This implementation is broken. It concatenates a hash of the plaintext to a CTR-mode ciphertext. That's weakly authenticated and leaks information about the plaintext.

It would be better to HMAC the ciphertext with a second key value.