teslacrypt | 37327c1df4dd585c2213d12020449ac78ee1b53948e35fec7da18fc9e84cbd2b

General

Target

37327c1df4dd585c2213d12020449ac78ee1b53948e35fec7da18fc9e84cbd2b
Size

344KB
Sample

220626-aencpsbea4
MD5

54a1ca99363f3f777841416acc597cd5
SHA1

1f24ad129b53307b679d797145ab0f17b19927b4
SHA256

37327c1df4dd585c2213d12020449ac78ee1b53948e35fec7da18fc9e84cbd2b
SHA512

a37b1bd104e2173e119b37e2c8090b9723dd24457412fedcf1f653754ba666e32121cb8530d63662b7cadb5c8410cbd087acda9bebdbfaff00769f9052506155

Score

10^/10

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-790309383-526510583-3802439154-1000\Recovery+hanxi.txt

Family

teslacrypt

Ransom Note

NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with AES More information about the encryption keys using AES can be found here: http://en.wikipedia.org/wiki/AES How did this happen ? !!! Specially for your PC was generated personal AES KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/DD6EA5598E7ABB52 2. http://tes543berda73i48fsdfsd.keratadze.at/DD6EA5598E7ABB52 3. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/DD6EA5598E7ABB52 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/DD6EA5598E7ABB52 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/DD6EA5598E7ABB52 http://tes543berda73i48fsdfsd.keratadze.at/DD6EA5598E7ABB52 http://tt54rfdjhb34rfbnknaerg.milerteddy.com/DD6EA5598E7ABB52 *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/DD6EA5598E7ABB52

URLs

http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/DD6EA5598E7ABB52

http://tes543berda73i48fsdfsd.keratadze.at/DD6EA5598E7ABB52

http://tt54rfdjhb34rfbnknaerg.milerteddy.com/DD6EA5598E7ABB52

http://xlowfznrg4wf7dli.ONION/DD6EA5598E7ABB52

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-1809750270-3141839489-3074374771-1000\Recovery+etpft.txt

Family

teslacrypt

Ransom Note

NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with AES More information about the encryption keys using AES can be found here: http://en.wikipedia.org/wiki/AES How did this happen ? !!! Specially for your PC was generated personal AES KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/A92EFD85BD3DBC5 2. http://tes543berda73i48fsdfsd.keratadze.at/A92EFD85BD3DBC5 3. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/A92EFD85BD3DBC5 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/A92EFD85BD3DBC5 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/A92EFD85BD3DBC5 http://tes543berda73i48fsdfsd.keratadze.at/A92EFD85BD3DBC5 http://tt54rfdjhb34rfbnknaerg.milerteddy.com/A92EFD85BD3DBC5 *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/A92EFD85BD3DBC5

URLs

http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/A92EFD85BD3DBC5

http://tes543berda73i48fsdfsd.keratadze.at/A92EFD85BD3DBC5

http://tt54rfdjhb34rfbnknaerg.milerteddy.com/A92EFD85BD3DBC5

http://xlowfznrg4wf7dli.ONION/A92EFD85BD3DBC5

Targets

- Target
  
  37327c1df4dd585c2213d12020449ac78ee1b53948e35fec7da18fc9e84cbd2b
- Size
  
  344KB
- MD5
  
  54a1ca99363f3f777841416acc597cd5
- SHA1
  
  1f24ad129b53307b679d797145ab0f17b19927b4
- SHA256
  
  37327c1df4dd585c2213d12020449ac78ee1b53948e35fec7da18fc9e84cbd2b
- SHA512
  
  a37b1bd104e2173e119b37e2c8090b9723dd24457412fedcf1f653754ba666e32121cb8530d63662b7cadb5c8410cbd087acda9bebdbfaff00769f9052506155
Score

10^/10

teslacrypt persistence ransomware suricata
- TeslaCrypt, AlphaCrypt
  Ransomware based on CryptoLocker. Shut down by the developers in 2016.
  ransomware teslacrypt
- suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
  suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
  suricata
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2