General
-
Target
4c1d58df8f862bada481d0e2c5368865bba702c8475632a6194229069b9c844f
-
Size
240KB
-
Sample
220712-jjxxdabcf2
-
MD5
1707d3716c43f33baf6a8b228481f3aa
-
SHA1
587dd24ef2c2c196d3afe2ed918e8244be94f508
-
SHA256
4c1d58df8f862bada481d0e2c5368865bba702c8475632a6194229069b9c844f
-
SHA512
7996e5724ee4e79dfd811b2e0ab40fd58b93ae29d0edc5a28c940dafb76b9d6df927a96124c8a072b099c5399e0ba00d82bb4568181489a7a5b4beddf913d0ff
Static task
static1
Behavioral task
behavioral1
Sample
4c1d58df8f862bada481d0e2c5368865bba702c8475632a6194229069b9c844f.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
4c1d58df8f862bada481d0e2c5368865bba702c8475632a6194229069b9c844f.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-1083475884-596052423-1669053738-1000\Recovery+ujyri.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/1FA948296410E532
http://tes543berda73i48fsdfsd.keratadze.at/1FA948296410E532
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/1FA948296410E532
http://xlowfznrg4wf7dli.ONION/1FA948296410E532
Targets
-
-
Target
4c1d58df8f862bada481d0e2c5368865bba702c8475632a6194229069b9c844f
-
Size
240KB
-
MD5
1707d3716c43f33baf6a8b228481f3aa
-
SHA1
587dd24ef2c2c196d3afe2ed918e8244be94f508
-
SHA256
4c1d58df8f862bada481d0e2c5368865bba702c8475632a6194229069b9c844f
-
SHA512
7996e5724ee4e79dfd811b2e0ab40fd58b93ae29d0edc5a28c940dafb76b9d6df927a96124c8a072b099c5399e0ba00d82bb4568181489a7a5b4beddf913d0ff
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
-
Executes dropped EXE
-
Deletes itself
-
Adds Run key to start application
-