teslacrypt | 0d8bc17c404ab29dfcf670c90d29a695d49f7d437b6d84ee1478c7f4121dbda7

General

Target

cb28c211ca8292894f3eef43ce5a6cd4.bin
Size

122KB
Sample

230410-b96cfaee59
MD5

c9f4d97ae61ccc670d3804ec4970146c
SHA1

5a7857be62626661c02e92c33f71eca38f27d2ad
SHA256

0d8bc17c404ab29dfcf670c90d29a695d49f7d437b6d84ee1478c7f4121dbda7
SHA512

d43a8ac76ee04622de18a78391569223eb498aaa43b72fb245fa5f4ed182abd27168bfe48232dc23decf18cf5fd992eefb38887096b5d45bf89753926621037f
SSDEEP

3072:xg5QClwlWU38JzXX3Xkr5qSlF0ziq50mCUR0fuMXLVC:xgaC3jJzn+5X0+q5nCUR0fTVC

Score

10^/10

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_RECoVERY_+xbsgq.txt

Family

teslacrypt

Ransom Note

NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with AES More information about the encryption keys using AES can be found here: http://en.wikipedia.org/wiki/AES How did this happen ? !!! Specially for your PC was generated personal AES KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/334F503A21D7CA22 2. http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/334F503A21D7CA22 3. http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/334F503A21D7CA22 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/334F503A21D7CA22 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/334F503A21D7CA22 http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/334F503A21D7CA22 http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/334F503A21D7CA22 *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/334F503A21D7CA22

URLs

http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/334F503A21D7CA22

http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/334F503A21D7CA22

http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/334F503A21D7CA22

http://xlowfznrg4wf7dli.ONION/334F503A21D7CA22

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\_RECoVERY_+xbsgq.html

Ransom Note

NOT YOUR LANGUAGE? USE Google Translate What happened to your files? of your files were protected by a strong encryption with AES More information about the encryption AES can be found https://en.wikipedia.org/wiki/AES at does this mean? his means that the structure and data within your files have been irrevocably changed, you will not be able work with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them How did this happen? Especially for you, on our SERVER was generated the secret key All your files were encrypted with the public key, which has been transferred to your computer via the Internet. Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program which is on our Secret Server!!! at do I do? do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed If you really need your data, then we suggest you do not waste valuable time searching for other solutions becausen they do not exist. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1 - http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/334F503A21D7CA22 2 - http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/334F503A21D7CA22 3 - http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/334F503A21D7CA22 If for some reasons the addresses are not available, follow these steps: 1 - Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2 - After a successful installation, run the browser and wait for initialization. 3 - Type in the tor-browser address bar: xlowfznrg4wf7dli.onion/334F503A21D7CA22 4 - Follow the instructions on the site. !!! IMPORTANT INFORMATION: Your Personal PAGES : http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/334F503A21D7CA22 http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/334F503A21D7CA22 http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/334F503A21D7CA22 Your Personal TOR-Browser page : xlowfznrg4wf7dli.onion/334F503A21D7CA22 Your personal ID (if you open the site directly):

URLs

http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/334F503A21D7CA22

http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/334F503A21D7CA22

http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/334F503A21D7CA22

http://xlowfznrg4wf7dli.onion/334F503A21D7CA22

Extracted

Path

C:\PerfLogs\_RECoVERY_+hvbkb.txt

Family

teslacrypt

Ransom Note

NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with AES More information about the encryption keys using AES can be found here: http://en.wikipedia.org/wiki/AES How did this happen ? !!! Specially for your PC was generated personal AES KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/BE3D20CD9E77937F 2. http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/BE3D20CD9E77937F 3. http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/BE3D20CD9E77937F If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/BE3D20CD9E77937F 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/BE3D20CD9E77937F http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/BE3D20CD9E77937F http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/BE3D20CD9E77937F *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/BE3D20CD9E77937F

URLs

http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/BE3D20CD9E77937F

http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/BE3D20CD9E77937F

http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/BE3D20CD9E77937F

http://xlowfznrg4wf7dli.ONION/BE3D20CD9E77937F

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\_RECoVERY_+hvbkb.html

Ransom Note

NOT YOUR LANGUAGE? USE Google Translate What happened to your files? of your files were protected by a strong encryption with AES More information about the encryption AES can be found https://en.wikipedia.org/wiki/AES at does this mean? his means that the structure and data within your files have been irrevocably changed, you will not be able work with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them How did this happen? Especially for you, on our SERVER was generated the secret key All your files were encrypted with the public key, which has been transferred to your computer via the Internet. Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program which is on our Secret Server!!! at do I do? do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed If you really need your data, then we suggest you do not waste valuable time searching for other solutions becausen they do not exist. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1 - http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/BE3D20CD9E77937F 2 - http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/BE3D20CD9E77937F 3 - http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/BE3D20CD9E77937F If for some reasons the addresses are not available, follow these steps: 1 - Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2 - After a successful installation, run the browser and wait for initialization. 3 - Type in the tor-browser address bar: xlowfznrg4wf7dli.onion/BE3D20CD9E77937F 4 - Follow the instructions on the site. !!! IMPORTANT INFORMATION: Your Personal PAGES : http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/BE3D20CD9E77937F http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/BE3D20CD9E77937F http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/BE3D20CD9E77937F Your Personal TOR-Browser page : xlowfznrg4wf7dli.onion/BE3D20CD9E77937F Your personal ID (if you open the site directly):

URLs

http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/BE3D20CD9E77937F

http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/BE3D20CD9E77937F

http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/BE3D20CD9E77937F

http://xlowfznrg4wf7dli.onion/BE3D20CD9E77937F

Targets

- Target
  
  87feca94fc02b098be787060da09fc6f6473221ddf4aaa2f19321db3de256c0d.exe
- Size
  
  692KB
- MD5
  
  cb28c211ca8292894f3eef43ce5a6cd4
- SHA1
  
  70e0bc5fce5534e6dbe5200d9c965c925b596ee3
- SHA256
  
  87feca94fc02b098be787060da09fc6f6473221ddf4aaa2f19321db3de256c0d
- SHA512
  
  b56c612e389f7b58218a2e66a66bddea55425ed5f99a22921e2a16b2a65ca415f0dc39fbe7c88fffe082ab4bc27923dcea652396cc922d06fd82baea76b356bd
- SSDEEP
  
  3072:UkmGgnjAYn2Fj5ohpzBovjtALLXOixtjOQ0hV09ZIR5YkHk7wELOhr1DwTTRpAe:g6mLD1OQW094YkHk7wsO7wPXAe
Score

10^/10

teslacrypt persistence ransomware spyware stealer
- TeslaCrypt, AlphaCrypt
  Ransomware based on CryptoLocker. Shut down by the developers in 2016.
  ransomware teslacrypt
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2