찾아줄게요

AAA 파일은 무엇입니까?

• 안녕하세요. 제 컴퓨터에서 AAA라는 파일을 찾았는데 이것이 무엇인지 잘 모르겠습니다. 알려주시면 감사하겠습니다.

• AAA 파일은 TeslaCrypt로 암호화된 파일 입니다. TeslaCrypt에서 배포한 파일인 것으로 보입니다. 2017-10-18 19:58:18에 처음으로 보고되었으며 2017-10-18 19:58:18에 마지막으로 보고되었습니다.

• TeslaCrypt 프로그램을 다운로드하여 AAA 파일을 열 수 있습니다.

• TeslaCrypt로 암호화된 파일
  
  TeslaCrypt 랜섬웨어로 암호화된 파일

• _H_e_l_p_RECOVER_INSTRUCTIONS+***
  
  help_recover_instructions+***
  
  how_recover+***
  
  _how_recover_***
  
  howto_recover_file_*****
  
  HOWTO_RESTORE_FILES_*****
  
  HELP_RESTORE_FILES
  
  HELP_TO_SAVE_FILES
  
  HELP_T

• 연관 링크 #1: 첨부된 링크가 없습니다.

• 연관 링크 #2: 첨부된 링크가 없습니다.

• [2021-07-04 14:53:23] @pollo290987 #redline multilogin.exe d4bfc09f4e75c9eef1ead04768aaabc9 build4 C2: /45.139.236.36:33611

• [2021-07-02 20:24:46] @decentralized_b Sobre el supuesto virus de specter Ha sido un falso positivo. lo han comunicado en su grupo de Telegram y lo harán por twitter https://www.virustotal.com/gui/file/2f3cc45adf8aaaf186bd0389454ad8d461e358e710974f4426ada39de3673a6e/details https://twitter.com/decentralized_b/status/1410588092927410180 https://twitter.com/decentralized_b/status/1410952588867026952/photo/1

• [2021-07-02 12:39:02] @ankit_anubhav Maldoc -> Websettings Abuse -> /bit.ly download -> another maldoc -> CVE-2017-11882 -> #Lokibot exe -> normal c2 fre.php connections. This week volume wise #Loki is very high. Stage 1 https://www.virustotal.com/gui/file/f06415d3df49d9c8f5ac780aaaed14d0cb28d7b24ad6fdac3d043485fd98159e/detection Stage 2 https://www.virustotal.com/gui/file/d1b85d7670f9d954c9fa4301e00d42652b28d28f086a057b66368b5e6a4a15ef/detection Stage 3 https://www.virustotal.com/gui/file/667250857f2b30a82d4dd701c3f54c1fa47b033546b20082ae19fc779a526b65/detection https://twitter.com/ankit_anubhav/status/1410835384733368325/photo/1

• [2021-07-02 11:04:51] @InQuest ???? Malicious RTF document found hosted at: https///bit.ly/2UTaZBr SHA256: d1b85d7670f9d954c9fa4301e00d42652b28d28f086a057b66368b5e6a4a15ef IOC extracted from sample: https://labs.inquest.net/dfi/hash/f06415d3df49d9c8f5ac780aaaed14d0cb28d7b24ad6fdac3d043485fd98159e

• [2021-07-01 18:20:57] @JAMESWT_MHT Mentioned "CARTA_IDENTITA" Samples rtf https://bazaar.abuse.ch/sample/abab55c3c2109d14d6efde236c6200bbf59edf9c2edc6d8a59ce6e310607bc9b/ vbe https://bazaar.abuse.ch/sample/bd63f098304c316749c2b49726aaa7c5af4c33a4de7a5049e32587491c21a113/ Run https://app.any.run/tasks/5bdbb67e-f8a4-45f5-98ef-d67943e7a484 ❗️❗️CARTA_IDENTITA.exe ❗️❗️ https://bazaar.abuse.ch/sample/99ebb7d245ea5a3535cfba9d1cc7ec71a8cef683b91522574e32170198851d7f/ ✳️Samples https://bazaar.abuse.ch/browse/tag/rinaldo/ Relations https://www.virustotal.com/gui/domain/rinaldomattei.firstcloudit.com/relations cc @verovaleros @felixw3000 @sS55752750 https://twitter.com/D3LabIT/status/1410540076447191040 https://twitter.com/JAMESWT_MHT/status/1410559041911328772/photo/1

