General
-
Target
407e85364f6d65a0209d70b7152a5fcfa0d96f0fad390ed94dc77b9874b2b8c9
-
Size
240KB
-
Sample
220708-t874radab3
-
MD5
6eef94ab0233130b8477c01eaa7f957f
-
SHA1
3e60938d00fe5e9fd2f4bff244b6eff2bbac9279
-
SHA256
407e85364f6d65a0209d70b7152a5fcfa0d96f0fad390ed94dc77b9874b2b8c9
-
SHA512
d8870646eb1b0339b40cf5341b0c2f3efb7adb7166d6e8eb7bfbcfa4a99ed38c570e54277e52f4f7d0a5e688fa5f241224cc794a927e42f51c39aacd75a12c02
Static task
static1
Behavioral task
behavioral1
Sample
407e85364f6d65a0209d70b7152a5fcfa0d96f0fad390ed94dc77b9874b2b8c9.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
407e85364f6d65a0209d70b7152a5fcfa0d96f0fad390ed94dc77b9874b2b8c9.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-2277218442-1199762539-2004043321-1000\Recovery+lrmuw.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/91777DB6A712A627
http://tes543berda73i48fsdfsd.keratadze.at/91777DB6A712A627
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/91777DB6A712A627
http://xlowfznrg4wf7dli.ONION/91777DB6A712A627
Targets
-
-
Target
407e85364f6d65a0209d70b7152a5fcfa0d96f0fad390ed94dc77b9874b2b8c9
-
Size
240KB
-
MD5
6eef94ab0233130b8477c01eaa7f957f
-
SHA1
3e60938d00fe5e9fd2f4bff244b6eff2bbac9279
-
SHA256
407e85364f6d65a0209d70b7152a5fcfa0d96f0fad390ed94dc77b9874b2b8c9
-
SHA512
d8870646eb1b0339b40cf5341b0c2f3efb7adb7166d6e8eb7bfbcfa4a99ed38c570e54277e52f4f7d0a5e688fa5f241224cc794a927e42f51c39aacd75a12c02
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
-
Executes dropped EXE
-
Deletes itself
-
Adds Run key to start application
-