General
-
Target
VirusShare_1395f8b044ea3fe54765cdf4bf5d242a
-
Size
284KB
-
Sample
240607-wxt4vscg77
-
MD5
1395f8b044ea3fe54765cdf4bf5d242a
-
SHA1
a445159ac6d6730943e41f686e8c2a56620cec2e
-
SHA256
c233cf8660be3b2575a577e5077a61f2e22d7cbbc550aed839ad49bfba8c6e82
-
SHA512
56d5c14cbe7306181120d568ffb7541e6d749f87e2a6d87db5911b7abe2d885746eb5884c62fbb2a64cc1816128fc984df93d7fe9592e43babf973c111c1a614
-
SSDEEP
6144:nopeaNSNNhY8DMTyyEJTL7X2bCsUoZPZZG/bi1:geaNSNNtqqjECsZhSDi1
Static task
static1
Behavioral task
behavioral1
Sample
VirusShare_1395f8b044ea3fe54765cdf4bf5d242a.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
VirusShare_1395f8b044ea3fe54765cdf4bf5d242a.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_ReCoVeRy_+hhivu.txt
teslacrypt
http://po4dbsjbneljhrlbvaueqrgveatv.bonmawp.at/636FD9701DCCC823
http://u54bbnhf354fbkh254tbkhjbgy8258gnkwerg.tahaplap.com/636FD9701DCCC823
http://w6bfg4hahn5bfnlsafgchkvg5fwsfvrt.hareuna.at/636FD9701DCCC823
http://xlowfznrg4wf7dli.ONION/636FD9701DCCC823
Targets
-
-
Target
VirusShare_1395f8b044ea3fe54765cdf4bf5d242a
-
Size
284KB
-
MD5
1395f8b044ea3fe54765cdf4bf5d242a
-
SHA1
a445159ac6d6730943e41f686e8c2a56620cec2e
-
SHA256
c233cf8660be3b2575a577e5077a61f2e22d7cbbc550aed839ad49bfba8c6e82
-
SHA512
56d5c14cbe7306181120d568ffb7541e6d749f87e2a6d87db5911b7abe2d885746eb5884c62fbb2a64cc1816128fc984df93d7fe9592e43babf973c111c1a614
-
SSDEEP
6144:nopeaNSNNhY8DMTyyEJTL7X2bCsUoZPZZG/bi1:geaNSNNtqqjECsZhSDi1
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (436) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-