General
-
Target
5375d680745593f96ad797fb29b770228dfc8169613a72928a67003f36a9ba12
-
Size
337KB
-
Sample
220716-3tvdsafdb3
-
MD5
68a457cedcf7dc8ef24863d223ccece5
-
SHA1
8a6b62d84b00f8bf72e903c8591486dbea87b4ec
-
SHA256
5375d680745593f96ad797fb29b770228dfc8169613a72928a67003f36a9ba12
-
SHA512
0fbef2de39466a9007c1a69827eb40ebf6ab78295155285955c37362e160ab8c7cd1ff5f5ee2132b9d26986b83f211eda1c03ffa0fab1e8806a445dba5329d25
Static task
static1
Behavioral task
behavioral1
Sample
5375d680745593f96ad797fb29b770228dfc8169613a72928a67003f36a9ba12.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
5375d680745593f96ad797fb29b770228dfc8169613a72928a67003f36a9ba12.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-1083475884-596052423-1669053738-1000\_RECoVERY_+cyewu.txt
teslacrypt
http://yyre45dbvn2nhbefbmh.begumvelic.at/B3D9FD789D3A1B33
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/B3D9FD789D3A1B33
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/B3D9FD789D3A1B33
http://xlowfznrg4wf7dli.ONION/B3D9FD789D3A1B33
Targets
-
-
Target
5375d680745593f96ad797fb29b770228dfc8169613a72928a67003f36a9ba12
-
Size
337KB
-
MD5
68a457cedcf7dc8ef24863d223ccece5
-
SHA1
8a6b62d84b00f8bf72e903c8591486dbea87b4ec
-
SHA256
5375d680745593f96ad797fb29b770228dfc8169613a72928a67003f36a9ba12
-
SHA512
0fbef2de39466a9007c1a69827eb40ebf6ab78295155285955c37362e160ab8c7cd1ff5f5ee2132b9d26986b83f211eda1c03ffa0fab1e8806a445dba5329d25
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
-
Executes dropped EXE
-
Deletes itself
-
Adds Run key to start application
-