General
-
Target
5df4db52ca894e079e4eac651ade8a58ee298e5759c5d0cfd190a9aa6cc9d7d0
-
Size
252KB
-
Sample
220731-1r2nzahhc2
-
MD5
40db84f7864d7d963420b832ae894873
-
SHA1
ecf5efe4bd6624cfde62500d9d2af95d00caca59
-
SHA256
5df4db52ca894e079e4eac651ade8a58ee298e5759c5d0cfd190a9aa6cc9d7d0
-
SHA512
2e18b2757ced8fcfc4ee8a6b5bab4bccfb81b07a0cd6ef3c4dcf31a1fc35accc1e66043387f32f0354481b4ea9a42d103d01d9fb4f1ca408d9ae794d9000f09a
Static task
static1
Behavioral task
behavioral1
Sample
5df4db52ca894e079e4eac651ade8a58ee298e5759c5d0cfd190a9aa6cc9d7d0.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
5df4db52ca894e079e4eac651ade8a58ee298e5759c5d0cfd190a9aa6cc9d7d0.exe
Resource
win10v2004-20220721-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-4084403625-2215941253-1760665084-1000\_RECOVERY_+hqpod.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/6FB6F320F91A1021
http://tes543berda73i48fsdfsd.keratadze.at/6FB6F320F91A1021
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/6FB6F320F91A1021
http://xlowfznrg4wf7dli.ONION/6FB6F320F91A1021
Targets
-
-
Target
5df4db52ca894e079e4eac651ade8a58ee298e5759c5d0cfd190a9aa6cc9d7d0
-
Size
252KB
-
MD5
40db84f7864d7d963420b832ae894873
-
SHA1
ecf5efe4bd6624cfde62500d9d2af95d00caca59
-
SHA256
5df4db52ca894e079e4eac651ade8a58ee298e5759c5d0cfd190a9aa6cc9d7d0
-
SHA512
2e18b2757ced8fcfc4ee8a6b5bab4bccfb81b07a0cd6ef3c4dcf31a1fc35accc1e66043387f32f0354481b4ea9a42d103d01d9fb4f1ca408d9ae794d9000f09a
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Deletes itself
-
Drops startup file
-
Adds Run key to start application
-