General
-
Target
47bc8160e048c97962bd025d0bb690ab6a181eb29ce34961cf14fb1658a743de
-
Size
364KB
-
Sample
220714-gdlaaagccp
-
MD5
2e210597af22309e3ebeeba65af6ea9e
-
SHA1
2ffc2060f55a03eea03c6a2cee005f07adfd979b
-
SHA256
47bc8160e048c97962bd025d0bb690ab6a181eb29ce34961cf14fb1658a743de
-
SHA512
34189ae4253da2e01c20866d921c0303f48b777f0ae6c7efcef96ef4d11531e258bd06de3da128fcd1e6432e6a3bfc41e812d9d7d4a6dfd3b288d57618b5a4b7
Static task
static1
Behavioral task
behavioral1
Sample
47bc8160e048c97962bd025d0bb690ab6a181eb29ce34961cf14fb1658a743de.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
47bc8160e048c97962bd025d0bb690ab6a181eb29ce34961cf14fb1658a743de.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-1819626980-2277161760-1023733287-1000\_RECoVERY_+dfnpb.txt
teslacrypt
http://yyre45dbvn2nhbefbmh.begumvelic.at/25F74F41183EDE96
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/25F74F41183EDE96
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/25F74F41183EDE96
http://xlowfznrg4wf7dli.ONION/25F74F41183EDE96
Targets
-
-
Target
47bc8160e048c97962bd025d0bb690ab6a181eb29ce34961cf14fb1658a743de
-
Size
364KB
-
MD5
2e210597af22309e3ebeeba65af6ea9e
-
SHA1
2ffc2060f55a03eea03c6a2cee005f07adfd979b
-
SHA256
47bc8160e048c97962bd025d0bb690ab6a181eb29ce34961cf14fb1658a743de
-
SHA512
34189ae4253da2e01c20866d921c0303f48b777f0ae6c7efcef96ef4d11531e258bd06de3da128fcd1e6432e6a3bfc41e812d9d7d4a6dfd3b288d57618b5a4b7
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
-
Executes dropped EXE
-
Deletes itself
-
Adds Run key to start application
-