Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
39994837fd8026fb9f8ee2d825370e0f1858c77d47d19539dfb4b505a4c6303a
-
Size
383KB
-
Sample
220625-lfpspshac7
-
MD5
7df9ceeb82676d57160f4a49217f2daa
-
SHA1
389d69dd6c58caedd95c8a634aa85be0c7b1ee76
-
SHA256
39994837fd8026fb9f8ee2d825370e0f1858c77d47d19539dfb4b505a4c6303a
-
SHA512
190e4637f4eef5791fe249292b2a14ef45d05a4e1f882fdde0a9526b0ef215cd1f5b5febca2f696668d8d9f63b74bdaea1d76e766481def6cab1befefbf4a1a4
Static task
static1
Behavioral task
behavioral1
Sample
39994837fd8026fb9f8ee2d825370e0f1858c77d47d19539dfb4b505a4c6303a.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
39994837fd8026fb9f8ee2d825370e0f1858c77d47d19539dfb4b505a4c6303a.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-1083475884-596052423-1669053738-1000\_RECOVERY_+sevfq.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/2775A89FADD46950
http://tes543berda73i48fsdfsd.keratadze.at/2775A89FADD46950
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/2775A89FADD46950
http://xlowfznrg4wf7dli.ONION/2775A89FADD46950
Targets
-
-
Target
39994837fd8026fb9f8ee2d825370e0f1858c77d47d19539dfb4b505a4c6303a
-
Size
383KB
-
MD5
7df9ceeb82676d57160f4a49217f2daa
-
SHA1
389d69dd6c58caedd95c8a634aa85be0c7b1ee76
-
SHA256
39994837fd8026fb9f8ee2d825370e0f1858c77d47d19539dfb4b505a4c6303a
-
SHA512
190e4637f4eef5791fe249292b2a14ef45d05a4e1f882fdde0a9526b0ef215cd1f5b5febca2f696668d8d9f63b74bdaea1d76e766481def6cab1befefbf4a1a4
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
-
Executes dropped EXE
-
Deletes itself
-
Adds Run key to start application
-