General
-
Target
ac5c42f77dd51f56be243d86d57427f5078e145746998c8e7f4915660693e417
-
Size
337KB
-
Sample
221128-ppr6zahb4s
-
MD5
0f3a9ed6fba2a76230339962e6793346
-
SHA1
223426255758ef3f30f29fb813f542cc7fff44ea
-
SHA256
ac5c42f77dd51f56be243d86d57427f5078e145746998c8e7f4915660693e417
-
SHA512
d3c87fcbfcb98ab96b341c7eed041ad234c8155fac24b0c36a5fd6c905d4f1533994269fbd12651e228ae93815bae3e16e200f810412a36ede162caa4e0b9a05
-
SSDEEP
6144:LavYMc7shFjr9N/my+7Kojvkj+/LKgExnj4HDqLCXZtc:LavBc7sLjr9NC7XjD/LKRcDXXE
Static task
static1
Behavioral task
behavioral1
Sample
ac5c42f77dd51f56be243d86d57427f5078e145746998c8e7f4915660693e417.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ac5c42f77dd51f56be243d86d57427f5078e145746998c8e7f4915660693e417.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-3385717845-2518323428-350143044-1000\_RECoVERY_+nqeqh.txt
teslacrypt
http://yyre45dbvn2nhbefbmh.begumvelic.at/6B41D8B7CAD254A
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/6B41D8B7CAD254A
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/6B41D8B7CAD254A
http://xlowfznrg4wf7dli.ONION/6B41D8B7CAD254A
Targets
-
-
Target
ac5c42f77dd51f56be243d86d57427f5078e145746998c8e7f4915660693e417
-
Size
337KB
-
MD5
0f3a9ed6fba2a76230339962e6793346
-
SHA1
223426255758ef3f30f29fb813f542cc7fff44ea
-
SHA256
ac5c42f77dd51f56be243d86d57427f5078e145746998c8e7f4915660693e417
-
SHA512
d3c87fcbfcb98ab96b341c7eed041ad234c8155fac24b0c36a5fd6c905d4f1533994269fbd12651e228ae93815bae3e16e200f810412a36ede162caa4e0b9a05
-
SSDEEP
6144:LavYMc7shFjr9N/my+7Kojvkj+/LKgExnj4HDqLCXZtc:LavBc7sLjr9NC7XjD/LKRcDXXE
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Deletes itself
-
Adds Run key to start application
-