• [2021-07-01 17:43:21] @fbgwls245 BD60871047C02C34DE4E76AAABF397C9 C:\Users\kashe\source\repos\Microsoft System\Microsoft System\obj\Debug\Microsoft System.pdb https://twitter.com/fbgwls245/status/1410549580601520135/photo/1

• [2021-06-29 22:16:01] @cyb3rops Aaand the winner is : this PCAP file literally triggering all possible detection rules in just 25MB I'd say that if you replay this in front of your NSM appliance and it doesn't show an alert. it's most likely crap https://www.virustotal.com/gui/file/baf013b1a0a3c19287797ca2f85d31f63ae53783ba66cd0fc21472132ccbbf12/detection https://twitter.com/cyb3rops/status/1409893425638514693/photo/1

• [2021-06-28 15:28:49] @benkow_ #Lu0bot of the week https://www.virustotal.com/gui/file/b93b8b99bdc14cb119ca0a51fe57c2da5aaa45d52a3f7121d31d675e4f900400/detection https://www.virustotal.com/gui/file/22934e006b3f1b8225c51a93ce0acaa1874c4f1dc895fa1664bdf16b0065d2e7/detection

• [2021-06-28 08:47:11] @fuuuing_ #donot 9407a3f116d93ff51a2cec8b580b6e30 dataupdates.live https://www.virustotal.com/gui/file/a59195a5a87b6d6e4275e01a2360003bf55bcc72772e92b07f22e59aaa7b3cad/

• [2021-06-27 21:30:02] @HeliosCert @HeliosCert Sample analysed on #virustotal VirusTotal-Score: 61 VirusTotal: https://www.virustotal.com/gui/file/363ab703e8aaae5dfa3e73ef24518529d111ec4c014c641a1d16e3f4b49e57b3/detection/f-363ab703e8aaae5dfa3e73ef24518529d111ec4c014c641a1d16e3f4b49e57b3-1615624599 Threat: Ransom_WCRY.SMALYM (TrendMicro)

• [2021-06-26 02:05:02] @HeliosCert @HeliosCert Sample analysed on #virustotal VirusTotal-Score: 5 VirusTotal: https://www.virustotal.com/gui/file/303a36a13238eaaa8ac4241252225db319f47d4f12567084dc2e1c08c98e4c90/detection/f-303a36a13238eaaa8ac4241252225db319f47d4f12567084dc2e1c08c98e4c90-1620718243 Threat:

• [2021-06-26 01:32:25] @petrovic082 #signed https://www.virustotal.com/gui/file/3a0ef999c0c9cb70acfa60b84adf1c3b5489f013ca82aaab46fe73a9dce99f34/ https://app.any.run/tasks/8b67b306-ece2-42e2-8b5c-cfc54de79f36

• [2021-06-26 00:25:13] @GossiTheDog @struppigel I like this one ???? https://www.virustotal.com/gui/file/13ace534c70e91b09b8f48e6e0b819bdf39d2ac7e1340409faaac99077b73759/detection

• [2021-06-23 00:30:02] @HeliosCert @HeliosCert Sample analysed on #virustotal VirusTotal-Score: 61 VirusTotal: https://www.virustotal.com/gui/file/f411aaa4bd7c2bd414858eac67118863584eb5bb232d974f39319805e57d3922/detection/f-f411aaa4bd7c2bd414858eac67118863584eb5bb232d974f39319805e57d3922-1606319146 Threat: Ransom_WCRY.SMALYM (TrendMicro)

• [2021-06-22 20:03:39] @GossiTheDog https://www.virustotal.com/gui/file/13ace534c70e91b09b8f48e6e0b819bdf39d2ac7e1340409faaac99077b73759/detection https://twitter.com/GossiTheDog/status/1407323398129213440/photo/1

