General
-
Target
3a1465da11ef3b09d59ff62714ce75b729ae7b1704a82fdbc786cccfab36e07c
-
Size
342KB
-
Sample
220625-hnh4caabcn
-
MD5
012427fa5009d5676f160dce7eb80eea
-
SHA1
00d38f07f9fcdd6a8873244d1eb9946935525b7f
-
SHA256
3a1465da11ef3b09d59ff62714ce75b729ae7b1704a82fdbc786cccfab36e07c
-
SHA512
defe32114c0ea31638825c001d9b5d4079ba7e6cbb0f65989053b08b9f5785d5d7471ec37dd5fc3d5632d2d858cd98a41319675721cd87c4bc4f1dbb2c9ad72c
Static task
static1
Behavioral task
behavioral1
Sample
3a1465da11ef3b09d59ff62714ce75b729ae7b1704a82fdbc786cccfab36e07c.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3a1465da11ef3b09d59ff62714ce75b729ae7b1704a82fdbc786cccfab36e07c.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-2277218442-1199762539-2004043321-1000\_RECoVERY_+pjuli.txt
teslacrypt
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/6E91DEB7F5CC7C6
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/6E91DEB7F5CC7C6
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/6E91DEB7F5CC7C6
http://xlowfznrg4wf7dli.ONION/6E91DEB7F5CC7C6
Targets
-
-
Target
3a1465da11ef3b09d59ff62714ce75b729ae7b1704a82fdbc786cccfab36e07c
-
Size
342KB
-
MD5
012427fa5009d5676f160dce7eb80eea
-
SHA1
00d38f07f9fcdd6a8873244d1eb9946935525b7f
-
SHA256
3a1465da11ef3b09d59ff62714ce75b729ae7b1704a82fdbc786cccfab36e07c
-
SHA512
defe32114c0ea31638825c001d9b5d4079ba7e6cbb0f65989053b08b9f5785d5d7471ec37dd5fc3d5632d2d858cd98a41319675721cd87c4bc4f1dbb2c9ad72c
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
-
Executes dropped EXE
-
Deletes itself
-
Adds Run key to start application
-