Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
38f30892490a4797d0ab13856121e36018f6cac9216e84126e1688b430993e9a
-
Size
364KB
-
Sample
220625-w2lnaahda4
-
MD5
1325631ba1fde9e86e50a652c8e00b41
-
SHA1
e54235603441c38cdc17098bf1be7307cfcc30ae
-
SHA256
38f30892490a4797d0ab13856121e36018f6cac9216e84126e1688b430993e9a
-
SHA512
b5d0a9a9c5d9bd8dc77767428de5fa517cd89d6227230e21b71294d47858d5e45ebb1b3b01a8532e5aa353077e7e5588ac7e10952c84341e5efa5d7c12a7a1cd
Static task
static1
Behavioral task
behavioral1
Sample
38f30892490a4797d0ab13856121e36018f6cac9216e84126e1688b430993e9a.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
38f30892490a4797d0ab13856121e36018f6cac9216e84126e1688b430993e9a.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-1083475884-596052423-1669053738-1000\_RECoVERY_+gegva.txt
teslacrypt
http://yyre45dbvn2nhbefbmh.begumvelic.at/C125546D6873347
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/C125546D6873347
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/C125546D6873347
http://xlowfznrg4wf7dli.ONION/C125546D6873347
Extracted
C:\$Recycle.Bin\S-1-5-21-3751123196-3323558407-1869646069-1000\_RECoVERY_+vodfa.txt
teslacrypt
http://yyre45dbvn2nhbefbmh.begumvelic.at/456FF52AE1793B5
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/456FF52AE1793B5
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/456FF52AE1793B5
http://xlowfznrg4wf7dli.ONION/456FF52AE1793B5
Targets
-
-
Target
38f30892490a4797d0ab13856121e36018f6cac9216e84126e1688b430993e9a
-
Size
364KB
-
MD5
1325631ba1fde9e86e50a652c8e00b41
-
SHA1
e54235603441c38cdc17098bf1be7307cfcc30ae
-
SHA256
38f30892490a4797d0ab13856121e36018f6cac9216e84126e1688b430993e9a
-
SHA512
b5d0a9a9c5d9bd8dc77767428de5fa517cd89d6227230e21b71294d47858d5e45ebb1b3b01a8532e5aa353077e7e5588ac7e10952c84341e5efa5d7c12a7a1cd
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Adds Run key to start application
-