Overview

overview

10

Static

static

3165274b8d...32.exe

windows7_x64

10

3165274b8d...32.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3165274b8def937c29b4e72d487f94fe1dac47e1c17e0625b06853e6c3819532

  • Size

    368KB

  • Sample

    220620-2xzl8scfhm

  • MD5

    06abd894d033d5ad4d81bc3fc43b4de6

  • SHA1

    19ec6cf56956d049d160e6c157b0a7f2b251abf4

  • SHA256

    3165274b8def937c29b4e72d487f94fe1dac47e1c17e0625b06853e6c3819532

  • SHA512

    beb7dd11c8e2986f4d3dc067c11663281400e555dd94ab74908d3b363f564270342d71b6ea536dc4e3e211d95da95b9448b22077bed13247de65e162e4bf7810

Score
10/10
teslacryptpersistenceransomwaresuricata

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-2277218442-1199762539-2004043321-1000\_RECoVERY_+ntocg.txt

Family

teslacrypt

Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with AES More information about the encryption keys using AES can be found here: http://en.wikipedia.org/wiki/AES How did this happen ? !!! Specially for your PC was generated personal AES KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/17485ECB7EB205A 2. http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/17485ECB7EB205A 3. http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/17485ECB7EB205A If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/17485ECB7EB205A 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/17485ECB7EB205A http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/17485ECB7EB205A http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/17485ECB7EB205A *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/17485ECB7EB205A
URLs

http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/17485ECB7EB205A

http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/17485ECB7EB205A

http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/17485ECB7EB205A

http://xlowfznrg4wf7dli.ONION/17485ECB7EB205A

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-1081944012-3634099177-1681222835-1000\_RECoVERY_+urlrf.txt

Family

teslacrypt

Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with AES More information about the encryption keys using AES can be found here: http://en.wikipedia.org/wiki/AES How did this happen ? !!! Specially for your PC was generated personal AES KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/BAF95DD1D24B4110 2. http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/BAF95DD1D24B4110 3. http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/BAF95DD1D24B4110 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/BAF95DD1D24B4110 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/BAF95DD1D24B4110 http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/BAF95DD1D24B4110 http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/BAF95DD1D24B4110 *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/BAF95DD1D24B4110
URLs

http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/BAF95DD1D24B4110

http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/BAF95DD1D24B4110

http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/BAF95DD1D24B4110

http://xlowfznrg4wf7dli.ONION/BAF95DD1D24B4110

Targets

    • Target

      3165274b8def937c29b4e72d487f94fe1dac47e1c17e0625b06853e6c3819532

    • Size

      368KB

    • MD5

      06abd894d033d5ad4d81bc3fc43b4de6

    • SHA1

      19ec6cf56956d049d160e6c157b0a7f2b251abf4

    • SHA256

      3165274b8def937c29b4e72d487f94fe1dac47e1c17e0625b06853e6c3819532

    • SHA512

      beb7dd11c8e2986f4d3dc067c11663281400e555dd94ab74908d3b363f564270342d71b6ea536dc4e3e211d95da95b9448b22077bed13247de65e162e4bf7810

    Score
    10/10
    teslacryptpersistenceransomwaresuricata

    • TeslaCrypt, AlphaCrypt

      Ransomware based on CryptoLocker. Shut down by the developers in 2016.

      ransomwareteslacrypt

    • suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon

      suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon

      suricata

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks