General
-
Target
466a0840ed6f4484f26afb630c6875cc6d9ebd4a968ee2808b801d89fcb31c4b
-
Size
424KB
-
Sample
220707-ksm9zabge3
-
MD5
4ee4303c494680602137222eced50e71
-
SHA1
3783dd9fbde986cc57b57170ac82d20ffeb7e3f3
-
SHA256
466a0840ed6f4484f26afb630c6875cc6d9ebd4a968ee2808b801d89fcb31c4b
-
SHA512
e6bb5129945cc1f4c69a6821bf9596cad72d7c0e9686bacd435365c9417e9a20b649ec59a4cb72875a43eb1a8a6aebc372d004dc3aedbe5a4374f002225e00c0
Static task
static1
Behavioral task
behavioral1
Sample
466a0840ed6f4484f26afb630c6875cc6d9ebd4a968ee2808b801d89fcb31c4b.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
466a0840ed6f4484f26afb630c6875cc6d9ebd4a968ee2808b801d89fcb31c4b.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-1083475884-596052423-1669053738-1000\_RECoVERY_+cvtle.txt
teslacrypt
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/7F7787DDBC5FC931
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/7F7787DDBC5FC931
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/7F7787DDBC5FC931
http://xlowfznrg4wf7dli.ONION/7F7787DDBC5FC931
Extracted
C:\$Recycle.Bin\S-1-5-21-3751123196-3323558407-1869646069-1000\_RECoVERY_+lmsnf.txt
teslacrypt
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/DC351A218A63E6
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/DC351A218A63E6
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/DC351A218A63E6
http://xlowfznrg4wf7dli.ONION/DC351A218A63E6
Targets
-
-
Target
466a0840ed6f4484f26afb630c6875cc6d9ebd4a968ee2808b801d89fcb31c4b
-
Size
424KB
-
MD5
4ee4303c494680602137222eced50e71
-
SHA1
3783dd9fbde986cc57b57170ac82d20ffeb7e3f3
-
SHA256
466a0840ed6f4484f26afb630c6875cc6d9ebd4a968ee2808b801d89fcb31c4b
-
SHA512
e6bb5129945cc1f4c69a6821bf9596cad72d7c0e9686bacd435365c9417e9a20b649ec59a4cb72875a43eb1a8a6aebc372d004dc3aedbe5a4374f002225e00c0
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Adds Run key to start application
-