General
-
Target
46c1eb1592fa4c5968fe7dfed52d1d05059fbb3ab1de223fc18bfcad2415f777
-
Size
360KB
-
Sample
220707-jnhy1shfe9
-
MD5
2c3d030922af0eda62e2d4d258665088
-
SHA1
c378e9cf2c919d3690fe13711122401e00f7ee80
-
SHA256
46c1eb1592fa4c5968fe7dfed52d1d05059fbb3ab1de223fc18bfcad2415f777
-
SHA512
5d06518c9ab6a8118dcde5710c61630866f6dcfc98152c1da3227a7023bab678870682af76e3364df5fd1a64abf83244a81e9ebd6273803652fad74fdbccbf0e
Static task
static1
Behavioral task
behavioral1
Sample
46c1eb1592fa4c5968fe7dfed52d1d05059fbb3ab1de223fc18bfcad2415f777.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
46c1eb1592fa4c5968fe7dfed52d1d05059fbb3ab1de223fc18bfcad2415f777.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-2277218442-1199762539-2004043321-1000\Recovery+hyski.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/B76B469C838DDA6F
http://tes543berda73i48fsdfsd.keratadze.at/B76B469C838DDA6F
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/B76B469C838DDA6F
http://xlowfznrg4wf7dli.ONION/B76B469C838DDA6F
Targets
-
-
Target
46c1eb1592fa4c5968fe7dfed52d1d05059fbb3ab1de223fc18bfcad2415f777
-
Size
360KB
-
MD5
2c3d030922af0eda62e2d4d258665088
-
SHA1
c378e9cf2c919d3690fe13711122401e00f7ee80
-
SHA256
46c1eb1592fa4c5968fe7dfed52d1d05059fbb3ab1de223fc18bfcad2415f777
-
SHA512
5d06518c9ab6a8118dcde5710c61630866f6dcfc98152c1da3227a7023bab678870682af76e3364df5fd1a64abf83244a81e9ebd6273803652fad74fdbccbf0e
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Deletes itself
-
Drops startup file
-
Adds Run key to start application
-