General
-
Target
a9401d52ba62b218245100c6343448040eac43934476fd1fc7c14dbc8f5a6185
-
Size
384KB
-
Sample
221108-qrdxssbggn
-
MD5
6eb1c8fb571684bd3d219b963fad3d6f
-
SHA1
b9205cd714e320fbac5f8c22171d40cc005a26ab
-
SHA256
a9401d52ba62b218245100c6343448040eac43934476fd1fc7c14dbc8f5a6185
-
SHA512
c65072e68066bf503ffae0605c56ecc86142c0d72cd14367a3c9237725ef2705b58d14f78abc31795d6fec691737a9562c8c48075ca6e3e614824be8b1278cde
-
SSDEEP
6144:5NcjGIJMerRAOEYIAZ6enYlFXENKtamXUIecJw+y9Mn8c8O0lb4oI:w1JfVaT7JlF00Rex9M13oI
Static task
static1
Behavioral task
behavioral1
Sample
a9401d52ba62b218245100c6343448040eac43934476fd1fc7c14dbc8f5a6185.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a9401d52ba62b218245100c6343448040eac43934476fd1fc7c14dbc8f5a6185.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-2292972927-2705560509-2768824231-1000\Recovery+xstrf.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/F663808E1B65445
http://tes543berda73i48fsdfsd.keratadze.at/F663808E1B65445
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/F663808E1B65445
http://xlowfznrg4wf7dli.ONION/F663808E1B65445
Targets
-
-
Target
a9401d52ba62b218245100c6343448040eac43934476fd1fc7c14dbc8f5a6185
-
Size
384KB
-
MD5
6eb1c8fb571684bd3d219b963fad3d6f
-
SHA1
b9205cd714e320fbac5f8c22171d40cc005a26ab
-
SHA256
a9401d52ba62b218245100c6343448040eac43934476fd1fc7c14dbc8f5a6185
-
SHA512
c65072e68066bf503ffae0605c56ecc86142c0d72cd14367a3c9237725ef2705b58d14f78abc31795d6fec691737a9562c8c48075ca6e3e614824be8b1278cde
-
SSDEEP
6144:5NcjGIJMerRAOEYIAZ6enYlFXENKtamXUIecJw+y9Mn8c8O0lb4oI:w1JfVaT7JlF00Rex9M13oI
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Deletes itself
-
Adds Run key to start application
-