• [2021-06-21 21:50:02] @HeliosCert @HeliosCert Sample analysed on #virustotal VirusTotal-Score: 63 VirusTotal: https://www.virustotal.com/gui/file/ca18c60562aaad86a9fdc8a534c5463357b56ee7991aea8a49664c1c42297d29/detection/f-ca18c60562aaad86a9fdc8a534c5463357b56ee7991aea8a49664c1c42297d29-1570263726 Threat: Ransom_WCRY.SMALYM (TrendMicro)

• [2021-06-20 04:45:56] @surepyw @scoliono1 https://www.hybrid-analysis.com/sample/215a01865001dc95375601fb55a422976511765aaa77ea7cba0b17301b6ef6c9

• [2021-06-18 06:10:02] @HeliosCert @HeliosCert Sample analysed on #virustotal VirusTotal-Score: 58 VirusTotal: https://www.virustotal.com/gui/file/a5ea7012fc6e8650e5fd74c3ecaaaf68565375c2a166482ac41102ed09283787/detection/f-a5ea7012fc6e8650e5fd74c3ecaaaf68565375c2a166482ac41102ed09283787-1549977606 Threat: Ransom_WCRY.SMALYM (TrendMicro)

• [2021-06-17 14:50:10] @58_158_177_102 日本語マルウェアメールの接到を確認しています #maldoc in Japanese #agenttesla ? Subject : 支払い請求書 MD5 : 29bb1fce93f265a13540036bc3fa3004 sample : https://app.any.run/tasks/ba504267-f1c5-494c-8a5d-c927073252db https://www.virustotal.com/gui/file/ac4cb0f2a22c56ac46418aaa10519b7582bf8dd9144ac5229f1f9a0a0aa92962/detection (6/61) https://tria.ge/210617-bb97re3l82/behavioral1 @bomccss https://twitter.com/58_158_177_102/status/1405432568338546688/photo/1

• [2021-06-15 22:21:38] @pollo290987 #sodinokibi #ransomware arm_crypt.exe 229da2b80073aed77526aaa0f9445334 Campaign: 8013 https://twitter.com/pollo290987/status/1404821406823632903/photo/1

• [2021-06-15 17:50:27] @fbgwls245 #Makop #Ransomware 082a2ce2dde8b3a50f2d499496879e85562ee949cb151c8052eaaa713cddd0f8 Ext: .XXXXXXXX [email protected] .makop

• [2021-06-10 15:55:02] @HeliosCert @HeliosCert Sample analysed on #virustotal VirusTotal-Score: 65 VirusTotal: https://www.virustotal.com/gui/file/c8db12d4e1b926b79ef7857e91b34e909b8024c3eaaab8580e4e1d157eaa726f/detection/f-c8db12d4e1b926b79ef7857e91b34e909b8024c3eaaab8580e4e1d157eaa726f-1589338301 Threat: Ransom_WCRY.SMALYM (TrendMicro)

• [2021-06-07 13:00:03] @HeliosCert @HeliosCert Sample analysed on #virustotal VirusTotal-Score: 59 VirusTotal: https://www.virustotal.com/gui/file/d53d9ce0aaaa16b07513bd58bba94418b73c96035b4bb7aea8ddc928fa6381fa/detection/f-d53d9ce0aaaa16b07513bd58bba94418b73c96035b4bb7aea8ddc928fa6381fa-1622719518 Threat: Ransom_WCRY.SMALYM (TrendMicro)

• [2021-06-05 22:18:09] @jjrruiz @PDI_CHILE #phishing en sitio web .CL: * hxxps://derio.cl/-/./home/ * hxxps://derio.cl/-/./home/Codigo.html Pruebas: * https://www.virustotal.com/gui/url/a7879ad22a448cf6c8404965124fc2205dfa516343a9ffca389dab8f3d962af3/detection * https://www.virustotal.com/gui/url/1f7fc23066eda2c6f37cb6bce005f7307f3e0012b4705ddea2aaa3d33dd24eaa/detection Favor su colaboración para la retirada del contenido o suspender el sitio. El dueño no coopera.

