General
-
Target
aa84b63461017011dfc0d585660e548d21e98840aaf48a487c0fc884a1b677f2
-
Size
252KB
-
Sample
221108-cpawgacag3
-
MD5
5049b9f88f0817e6de0ff42ad195f085
-
SHA1
2a4075d7da5eb3cef6cd7a0ca27f7eb7e652d2cd
-
SHA256
aa84b63461017011dfc0d585660e548d21e98840aaf48a487c0fc884a1b677f2
-
SHA512
5cec52be80a5385c34865e4dd89c22c112c088b6b6a5fb9d17ebf226d23709cf6f18750945a876306468dc704a725462e6d35a9ca1eaf421f912857f7984c64c
-
SSDEEP
6144:N4GdVmoxZi7SVeEiDmC9WRkdnUGO354aFF0grPTmc0Nt/e1bPMmK:NLZ+eHC9KkhUGg42FpTUhe1w
Static task
static1
Behavioral task
behavioral1
Sample
aa84b63461017011dfc0d585660e548d21e98840aaf48a487c0fc884a1b677f2.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
aa84b63461017011dfc0d585660e548d21e98840aaf48a487c0fc884a1b677f2.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-3845472200-3839195424-595303356-1000\_RECOVERY_+cpefk.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/CBF4C758F6142AA
http://tes543berda73i48fsdfsd.keratadze.at/CBF4C758F6142AA
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/CBF4C758F6142AA
http://xlowfznrg4wf7dli.ONION/CBF4C758F6142AA
Targets
-
-
Target
aa84b63461017011dfc0d585660e548d21e98840aaf48a487c0fc884a1b677f2
-
Size
252KB
-
MD5
5049b9f88f0817e6de0ff42ad195f085
-
SHA1
2a4075d7da5eb3cef6cd7a0ca27f7eb7e652d2cd
-
SHA256
aa84b63461017011dfc0d585660e548d21e98840aaf48a487c0fc884a1b677f2
-
SHA512
5cec52be80a5385c34865e4dd89c22c112c088b6b6a5fb9d17ebf226d23709cf6f18750945a876306468dc704a725462e6d35a9ca1eaf421f912857f7984c64c
-
SSDEEP
6144:N4GdVmoxZi7SVeEiDmC9WRkdnUGO354aFF0grPTmc0Nt/e1bPMmK:NLZ+eHC9KkhUGg42FpTUhe1w
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Deletes itself
-
Adds Run key to start application
-