Ransomware.TeslaCrypt.zip
- SHA256 3b246faa7e4b2a8550aa619f4da893db83721aacf62b46e5863644a5249aa87e
Password
infected
Overview
overview
10Static
static
33372c1edab...70.exe
windows7-x64
93372c1edab...70.exe
windows10-ltsc 2021-x64
93372c1edab...70.exe
windows11-21h2-x64
951B4EF5DC9...67.exe
windows7-x64
1051B4EF5DC9...67.exe
windows10-ltsc 2021-x64
351B4EF5DC9...67.exe
windows11-21h2-x64
3E906FA3D51...56.exe
windows7-x64
10E906FA3D51...56.exe
windows10-ltsc 2021-x64
4E906FA3D51...56.exe
windows11-21h2-x64
6Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3372c1edab46837f1e973164fa2d726c5c5e17bcb888828ccd7c4dfcc234a370.exe
Resource
win7-20241010-en
windows7-x64
24 signatures
1200 seconds
Behavioral task
behavioral2
Sample
3372c1edab46837f1e973164fa2d726c5c5e17bcb888828ccd7c4dfcc234a370.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
18 signatures
1200 seconds
Behavioral task
behavioral3
Sample
3372c1edab46837f1e973164fa2d726c5c5e17bcb888828ccd7c4dfcc234a370.exe
Resource
win11-20241023-en
windows11-21h2-x64
20 signatures
1200 seconds
Behavioral task
behavioral4
Sample
51B4EF5DC9D26B7A26E214CEE90598631E2EAA67.exe
Resource
win7-20240903-en
windows7-x64
22 signatures
1200 seconds
Behavioral task
behavioral5
Sample
51B4EF5DC9D26B7A26E214CEE90598631E2EAA67.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
2 signatures
1200 seconds
Behavioral task
behavioral6
Sample
51B4EF5DC9D26B7A26E214CEE90598631E2EAA67.exe
Resource
win11-20241007-en
windows11-21h2-x64
2 signatures
1200 seconds
Behavioral task
behavioral7
Sample
E906FA3D51E86A61741B3499145A114E9BFB7C56.exe
Resource
win7-20240903-en
windows7-x64
22 signatures
1200 seconds
Behavioral task
behavioral8
Sample
E906FA3D51E86A61741B3499145A114E9BFB7C56.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
5 signatures
1200 seconds
Behavioral task
behavioral9
Sample
E906FA3D51E86A61741B3499145A114E9BFB7C56.exe
Resource
win11-20241007-en
windows11-21h2-x64
6 signatures
1200 seconds
General
- Target Ransomware.TeslaCrypt.zip
- Size 479KB
- Sample241114-gd6afsymem
- SHA256 3b246faa7e4b2a8550aa619f4da893db83721aacf62b46e5863644a5249aa87e
- MD5 f755a44bbb97e9ba70bf38f1bdc67722
- SHA1 f70331eb64fd893047f263623ffb1e74e6fe4187
- SHA512 f8ce666ae273e6c5cd57447189a8cf0e53c7704cf269fa120068f21e6faf6c89e2e75f37aee43cac83f4534790c5c6f1827621684034ef3eb7e94d7ee1ac365e
- SSDEEP 6144:xQAq0svy/pQhk1NBePvxGNWeOyqYAGfr/H/h60BHtzbprAvNGTG/fi5QCIq3h11Z:LyKoUlWeOP8HXrINZ/2uJUgVu
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/3372c1edab46837f1e973164fa2d726c5c5e17bcb888828ccd7c4dfcc234a370 unpack001/51B4EF5DC9D26B7A26E214CEE90598631E2EAA67 unpack001/E906FA3D51E86A61741B3499145A114E9BFB7C56
File Explorer
-
Ransomware.TeslaCrypt.zip.zip 479KB
-
3372c1edab46837f1e973164fa2d726c5c5e17bcb888828ccd7c4dfcc234a370.exe 284KB
-
51B4EF5DC9D26B7A26E214CEE90598631E2EAA67.exe 257KB
-
E906FA3D51E86A61741B3499145A114E9BFB7C56.exe 261KB
3372c1edab46837f1e973164fa2d726c5c5e17bcb888828ccd7c4dfcc234a370
- IMPHASH 41bde7e296ed20c37e477bd256a1b6dc
- SHA256 3372c1edab46837f1e973164fa2d726c5c5e17bcb888828ccd7c4dfcc234a370
- MD5 209a288c68207d57e0ce6e60ebf60729
- SHA1 e654d39cd13414b5151e8cf0d8f5b166dddd45cb
- SHA512 ce4a7e42738154183fc53702f0841dfd4ad1eb0567b13cc1ff0909f1d330e9cd2fb994375efc6f02e7eddaaae1f465ff93458412143266afdaff1c6bf6477fc3
- SSDEEP 3072:rYXT8PUsMNL8V4tD2My/JAAbQoM29wlV58lbNnolY7VgsYiVTPtiTu/q:rowUsML8g2j0o9wb0bNoaKsYImui
