General

  • Target

    4daa27ed35b8f69d102fb1df910c9c30a890bb15e6fc8281ba8b348ed2a8ba39

  • Size

    383KB

  • Sample

    220720-y56tqshha9

  • MD5

    7a34c314dcb730e9d7b1fb74db78050f

  • SHA1

    af3ab8350547fba0a14bc2d6b8a315a2ec9d2986

  • SHA256

    4daa27ed35b8f69d102fb1df910c9c30a890bb15e6fc8281ba8b348ed2a8ba39

  • SHA512

    c08a4b74673a93841b328eb5aee31cf0ff1f786457a47cc5f00ea323ffd0b8e95be8e6ef0670c1ac5cc84b61ec7b48674a76b6b3fc865675893b5d513ffc8196

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-4084403625-2215941253-1760665084-1000\_RECOVERY_+knsof.txt

Family

teslacrypt

Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with AES More information about the encryption keys using AES can be found here: http://en.wikipedia.org/wiki/AES How did this happen ? !!! Specially for your PC was generated personal AES KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/1B3EF3AC377E5BF8 2. http://tes543berda73i48fsdfsd.keratadze.at/1B3EF3AC377E5BF8 3. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/1B3EF3AC377E5BF8 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/1B3EF3AC377E5BF8 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/1B3EF3AC377E5BF8 http://tes543berda73i48fsdfsd.keratadze.at/1B3EF3AC377E5BF8 http://tt54rfdjhb34rfbnknaerg.milerteddy.com/1B3EF3AC377E5BF8 *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/1B3EF3AC377E5BF8
URLs

http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/1B3EF3AC377E5BF8

http://tes543berda73i48fsdfsd.keratadze.at/1B3EF3AC377E5BF8

http://tt54rfdjhb34rfbnknaerg.milerteddy.com/1B3EF3AC377E5BF8

http://xlowfznrg4wf7dli.ONION/1B3EF3AC377E5BF8

Targets

    • Target

      4daa27ed35b8f69d102fb1df910c9c30a890bb15e6fc8281ba8b348ed2a8ba39

    • Size

      383KB

    • MD5

      7a34c314dcb730e9d7b1fb74db78050f

    • SHA1

      af3ab8350547fba0a14bc2d6b8a315a2ec9d2986

    • SHA256

      4daa27ed35b8f69d102fb1df910c9c30a890bb15e6fc8281ba8b348ed2a8ba39

    • SHA512

      c08a4b74673a93841b328eb5aee31cf0ff1f786457a47cc5f00ea323ffd0b8e95be8e6ef0670c1ac5cc84b61ec7b48674a76b6b3fc865675893b5d513ffc8196

    • TeslaCrypt, AlphaCrypt

      Ransomware based on CryptoLocker. Shut down by the developers in 2016.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Executes dropped EXE

    • Deletes itself

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks