General
-
Target
3fd9b1adcb7a64a0ef8d47423bcf984a02b8a7b96fb3467a09d278385a1080e3
-
Size
329KB
-
Sample
220630-w9nslsgcap
-
MD5
4307f050fdd98a39e1c38dc1d56abb4a
-
SHA1
ae3489b94b4a396c82e966de39e49974e84d432c
-
SHA256
3fd9b1adcb7a64a0ef8d47423bcf984a02b8a7b96fb3467a09d278385a1080e3
-
SHA512
9a55a3109f4fba4270f1c13ba37cf7d8a7114a9bd93c11c3b3f59c02d544c708e3ff55f804497d6cb416dc4fc792f21d18901e0cc17f9369736d805d73fc648b
Static task
static1
Behavioral task
behavioral1
Sample
3fd9b1adcb7a64a0ef8d47423bcf984a02b8a7b96fb3467a09d278385a1080e3.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3fd9b1adcb7a64a0ef8d47423bcf984a02b8a7b96fb3467a09d278385a1080e3.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-790309383-526510583-3802439154-1000\Recovery+wfrrr.txt
teslacrypt
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/A594E08BE5817F
http://kkd47eh4hdjshb5t.angortra.at/A594E08BE5817F
http://ytrest84y5i456hghadefdsd.pontogrot.com/A594E08BE5817F
http://xlowfznrg4wf7dli.ONION/A594E08BE5817F
Targets
-
-
Target
3fd9b1adcb7a64a0ef8d47423bcf984a02b8a7b96fb3467a09d278385a1080e3
-
Size
329KB
-
MD5
4307f050fdd98a39e1c38dc1d56abb4a
-
SHA1
ae3489b94b4a396c82e966de39e49974e84d432c
-
SHA256
3fd9b1adcb7a64a0ef8d47423bcf984a02b8a7b96fb3467a09d278385a1080e3
-
SHA512
9a55a3109f4fba4270f1c13ba37cf7d8a7114a9bd93c11c3b3f59c02d544c708e3ff55f804497d6cb416dc4fc792f21d18901e0cc17f9369736d805d73fc648b
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
-
Executes dropped EXE
-
Deletes itself
-
Adds Run key to start application
-