General
-
Target
4daa27ed35b8f69d102fb1df910c9c30a890bb15e6fc8281ba8b348ed2a8ba39
-
Size
383KB
-
Sample
220720-y56tqshha9
-
MD5
7a34c314dcb730e9d7b1fb74db78050f
-
SHA1
af3ab8350547fba0a14bc2d6b8a315a2ec9d2986
-
SHA256
4daa27ed35b8f69d102fb1df910c9c30a890bb15e6fc8281ba8b348ed2a8ba39
-
SHA512
c08a4b74673a93841b328eb5aee31cf0ff1f786457a47cc5f00ea323ffd0b8e95be8e6ef0670c1ac5cc84b61ec7b48674a76b6b3fc865675893b5d513ffc8196
Static task
static1
Behavioral task
behavioral1
Sample
4daa27ed35b8f69d102fb1df910c9c30a890bb15e6fc8281ba8b348ed2a8ba39.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
4daa27ed35b8f69d102fb1df910c9c30a890bb15e6fc8281ba8b348ed2a8ba39.exe
Resource
win10v2004-20220718-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-4084403625-2215941253-1760665084-1000\_RECOVERY_+knsof.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/1B3EF3AC377E5BF8
http://tes543berda73i48fsdfsd.keratadze.at/1B3EF3AC377E5BF8
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/1B3EF3AC377E5BF8
http://xlowfznrg4wf7dli.ONION/1B3EF3AC377E5BF8
Targets
-
-
Target
4daa27ed35b8f69d102fb1df910c9c30a890bb15e6fc8281ba8b348ed2a8ba39
-
Size
383KB
-
MD5
7a34c314dcb730e9d7b1fb74db78050f
-
SHA1
af3ab8350547fba0a14bc2d6b8a315a2ec9d2986
-
SHA256
4daa27ed35b8f69d102fb1df910c9c30a890bb15e6fc8281ba8b348ed2a8ba39
-
SHA512
c08a4b74673a93841b328eb5aee31cf0ff1f786457a47cc5f00ea323ffd0b8e95be8e6ef0670c1ac5cc84b61ec7b48674a76b6b3fc865675893b5d513ffc8196
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Deletes itself
-
Adds Run key to start application
-