General
-
Target
aa3c96864225818340d549f429f9be3a474b94fafe19ec191e253dff358eabf1
-
Size
335KB
-
Sample
221108-ff4zqsghc4
-
MD5
4ba3b368b7a30eec7084a087460cd4a5
-
SHA1
209abbe07dfa54439f93bfd1092006bcaa5dd83b
-
SHA256
aa3c96864225818340d549f429f9be3a474b94fafe19ec191e253dff358eabf1
-
SHA512
f9e07f1e4809e6406804d6842b0a090d7dc30ce0679d5c4264cd15d11033e4235e1ecec30a9832f57aa6d1fa9273fb75d16b763944f416526a18112219d23332
-
SSDEEP
6144:cMlhTEzkFxLyQb7kmp76NYsYRnZa0dIa4Scb0a/8MH9CC4l:cMlhZFxVb7kIfsgxl4Nw+f9Dy
Static task
static1
Behavioral task
behavioral1
Sample
aa3c96864225818340d549f429f9be3a474b94fafe19ec191e253dff358eabf1.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
aa3c96864225818340d549f429f9be3a474b94fafe19ec191e253dff358eabf1.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-2292972927-2705560509-2768824231-1000\_RECoVERY_+ufvyl.txt
teslacrypt
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/D78898589F841FE
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/D78898589F841FE
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/D78898589F841FE
http://xlowfznrg4wf7dli.ONION/D78898589F841FE
Targets
-
-
Target
aa3c96864225818340d549f429f9be3a474b94fafe19ec191e253dff358eabf1
-
Size
335KB
-
MD5
4ba3b368b7a30eec7084a087460cd4a5
-
SHA1
209abbe07dfa54439f93bfd1092006bcaa5dd83b
-
SHA256
aa3c96864225818340d549f429f9be3a474b94fafe19ec191e253dff358eabf1
-
SHA512
f9e07f1e4809e6406804d6842b0a090d7dc30ce0679d5c4264cd15d11033e4235e1ecec30a9832f57aa6d1fa9273fb75d16b763944f416526a18112219d23332
-
SSDEEP
6144:cMlhTEzkFxLyQb7kmp76NYsYRnZa0dIa4Scb0a/8MH9CC4l:cMlhZFxVb7kIfsgxl4Nw+f9Dy
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Deletes itself
-
Adds Run key to start application
-