General
-
Target
3d938a2ea292a66c309305161dd919c1e6f7aab73c03526cf6908e250fe708e6
-
Size
384KB
-
Sample
220703-c4zhdacbcp
-
MD5
67899340213a285a6790c75dd86819f4
-
SHA1
44d863533ed3cddc5850be89e99f930052a88952
-
SHA256
3d938a2ea292a66c309305161dd919c1e6f7aab73c03526cf6908e250fe708e6
-
SHA512
1654bdc09c7daed79a010a807b20e2c99c905711d5f0d64c03975961b6c80c651c1bb8e966837050fcf4414f46618991012b123bd8612ea1f5bb731edcdea8ff
Static task
static1
Behavioral task
behavioral1
Sample
3d938a2ea292a66c309305161dd919c1e6f7aab73c03526cf6908e250fe708e6.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3d938a2ea292a66c309305161dd919c1e6f7aab73c03526cf6908e250fe708e6.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-2277218442-1199762539-2004043321-1000\Recovery+eqono.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/A6532FA9612D75DB
http://tes543berda73i48fsdfsd.keratadze.at/A6532FA9612D75DB
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/A6532FA9612D75DB
http://xlowfznrg4wf7dli.ONION/A6532FA9612D75DB
Targets
-
-
Target
3d938a2ea292a66c309305161dd919c1e6f7aab73c03526cf6908e250fe708e6
-
Size
384KB
-
MD5
67899340213a285a6790c75dd86819f4
-
SHA1
44d863533ed3cddc5850be89e99f930052a88952
-
SHA256
3d938a2ea292a66c309305161dd919c1e6f7aab73c03526cf6908e250fe708e6
-
SHA512
1654bdc09c7daed79a010a807b20e2c99c905711d5f0d64c03975961b6c80c651c1bb8e966837050fcf4414f46618991012b123bd8612ea1f5bb731edcdea8ff
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
-
Executes dropped EXE
-
Deletes itself
-
Adds Run key to start application
-