General
-
Target
535bc699baf41334ad3f15528af60df9a8421533068f3f09ed01df212b40b059
-
Size
376KB
-
Sample
220717-aetjqaghhp
-
MD5
2b4d5982e3909f16967246c9fc4d2451
-
SHA1
2bd2a2d29679fe8cf68ab8f00ae9ed58f1506c06
-
SHA256
535bc699baf41334ad3f15528af60df9a8421533068f3f09ed01df212b40b059
-
SHA512
01d8716520cab4c226135116cc716d5337b54bcfd672fed8ef727b02560ecd1a16c8602bafbdc75fb65eb49f8af9d3add0658c116b9a574fe2183e2f2f9c68cb
Static task
static1
Behavioral task
behavioral1
Sample
535bc699baf41334ad3f15528af60df9a8421533068f3f09ed01df212b40b059.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
535bc699baf41334ad3f15528af60df9a8421533068f3f09ed01df212b40b059.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-2277218442-1199762539-2004043321-1000\Recovery+ljtqc.txt
teslacrypt
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/4F70D8B5494DDF30
http://kkd47eh4hdjshb5t.angortra.at/4F70D8B5494DDF30
http://ytrest84y5i456hghadefdsd.pontogrot.com/4F70D8B5494DDF30
http://xlowfznrg4wf7dli.ONION/4F70D8B5494DDF30
Targets
-
-
Target
535bc699baf41334ad3f15528af60df9a8421533068f3f09ed01df212b40b059
-
Size
376KB
-
MD5
2b4d5982e3909f16967246c9fc4d2451
-
SHA1
2bd2a2d29679fe8cf68ab8f00ae9ed58f1506c06
-
SHA256
535bc699baf41334ad3f15528af60df9a8421533068f3f09ed01df212b40b059
-
SHA512
01d8716520cab4c226135116cc716d5337b54bcfd672fed8ef727b02560ecd1a16c8602bafbdc75fb65eb49f8af9d3add0658c116b9a574fe2183e2f2f9c68cb
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
-
Executes dropped EXE
-
Deletes itself
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-