General
-
Target
34be65054fa011b17d3bc772f45948344850c7077557ed53cbe48ebc54cf7713
-
Size
368KB
-
Sample
220619-yynpksdee7
-
MD5
3095333f942aafbea85f1bb9300dec9d
-
SHA1
38e7a84e8b03055ba63600d38395534174800dc4
-
SHA256
34be65054fa011b17d3bc772f45948344850c7077557ed53cbe48ebc54cf7713
-
SHA512
daa14f5024470c579496a0600a934b970e7e2eb19a5707a057a05d31ba4c4dc407d19c81d72fee91e96fe0c49410658f7d40b6edb1c2c8403fceccc2c2ab70d0
Static task
static1
Behavioral task
behavioral1
Sample
34be65054fa011b17d3bc772f45948344850c7077557ed53cbe48ebc54cf7713.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
34be65054fa011b17d3bc772f45948344850c7077557ed53cbe48ebc54cf7713.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-2277218442-1199762539-2004043321-1000\_RECoVERY_+bjogc.txt
teslacrypt
http://yyre45dbvn2nhbefbmh.begumvelic.at/73556878EAC8B469
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/73556878EAC8B469
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/73556878EAC8B469
http://xlowfznrg4wf7dli.ONION/73556878EAC8B469
Extracted
C:\$Recycle.Bin\S-1-5-21-3751123196-3323558407-1869646069-1000\_RECoVERY_+kuaws.txt
teslacrypt
http://yyre45dbvn2nhbefbmh.begumvelic.at/9A56E01AD755F85
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/9A56E01AD755F85
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/9A56E01AD755F85
http://xlowfznrg4wf7dli.ONION/9A56E01AD755F85
Targets
-
-
Target
34be65054fa011b17d3bc772f45948344850c7077557ed53cbe48ebc54cf7713
-
Size
368KB
-
MD5
3095333f942aafbea85f1bb9300dec9d
-
SHA1
38e7a84e8b03055ba63600d38395534174800dc4
-
SHA256
34be65054fa011b17d3bc772f45948344850c7077557ed53cbe48ebc54cf7713
-
SHA512
daa14f5024470c579496a0600a934b970e7e2eb19a5707a057a05d31ba4c4dc407d19c81d72fee91e96fe0c49410658f7d40b6edb1c2c8403fceccc2c2ab70d0
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Adds Run key to start application
-