General
-
Target
3af2655c4fc69d0ac9713bc32d00950a3f62e46bfacfec63d9028a8659fcd245
-
Size
424KB
-
Sample
220703-wya3dabgbm
-
MD5
1f6c2ee7195acf760cb3be66590d70fb
-
SHA1
483fe52b42e290a146b9b01ddd0aed4615a31508
-
SHA256
3af2655c4fc69d0ac9713bc32d00950a3f62e46bfacfec63d9028a8659fcd245
-
SHA512
a0fb9d84671c5db5dce2482a5b348b7ebc6d8af5cd098304c3ce43fa34f58aff15c90daaedeef5ddb2f852b44aba67b88fda69631a07ce88b4869fdee1f86934
Static task
static1
Behavioral task
behavioral1
Sample
3af2655c4fc69d0ac9713bc32d00950a3f62e46bfacfec63d9028a8659fcd245.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3af2655c4fc69d0ac9713bc32d00950a3f62e46bfacfec63d9028a8659fcd245.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-1083475884-596052423-1669053738-1000\_RECoVERY_+uwuhg.txt
teslacrypt
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/EB202A70418E531F
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/EB202A70418E531F
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/EB202A70418E531F
http://xlowfznrg4wf7dli.ONION/EB202A70418E531F
Extracted
C:\$Recycle.Bin\S-1-5-21-2632097139-1792035885-811742494-1000\_RECoVERY_+jdivf.txt
teslacrypt
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/31124EA0C012C73A
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/31124EA0C012C73A
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/31124EA0C012C73A
http://xlowfznrg4wf7dli.ONION/31124EA0C012C73A
Targets
-
-
Target
3af2655c4fc69d0ac9713bc32d00950a3f62e46bfacfec63d9028a8659fcd245
-
Size
424KB
-
MD5
1f6c2ee7195acf760cb3be66590d70fb
-
SHA1
483fe52b42e290a146b9b01ddd0aed4615a31508
-
SHA256
3af2655c4fc69d0ac9713bc32d00950a3f62e46bfacfec63d9028a8659fcd245
-
SHA512
a0fb9d84671c5db5dce2482a5b348b7ebc6d8af5cd098304c3ce43fa34f58aff15c90daaedeef5ddb2f852b44aba67b88fda69631a07ce88b4869fdee1f86934
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Adds Run key to start application
-