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
153505
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
shlwapi
PathFindFileNameW
psapi
EnumProcesses
GetProcessImageFileNameW
msimg32
GradientFill
kernel32
GetLogicalDriveStringsW
CreateProcessA
CreateThread
GetLastError
GlobalUnlock
GlobalLock
GlobalAlloc
LocalFree
LocalAlloc
GetCurrentProcess
SetLastError
GetEnvironmentVariableW
lstrcatW
lstrcpyW
GetShortPathNameW
GetModuleFileNameW
lstrlenW
Sleep
TerminateProcess
OpenProcess
GetCurrentProcessId
GetModuleHandleW
CreateProcessW
CopyFileW
GetFullPathNameW
LoadLibraryW
AllocConsole
GetVersionExW
CreateMutexW
GetSystemInfo
GetTickCount
QueryPerformanceCounter
GlobalMemoryStatus
FreeLibrary
GetProcAddress
GetDriveTypeW
GetStringTypeW
GetStringTypeA
HeapSize
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
LoadLibraryA
InitializeCriticalSection
GetCommandLineW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
LCMapStringW
LCMapStringA
GetOEMCP
GetACP
GetCPInfo
GetStartupInfoA
GetFileType
SetHandleCount
FlushFileBuffers
MultiByteToWideChar
InterlockedDecrement
GetCurrentThreadId
InterlockedIncrement
TlsFree
TlsSetValue
ExitThread
FindFirstFileW
FindNextFileW
FindClose
DeleteFileW
CreateFileW
GetFileSize
CloseHandle
ReadFile
SetFilePointer
WriteFile
MoveFileW
GetSystemTimeAsFileTime
GetLocalTime
CreateFileA
SetEndOfFile
GetLocaleInfoA
TlsAlloc
TlsGetValue
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
GetModuleFileNameA
GetStdHandle
ExitProcess
GetModuleHandleA
VirtualAlloc
DeleteCriticalSection
VirtualFree
HeapCreate
HeapDestroy
GetStartupInfoW
HeapFree
HeapAlloc
HeapReAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
GetVersionExA
GetProcessHeap
user32
CloseClipboard
PostMessageW
SetClipboardData
EmptyClipboard
LoadCursorW
GetMessageW
TranslateMessage
DispatchMessageW
RegisterClassExW
ShowWindow
PostQuitMessage
EnableWindow
DefWindowProcW
UpdateWindow
SendMessageW
PtInRect
SetCursor
DrawIconEx
OpenClipboard
EnableMenuItem
LookupIconIdFromDirectoryEx
CreateIconFromResourceEx
DialogBoxIndirectParamW
BeginPaint
EndPaint
DestroyWindow
EndDialog
GetWindowTextA
MessageBoxW
CreateWindowExW
GetDC
ReleaseDC
SystemParametersInfoW
GetClientRect
DrawTextW
GetSystemMenu
gdi32
RoundRect
GetDIBits
CreateCompatibleDC
SetBkMode
SetTextColor
DeleteDC
CreateFontW
SelectObject
GetStockObject
DeleteObject
CreateCompatibleBitmap
advapi32
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
OpenProcessToken
GetTokenInformation
GetSidSubAuthority
shell32
SHGetFolderPathW
ShellExecuteW
ShellExecuteA
ShellExecuteExW
ole32
CoInitializeEx
CoCreateInstance
wininet
InternetCloseHandle
InternetReadFile
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetSetCookieW
InternetOpenA
Name
.text
Size
216KB
Virtual Size
214KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
32KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
28KB
Virtual Size
108KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
852B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=27, id=125, productName=VS2005 build 50727, version=50727,
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=204, id=1, productName=Unmarked objects,
count=23, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=65, id=110, productName=VS2005 build 50727, version=50727,
count=1, productName=Unmarked objects (old),
