General
-
Target
3e27fd85e9809a130b06d509315ef5d1365dfb65e8cf1e0f395b31bc24582b9e
-
Size
240KB
-
Sample
220701-kblptabgfm
-
MD5
07178a973e53ce8e9f45043706eb7c27
-
SHA1
17e8323e6c7440740526cb99c05aae4743f3fb6a
-
SHA256
3e27fd85e9809a130b06d509315ef5d1365dfb65e8cf1e0f395b31bc24582b9e
-
SHA512
3b33c4d3ffb76fa30d1f4ab1acbc3e62030a5aa8b97aa5d8364b6a149c66495a453a0d4c65733fb33933a7c0ee175102daec2d5b62c92b5168a0df2eef7299c8
Static task
static1
Behavioral task
behavioral1
Sample
3e27fd85e9809a130b06d509315ef5d1365dfb65e8cf1e0f395b31bc24582b9e.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3e27fd85e9809a130b06d509315ef5d1365dfb65e8cf1e0f395b31bc24582b9e.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-1083475884-596052423-1669053738-1000\Recovery+iquxe.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/6145BE1DEA263295
http://tes543berda73i48fsdfsd.keratadze.at/6145BE1DEA263295
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/6145BE1DEA263295
http://xlowfznrg4wf7dli.ONION/6145BE1DEA263295
Targets
-
-
Target
3e27fd85e9809a130b06d509315ef5d1365dfb65e8cf1e0f395b31bc24582b9e
-
Size
240KB
-
MD5
07178a973e53ce8e9f45043706eb7c27
-
SHA1
17e8323e6c7440740526cb99c05aae4743f3fb6a
-
SHA256
3e27fd85e9809a130b06d509315ef5d1365dfb65e8cf1e0f395b31bc24582b9e
-
SHA512
3b33c4d3ffb76fa30d1f4ab1acbc3e62030a5aa8b97aa5d8364b6a149c66495a453a0d4c65733fb33933a7c0ee175102daec2d5b62c92b5168a0df2eef7299c8
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
-
Executes dropped EXE
-
Deletes itself
-
Adds Run key to start application
-