teslacrypt | 5caafc32f56e19289b2668cf28ff7f2b73b01ecaa6ab8500850fa8618b59e0df

General

Target

5caafc32f56e19289b2668cf28ff7f2b73b01ecaa6ab8500850fa8618b59e0df
Size

356KB
Sample

220801-gdc9nscbd6
MD5

831b9546c2de09e223f29dc01e6c1e12
SHA1

c222fda0c29096b9d5356e010d830e8217ac845f
SHA256

5caafc32f56e19289b2668cf28ff7f2b73b01ecaa6ab8500850fa8618b59e0df
SHA512

3cd8e7978c4462a8f342623415a31c07151360be29fcab37482f6accd33d6ae9dff9b9654afa036328fb6b61fbfa87f5fcef0ecf9815f01d6ae497b393491b27

Score

10^/10

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-3440072777-2118400376-1759599358-1000\Recovery+kowce.txt

Family

teslacrypt

Ransom Note

NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with AES More information about the encryption keys using AES can be found here: http://en.wikipedia.org/wiki/AES How did this happen ? !!! Specially for your PC was generated personal AES KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/174627B83598AE4A 2. http://tes543berda73i48fsdfsd.keratadze.at/174627B83598AE4A 3. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/174627B83598AE4A If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/174627B83598AE4A 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/174627B83598AE4A http://tes543berda73i48fsdfsd.keratadze.at/174627B83598AE4A http://tt54rfdjhb34rfbnknaerg.milerteddy.com/174627B83598AE4A *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/174627B83598AE4A

URLs

http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/174627B83598AE4A

http://tes543berda73i48fsdfsd.keratadze.at/174627B83598AE4A

http://tt54rfdjhb34rfbnknaerg.milerteddy.com/174627B83598AE4A

http://xlowfznrg4wf7dli.ONION/174627B83598AE4A

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-2660308776-3705150086-26593515-1000\Recovery+hydtd.txt

Family

teslacrypt

Ransom Note

NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with AES More information about the encryption keys using AES can be found here: http://en.wikipedia.org/wiki/AES How did this happen ? !!! Specially for your PC was generated personal AES KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/F27D7514319ED41 2. http://tes543berda73i48fsdfsd.keratadze.at/F27D7514319ED41 3. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/F27D7514319ED41 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/F27D7514319ED41 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/F27D7514319ED41 http://tes543berda73i48fsdfsd.keratadze.at/F27D7514319ED41 http://tt54rfdjhb34rfbnknaerg.milerteddy.com/F27D7514319ED41 *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/F27D7514319ED41

URLs

http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/F27D7514319ED41

http://tes543berda73i48fsdfsd.keratadze.at/F27D7514319ED41

http://tt54rfdjhb34rfbnknaerg.milerteddy.com/F27D7514319ED41

http://xlowfznrg4wf7dli.ONION/F27D7514319ED41

Targets

- Target
  
  5caafc32f56e19289b2668cf28ff7f2b73b01ecaa6ab8500850fa8618b59e0df
- Size
  
  356KB
- MD5
  
  831b9546c2de09e223f29dc01e6c1e12
- SHA1
  
  c222fda0c29096b9d5356e010d830e8217ac845f
- SHA256
  
  5caafc32f56e19289b2668cf28ff7f2b73b01ecaa6ab8500850fa8618b59e0df
- SHA512
  
  3cd8e7978c4462a8f342623415a31c07151360be29fcab37482f6accd33d6ae9dff9b9654afa036328fb6b61fbfa87f5fcef0ecf9815f01d6ae497b393491b27
Score

10^/10

teslacrypt persistence ransomware spyware stealer
- TeslaCrypt, AlphaCrypt
  Ransomware based on CryptoLocker. Shut down by the developers in 2016.
  ransomware teslacrypt
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2