General
-
Target
aa12de4a71b15bbb05551b86fd159d34b08372496ecdac8712e6130151f4b3bc
-
Size
314KB
-
Sample
221108-g5hy8sdgfj
-
MD5
08ed3a82b107e945abbdf43a03f7bf06
-
SHA1
c1413fe082a18a5b895c9c8ddebb3b684cb22dd8
-
SHA256
aa12de4a71b15bbb05551b86fd159d34b08372496ecdac8712e6130151f4b3bc
-
SHA512
07a126e3584a1c0ee88d2ea31b2062191854e006fe2443d3e9f76ceee97213aecfce036ff96b7c0a9fd3971580d216bb74afac551ebdbfe936438ba689180fce
-
SSDEEP
6144:IYmRAwCvZWJDQKTARjABxuPZvFSZVdWeLVgfksUQft+YJ:ISwUZDMyB8Xh0Ua1J
Static task
static1
Behavioral task
behavioral1
Sample
aa12de4a71b15bbb05551b86fd159d34b08372496ecdac8712e6130151f4b3bc.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
aa12de4a71b15bbb05551b86fd159d34b08372496ecdac8712e6130151f4b3bc.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-3845472200-3839195424-595303356-1000\_RECoVERY_+prrho.txt
teslacrypt
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/3ADDB11A68AD489E
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/3ADDB11A68AD489E
http://yyre45dbvn2nhbefbmh.begumvelic.at/3ADDB11A68AD489E
http://xlowfznrg4wf7dli.ONION/3ADDB11A68AD489E
Targets
-
-
Target
aa12de4a71b15bbb05551b86fd159d34b08372496ecdac8712e6130151f4b3bc
-
Size
314KB
-
MD5
08ed3a82b107e945abbdf43a03f7bf06
-
SHA1
c1413fe082a18a5b895c9c8ddebb3b684cb22dd8
-
SHA256
aa12de4a71b15bbb05551b86fd159d34b08372496ecdac8712e6130151f4b3bc
-
SHA512
07a126e3584a1c0ee88d2ea31b2062191854e006fe2443d3e9f76ceee97213aecfce036ff96b7c0a9fd3971580d216bb74afac551ebdbfe936438ba689180fce
-
SSDEEP
6144:IYmRAwCvZWJDQKTARjABxuPZvFSZVdWeLVgfksUQft+YJ:ISwUZDMyB8Xh0Ua1J
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Deletes itself
-
Adds Run key to start application
-