General
-
Target
5b689d04c37b221fb03e4957edc64bf3a8fa7762a42b5257a64ed86f9e182c4b
-
Size
383KB
-
Sample
220801-3yw36sbfdj
-
MD5
02a65851ad053ac7dcd6d5356b3f98a2
-
SHA1
86cbe36bb6c5e457af6f4e8612debed8fe705a6c
-
SHA256
5b689d04c37b221fb03e4957edc64bf3a8fa7762a42b5257a64ed86f9e182c4b
-
SHA512
5f7993a27a512cf469db62f45ffab7c30aaf9103549ddc2402e33ae5ea7cb144f1e8aa6515b85ca8ebc77d0825ed551a175cb0077f7bf4dad0ccf06cf93828bf
Static task
static1
Behavioral task
behavioral1
Sample
5b689d04c37b221fb03e4957edc64bf3a8fa7762a42b5257a64ed86f9e182c4b.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
5b689d04c37b221fb03e4957edc64bf3a8fa7762a42b5257a64ed86f9e182c4b.exe
Resource
win10v2004-20220722-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-3762437355-3468409815-1164039494-1000\_RECOVERY_+ujbxo.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/7D509FAA17B6159
http://tes543berda73i48fsdfsd.keratadze.at/7D509FAA17B6159
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/7D509FAA17B6159
http://xlowfznrg4wf7dli.ONION/7D509FAA17B6159
Targets
-
-
Target
5b689d04c37b221fb03e4957edc64bf3a8fa7762a42b5257a64ed86f9e182c4b
-
Size
383KB
-
MD5
02a65851ad053ac7dcd6d5356b3f98a2
-
SHA1
86cbe36bb6c5e457af6f4e8612debed8fe705a6c
-
SHA256
5b689d04c37b221fb03e4957edc64bf3a8fa7762a42b5257a64ed86f9e182c4b
-
SHA512
5f7993a27a512cf469db62f45ffab7c30aaf9103549ddc2402e33ae5ea7cb144f1e8aa6515b85ca8ebc77d0825ed551a175cb0077f7bf4dad0ccf06cf93828bf
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Deletes itself
-
Adds Run key to start application
-