• [2021-06-05 20:54:54] @jjrruiz @NICChile #phishing en sitio web .CL: * hxxps://derio.cl/-/./home/ * hxxps://derio.cl/-/./home/Codigo.html Pruebas: * https://www.virustotal.com/gui/url/a7879ad22a448cf6c8404965124fc2205dfa516343a9ffca389dab8f3d962af3/detection * https://www.virustotal.com/gui/url/1f7fc23066eda2c6f37cb6bce005f7307f3e0012b4705ddea2aaa3d33dd24eaa/detection Favor su colaboración para la retirada del contenido o suspender el sitio. El dueño no coopera.

• [2021-06-04 17:06:49] @JAMESWT_MHT "Re:FW: PROFORMA INVOICE2" #spread #Formbook too today in #italy Zip https://bazaar.abuse.ch/sample/20958a929e48de6150bdb51a08ac836a2ed1481537a5d35ca5ec7d02aaa293c0/ PROFORMA INVOICE PDF.exe https://bazaar.abuse.ch/sample/98acba30e1beae1f5b26942e308d3e34e776abf297925b373bfe1e39ed6d5dc2/ C2 hXXp://www.kalptarucentrino.com/owws/ cc @58_158_177_102 @felixw3000 https://twitter.com/JAMESWT_MHT/status/1400755913099730945/photo/1

• [2021-06-04 04:37:38] @c3rb3ru5d3d53c #ASyncRAT #Malware #RAT ???? 84f86d2ec5abb3d52cf1963caaaff00f ???? RobinD3l-46206.portmap.host:46206 Mutex: AsyncMutex_6SI8OkPnk Install Folder: %AppData% Install File: Explorer.exe @pastebin: hxxps://pastebin.com/raw/hbwHfEg3 https://www.virustotal.com/gui/file/afc01f20e5c415f0c7270f0d20c2267dc5c9bce77fe8f63f2b54887adc1b4bc7/detection https://twitter.com/c3rb3ru5d3d53c/status/1400567376861700101/photo/1

• [2021-06-01 18:31:08] @JAMESWT_MHT #interesting sample caught by @cocaman .ppam https://bazaar.abuse.ch/sample/df91f20f8204e6d0e1239202c58d438143ccc560ac5ae8b2d8cf8e49aaae3708/ ???? Ps1 https://bazaar.abuse.ch/sample/63b6f4de7ae3b635415d9963830613c9b6654a6d1e429580494105a72404867e/ Urls hXXps://ia601409.us.archive.org/4/items/Re-Panel-24/10.txt 1230948%[email protected]/p/10.html 103.114.107.28/me/web10/inc/d3808c7188cb55.php spread #AgentTesla https://twitter.com/JAMESWT_MHT/status/1399689971401900036/photo/1

• [2021-05-29 04:05:02] @HeliosCert @HeliosCert Sample analysed on #virustotal VirusTotal-Score: 59 VirusTotal: https://www.virustotal.com/gui/file/21345165eb15b40f5c951c28daa11aaab408b1c6b28ba2d302ddba127baf62ad/detection/f-21345165eb15b40f5c951c28daa11aaab408b1c6b28ba2d302ddba127baf62ad-1606729315 Threat: Ransom_WCRY.SMALYM (TrendMicro)

• [2021-05-28 00:21:19] @win32kid @theotherJohnC @malwrhunterteam https://www.virustotal.com/gui/file/d81e62102d9b748aaabf4f06bf0c09a66dfaaac7836374016a5f076b6f7ed418/detection/f-d81e62102d9b748aaabf4f06bf0c09a66dfaaac7836374016a5f076b6f7ed418-1622054791 - nor does it detect redline :P

• 보이스피싱, 불법촬영물, 랜섬웨어, 사이버 안보위협 등에 관련된 사안의 경우 다음과 같은 기관 및 단체의 도움을 받을 수 있습니다. 노모어랜섬(No More Ransom) 경찰청 사이버범죄 신고시스템 국가정보원 민원센터