General
-
Target
5f5b2501b23fd3efceffa161bb51b9721a10f583e85e10a287faa170d847e1cc
-
Size
342KB
-
Sample
220731-pemthagdbk
-
MD5
1363011ce43fdadbff9360a2e2716731
-
SHA1
d980ddf282aa7170c38caaa4fe73d05cf04d9fe6
-
SHA256
5f5b2501b23fd3efceffa161bb51b9721a10f583e85e10a287faa170d847e1cc
-
SHA512
355c654a7226f6c68367f0ede1f294d84f5f2d8b70757c9c0b20546589971b5534d67b0a99360acca7d5a0251aca0339b55226e859d5d53637a5491533072feb
Static task
static1
Behavioral task
behavioral1
Sample
5f5b2501b23fd3efceffa161bb51b9721a10f583e85e10a287faa170d847e1cc.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
5f5b2501b23fd3efceffa161bb51b9721a10f583e85e10a287faa170d847e1cc.exe
Resource
win10v2004-20220722-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-4084403625-2215941253-1760665084-1000\Recovery+dnmsb.txt
teslacrypt
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/C683CCD3C5648DB
http://kkd47eh4hdjshb5t.angortra.at/C683CCD3C5648DB
http://ytrest84y5i456hghadefdsd.pontogrot.com/C683CCD3C5648DB
http://xlowfznrg4wf7dli.ONION/C683CCD3C5648DB
Targets
-
-
Target
5f5b2501b23fd3efceffa161bb51b9721a10f583e85e10a287faa170d847e1cc
-
Size
342KB
-
MD5
1363011ce43fdadbff9360a2e2716731
-
SHA1
d980ddf282aa7170c38caaa4fe73d05cf04d9fe6
-
SHA256
5f5b2501b23fd3efceffa161bb51b9721a10f583e85e10a287faa170d847e1cc
-
SHA512
355c654a7226f6c68367f0ede1f294d84f5f2d8b70757c9c0b20546589971b5534d67b0a99360acca7d5a0251aca0339b55226e859d5d53637a5491533072feb
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Deletes itself
-
Adds Run key to start application
-