General
-
Target
af80390a5d4d6865fd652c1ba81e4c4c8f34cc135d028d70975eaa9453eb45cc
-
Size
326KB
-
Sample
221204-l1zteahb46
-
MD5
3736b5e8d91e93799aa194a63669ba4f
-
SHA1
2630a0c95d8f4234b5d53469d8a075a6266c7756
-
SHA256
af80390a5d4d6865fd652c1ba81e4c4c8f34cc135d028d70975eaa9453eb45cc
-
SHA512
49bc5a501904be65e44a256efd51276dc31153b76ee83476a5b724c87c554c651f178a5ea5e70f7391a8edfff5f20085306982c7be64e21076bdb64696f2dc6c
-
SSDEEP
6144:P33tj8BBIQq3JuCPBz9OzbO41XW+hHntnyVg/ucTM6ZkK5:P3dj2q3gUcb/cCntyVgGc115
Static task
static1
Behavioral task
behavioral1
Sample
af80390a5d4d6865fd652c1ba81e4c4c8f34cc135d028d70975eaa9453eb45cc.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
af80390a5d4d6865fd652c1ba81e4c4c8f34cc135d028d70975eaa9453eb45cc.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-3385717845-2518323428-350143044-1000\_ReCoVeRy_+ethcb.txt
teslacrypt
http://po4dbsjbneljhrlbvaueqrgveatv.bonmawp.at/3B2E44785F28FD73
http://u54bbnhf354fbkh254tbkhjbgy8258gnkwerg.tahaplap.com/3B2E44785F28FD73
http://w6bfg4hahn5bfnlsafgchkvg5fwsfvrt.hareuna.at/3B2E44785F28FD73
http://xlowfznrg4wf7dli.ONION/3B2E44785F28FD73
Targets
-
-
Target
af80390a5d4d6865fd652c1ba81e4c4c8f34cc135d028d70975eaa9453eb45cc
-
Size
326KB
-
MD5
3736b5e8d91e93799aa194a63669ba4f
-
SHA1
2630a0c95d8f4234b5d53469d8a075a6266c7756
-
SHA256
af80390a5d4d6865fd652c1ba81e4c4c8f34cc135d028d70975eaa9453eb45cc
-
SHA512
49bc5a501904be65e44a256efd51276dc31153b76ee83476a5b724c87c554c651f178a5ea5e70f7391a8edfff5f20085306982c7be64e21076bdb64696f2dc6c
-
SSDEEP
6144:P33tj8BBIQq3JuCPBz9OzbO41XW+hHntnyVg/ucTM6ZkK5:P3dj2q3gUcb/cCntyVgGc115
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Deletes itself
-
Adds Run key to start application
-