Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
3a32b5a0f014b080075171c56ead69a8de6692a46ff25c65baccd76c229979ac
-
Size
325KB
-
Sample
220625-g3b3xabdg6
-
MD5
5c982424684cd787e8fb1fbc733623c1
-
SHA1
69f5a4c352f018e1d24a4064673545e35bf2eae3
-
SHA256
3a32b5a0f014b080075171c56ead69a8de6692a46ff25c65baccd76c229979ac
-
SHA512
c2ca550ad52b963cdaadc2924b84912f19c432ccc9b77cc51b8a2e774566188e19eba4e557a686ce99851cc8ed8b2895fd7fda7760574745be19747f22332abb
Static task
static1
Behavioral task
behavioral1
Sample
3a32b5a0f014b080075171c56ead69a8de6692a46ff25c65baccd76c229979ac.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3a32b5a0f014b080075171c56ead69a8de6692a46ff25c65baccd76c229979ac.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-2277218442-1199762539-2004043321-1000\_ReCoVeRy_+ojyji.txt
teslacrypt
http://po4dbsjbneljhrlbvaueqrgveatv.bonmawp.at/2C3DC3D8821B4FC8
http://u54bbnhf354fbkh254tbkhjbgy8258gnkwerg.tahaplap.com/2C3DC3D8821B4FC8
http://w6bfg4hahn5bfnlsafgchkvg5fwsfvrt.hareuna.at/2C3DC3D8821B4FC8
http://xlowfznrg4wf7dli.ONION/2C3DC3D8821B4FC8
Extracted
C:\$Recycle.Bin\S-1-5-21-2277218442-1199762539-2004043321-1000\_ReCoVeRy_+ojyji.html
Targets
-
-
Target
3a32b5a0f014b080075171c56ead69a8de6692a46ff25c65baccd76c229979ac
-
Size
325KB
-
MD5
5c982424684cd787e8fb1fbc733623c1
-
SHA1
69f5a4c352f018e1d24a4064673545e35bf2eae3
-
SHA256
3a32b5a0f014b080075171c56ead69a8de6692a46ff25c65baccd76c229979ac
-
SHA512
c2ca550ad52b963cdaadc2924b84912f19c432ccc9b77cc51b8a2e774566188e19eba4e557a686ce99851cc8ed8b2895fd7fda7760574745be19747f22332abb
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
-
Executes dropped EXE
-
Deletes itself
-
Adds Run key to start application
-