1
Behavioral task
behavioral1
Sample
2729d7b045ba7a4dbab489a1d0dd38735ef4744e90a59c48b55c861a3a84d8c0.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
2729d7b045ba7a4dbab489a1d0dd38735ef4744e90a59c48b55c861a3a84d8c0.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-1083475884-596052423-1669053738-1000\_RECOVERY_+ryofl.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/69BE8739A1588D9
http://tes543berda73i48fsdfsd.keratadze.at/69BE8739A1588D9
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/69BE8739A1588D9
http://xlowfznrg4wf7dli.ONION/69BE8739A1588D9
Targets
-
-
Target
2729d7b045ba7a4dbab489a1d0dd38735ef4744e90a59c48b55c861a3a84d8c0
-
Size
332KB
-
MD5
5838bce0041dcbcda08b08f471891d89
-
SHA1
e382ffb84b93947cb840ef4117b874ce75436c5f
-
SHA256
2729d7b045ba7a4dbab489a1d0dd38735ef4744e90a59c48b55c861a3a84d8c0
-
SHA512
aa3da4bda124b0166ad975a44e16260677f49c80716a9589b1338eb277528593262a2eb810dce4919cec2fb47a63ea22317203fb9b51507c20c36111d2a10c94
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Deletes itself
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-