General
-
Target
3ec7e1e22b606a87d27e4da549ebaa85dbaf3cc966fc73a13970fd9414fb3e69
-
Size
332KB
-
Sample
220701-fwz1qadebr
-
MD5
122bf9aa2d3eb6a9269ada81ec0a2041
-
SHA1
6cf5526956d455d1be66ba4446eaaaa0caf4fb73
-
SHA256
3ec7e1e22b606a87d27e4da549ebaa85dbaf3cc966fc73a13970fd9414fb3e69
-
SHA512
6b3e2430e2ddb59938b4b4f47c5dbda6b144c3aeaa0b7e012e5def7f6e09427846979977096e4bb80a6263369bf1863bc0de03520287ca87d840d856e259187d
Static task
static1
Behavioral task
behavioral1
Sample
3ec7e1e22b606a87d27e4da549ebaa85dbaf3cc966fc73a13970fd9414fb3e69.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3ec7e1e22b606a87d27e4da549ebaa85dbaf3cc966fc73a13970fd9414fb3e69.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-1083475884-596052423-1669053738-1000\Recovery+vgvse.txt
teslacrypt
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/16685EA7E1259B42
http://kkd47eh4hdjshb5t.angortra.at/16685EA7E1259B42
http://ytrest84y5i456hghadefdsd.pontogrot.com/16685EA7E1259B42
http://xlowfznrg4wf7dli.ONION/16685EA7E1259B42
Extracted
C:\$Recycle.Bin\S-1-5-21-2632097139-1792035885-811742494-1000\Recovery+toheq.txt
teslacrypt
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/62BFA74289E184D4
http://kkd47eh4hdjshb5t.angortra.at/62BFA74289E184D4
http://ytrest84y5i456hghadefdsd.pontogrot.com/62BFA74289E184D4
http://xlowfznrg4wf7dli.ONION/62BFA74289E184D4
Targets
-
-
Target
3ec7e1e22b606a87d27e4da549ebaa85dbaf3cc966fc73a13970fd9414fb3e69
-
Size
332KB
-
MD5
122bf9aa2d3eb6a9269ada81ec0a2041
-
SHA1
6cf5526956d455d1be66ba4446eaaaa0caf4fb73
-
SHA256
3ec7e1e22b606a87d27e4da549ebaa85dbaf3cc966fc73a13970fd9414fb3e69
-
SHA512
6b3e2430e2ddb59938b4b4f47c5dbda6b144c3aeaa0b7e012e5def7f6e09427846979977096e4bb80a6263369bf1863bc0de03520287ca87d840d856e259187d
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Adds Run key to start application
-