count=194, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
51B4EF5DC9D26B7A26E214CEE90598631E2EAA67
- IMPHASH 5656329acd9893a7babdc7ca571a6139
- SHA256 9b462800f1bef019d7ec00098682d3ea7fc60e6721555f616399228e4e3ad122
- MD5 6e080aa085293bb9fbdcc9015337d309
- SHA1 51b4ef5dc9d26b7a26e214cee90598631e2eaa67
- SHA512 4e173fb5287c7ea8ff116099ec1a0599b37f743f8b798368319b5960af38e742124223dfd209457665b701e9efc6e76071fa2513322b232ac50ddad21fcebe77
- SSDEEP 6144:xy+als+0nIycigV5cbEo6dZbBODPIsjQ/UFsYW:xy+aCFnIycigVSbObBODTMUd
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4800
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
CreateProcessW
DeleteCriticalSection
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileA
FindNextFileA
FindResourceW
GetCommandLineA
GetCommandLineW
GetLastError
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GetThreadContext
InitializeCriticalSection
InterlockedExchange
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LoadResource
LockResource
MultiByteToWideChar
SetUnhandledExceptionFilter
SizeofResource
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WideCharToMultiByte
msvcrt
_strdup
_stricoll
__getmainargs
__mb_cur_max
__p__environ
__p__fmode
__set_app_type
_cexit
_errno
_fullpath
_iob
_onexit
_setmode
abort
atexit
atoi
calloc
exit
fputc
free
fwrite
getenv
isspace
localeconv
malloc
mbstowcs
memcpy
realloc
setlocale
signal
sprintf
strchr
strcoll
strlen
tolower
vfprintf
wcslen
wcstombs
shell32
CommandLineToArgvW
Name
.text
Size
38KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.eh_fram
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
190KB
Virtual Size
189KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
E906FA3D51E86A61741B3499145A114E9BFB7C56
- IMPHASH 99bff35f43bcff8998b2001d6df68577
- SHA256 afaba2400552c7032a5c4c6e6151df374d0e98dc67204066281e30e6699dbd18
- MD5 6d3d62a4cff19b4f2cc7ce9027c33be8
- SHA1 e906fa3d51e86a61741b3499145a114e9bfb7c56
- SHA512 973643639cb02491b86d5b264ee8118a67d8a83453307aea95de2f4c6aa55819d37730c41dc3338116ebe86f9a4f2bba7d9537ea744ae08b9755f05c15153fad
- SSDEEP 6144:93g0BQG+aZiycigV5bbEo6dZbBODPIsjQ/UFsYWo:93g0OGjZiycigVRbObBODTMUdj
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4800
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
gdi32
DeleteObject
GetStockObject
kernel32
CreateProcessW
DeleteCriticalSection
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileA
FindNextFileA
FindResourceW
GetCommandLineA
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
GetStartupInfoA
InitializeCriticalSection
InterlockedExchange
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LoadResource
MultiByteToWideChar
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WideCharToMultiByte
msvcrt
_strdup
_stricoll
__getmainargs
__mb_cur_max
__p__environ
__p__fmode
__set_app_type
_cexit
_errno
_fullpath
_iob
_onexit
_setmode
abort
atexit
atoi
calloc
exit
fputc
free
fwrite
getenv
isspace
localeconv
malloc
mbstowcs
memcpy
realloc
setlocale
signal
sprintf
strchr
strcoll
strlen
tolower
vfprintf
wcslen
wcstombs
ole32
CoInitializeEx
shell32
SHGetFolderPathA
user32
DispatchMessageA
GetMessageA
ShowWindow
TranslateMessage
UpdateWindow
Name
.text
Size
42KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
/4
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
189KB
Virtual Size
189KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE