General
-
Target
3cf3bcb7c5cc493852122e94cd38f60ec6bd639856861f9c6d02097674876c2d
-
Size
352KB
-
Sample
220703-fdcsgahdh7
-
MD5
761b5210153ca201ad516c19b4790bb5
-
SHA1
7d332ee352d4ce0c63d072ddc4d428c41a3641da
-
SHA256
3cf3bcb7c5cc493852122e94cd38f60ec6bd639856861f9c6d02097674876c2d
-
SHA512
033ad8cac6b36b18aac4bb8d5630475a7b2ca2f595d37729c1fcb30f76bdcc9b722c1b157d315926753d9d02d95c8cc2b11ac8e50d0415e99722c91a3788af88
Static task
static1
Behavioral task
behavioral1
Sample
3cf3bcb7c5cc493852122e94cd38f60ec6bd639856861f9c6d02097674876c2d.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3cf3bcb7c5cc493852122e94cd38f60ec6bd639856861f9c6d02097674876c2d.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-2277218442-1199762539-2004043321-1000\Recovery+xckit.txt
teslacrypt
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/54C2FD5D13D3A2B7
http://kkd47eh4hdjshb5t.angortra.at/54C2FD5D13D3A2B7
http://ytrest84y5i456hghadefdsd.pontogrot.com/54C2FD5D13D3A2B7
http://xlowfznrg4wf7dli.ONION/54C2FD5D13D3A2B7
Targets
-
-
Target
3cf3bcb7c5cc493852122e94cd38f60ec6bd639856861f9c6d02097674876c2d
-
Size
352KB
-
MD5
761b5210153ca201ad516c19b4790bb5
-
SHA1
7d332ee352d4ce0c63d072ddc4d428c41a3641da
-
SHA256
3cf3bcb7c5cc493852122e94cd38f60ec6bd639856861f9c6d02097674876c2d
-
SHA512
033ad8cac6b36b18aac4bb8d5630475a7b2ca2f595d37729c1fcb30f76bdcc9b722c1b157d315926753d9d02d95c8cc2b11ac8e50d0415e99722c91a3788af88
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
-
Executes dropped EXE
-
Deletes itself
-
Adds Run key to start application
-