General
-
Target
ac1314165b1c5d065bfe19fc4fc9b411b3af9f3a3e74661ada6d53770fc49ee6
-
Size
335KB
-
Sample
221124-cyj6habe88
-
MD5
4bc90d148fe634b9d87bcdb7e67d7f8d
-
SHA1
3e706aaae73d985282d638b03b48be6f8f447981
-
SHA256
ac1314165b1c5d065bfe19fc4fc9b411b3af9f3a3e74661ada6d53770fc49ee6
-
SHA512
a25c43f2096ed8516cc33940723d69e1eb366c030cb1f88823518113a4c39ab9dcbde2168029405dc7208c6ac7c9ae3016871a53c23df2d0d7af64ccacc3e10c
-
SSDEEP
6144:3MlhTEzkFxLyQb7kmp76NYsYRnZa0dIa4Scb0a/8MH9CC4l:3MlhZFxVb7kIfsgxl4Nw+f9Dy
Static task
static1
Behavioral task
behavioral1
Sample
ac1314165b1c5d065bfe19fc4fc9b411b3af9f3a3e74661ada6d53770fc49ee6.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ac1314165b1c5d065bfe19fc4fc9b411b3af9f3a3e74661ada6d53770fc49ee6.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-3406023954-474543476-3319432036-1000\_RECoVERY_+lcrvi.txt
teslacrypt
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/C231C5B02BC6A373
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/C231C5B02BC6A373
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/C231C5B02BC6A373
http://xlowfznrg4wf7dli.ONION/C231C5B02BC6A373
Targets
-
-
Target
ac1314165b1c5d065bfe19fc4fc9b411b3af9f3a3e74661ada6d53770fc49ee6
-
Size
335KB
-
MD5
4bc90d148fe634b9d87bcdb7e67d7f8d
-
SHA1
3e706aaae73d985282d638b03b48be6f8f447981
-
SHA256
ac1314165b1c5d065bfe19fc4fc9b411b3af9f3a3e74661ada6d53770fc49ee6
-
SHA512
a25c43f2096ed8516cc33940723d69e1eb366c030cb1f88823518113a4c39ab9dcbde2168029405dc7208c6ac7c9ae3016871a53c23df2d0d7af64ccacc3e10c
-
SSDEEP
6144:3MlhTEzkFxLyQb7kmp76NYsYRnZa0dIa4Scb0a/8MH9CC4l:3MlhZFxVb7kIfsgxl4Nw+f9Dy
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Deletes itself
-
Adds Run key to start application
-