General
-
Target
4cbacc05d5e64567a4eb432fa7b6581b5adcf89361eaf7b31ff9cb4757dbad2a
-
Size
243KB
-
Sample
220712-fyrr5afca6
-
MD5
1b6e3083fa4592a7929a0a778c1e5cf3
-
SHA1
a5513ad4ad73626ae4f8c8c325cf4d0d6c0c595b
-
SHA256
4cbacc05d5e64567a4eb432fa7b6581b5adcf89361eaf7b31ff9cb4757dbad2a
-
SHA512
f4e4c6cb5f5d8e464bd6235086c5b08e341f9ba5c93063617a829107862a6372587209a4ccf25296f9014a4234669995109484eaf085c301f1d6b36abfbcc37e
Static task
static1
Behavioral task
behavioral1
Sample
4cbacc05d5e64567a4eb432fa7b6581b5adcf89361eaf7b31ff9cb4757dbad2a.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
4cbacc05d5e64567a4eb432fa7b6581b5adcf89361eaf7b31ff9cb4757dbad2a.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-2277218442-1199762539-2004043321-1000\Recovery+ujkrr.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/3B693A976AB83E9B
http://tes543berda73i48fsdfsd.keratadze.at/3B693A976AB83E9B
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/3B693A976AB83E9B
http://xlowfznrg4wf7dli.ONION/3B693A976AB83E9B
Targets
-
-
Target
4cbacc05d5e64567a4eb432fa7b6581b5adcf89361eaf7b31ff9cb4757dbad2a
-
Size
243KB
-
MD5
1b6e3083fa4592a7929a0a778c1e5cf3
-
SHA1
a5513ad4ad73626ae4f8c8c325cf4d0d6c0c595b
-
SHA256
4cbacc05d5e64567a4eb432fa7b6581b5adcf89361eaf7b31ff9cb4757dbad2a
-
SHA512
f4e4c6cb5f5d8e464bd6235086c5b08e341f9ba5c93063617a829107862a6372587209a4ccf25296f9014a4234669995109484eaf085c301f1d6b36abfbcc37e
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Deletes itself
-
Adds Run key to start application
-