General
-
Target
5797a4ccbf6e1e24fa85c7b514d82aff6b3774dfd8240efb8f00db61ab0ece1b
-
Size
383KB
-
Sample
220724-z84n8ahban
-
MD5
0ba94ab085f772674ff7593671403d88
-
SHA1
72f4a7ae63b12e3383f68f0a1f1e4f0097a9a6dd
-
SHA256
5797a4ccbf6e1e24fa85c7b514d82aff6b3774dfd8240efb8f00db61ab0ece1b
-
SHA512
ca84d0c550a51bc28e9bd8cb21093acd929ea901d8fd3b5d1c80a172b799b1f75c9d002e8996d0c8e5dabe2cc3a733a3ec546a7b58457049ef703da825776fa6
Static task
static1
Behavioral task
behavioral1
Sample
5797a4ccbf6e1e24fa85c7b514d82aff6b3774dfd8240efb8f00db61ab0ece1b.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
5797a4ccbf6e1e24fa85c7b514d82aff6b3774dfd8240efb8f00db61ab0ece1b.exe
Resource
win10v2004-20220721-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-3762437355-3468409815-1164039494-1000\_RECOVERY_+ppfte.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/8042A3293EEFFFF1
http://tes543berda73i48fsdfsd.keratadze.at/8042A3293EEFFFF1
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/8042A3293EEFFFF1
http://xlowfznrg4wf7dli.ONION/8042A3293EEFFFF1
Targets
-
-
Target
5797a4ccbf6e1e24fa85c7b514d82aff6b3774dfd8240efb8f00db61ab0ece1b
-
Size
383KB
-
MD5
0ba94ab085f772674ff7593671403d88
-
SHA1
72f4a7ae63b12e3383f68f0a1f1e4f0097a9a6dd
-
SHA256
5797a4ccbf6e1e24fa85c7b514d82aff6b3774dfd8240efb8f00db61ab0ece1b
-
SHA512
ca84d0c550a51bc28e9bd8cb21093acd929ea901d8fd3b5d1c80a172b799b1f75c9d002e8996d0c8e5dabe2cc3a733a3ec546a7b58457049ef703da825776fa6
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
-
Executes dropped EXE
-
Deletes itself
-
Adds Run key to start application
-