General
-
Target
957675e7fd1d1cb50f3252d3950d77ec1e37c3004c5da39674e03a817e9ba7f9
-
Size
215KB
-
Sample
210917-gd5zpaegg7
-
MD5
c7d52ab979c73fc11e00c7ad32a2ee6c
-
SHA1
ef750a4dfa69a0108e72306dc2ed53e13ed38c2d
-
SHA256
957675e7fd1d1cb50f3252d3950d77ec1e37c3004c5da39674e03a817e9ba7f9
-
SHA512
afb752109186f18742ef44f0c13e10273209069e894979560c03d184949ce39201d28179f117f5206a1212268f00f3a1b0c4eabed852e3206985c11501bc158e
Static task
static1
Behavioral task
behavioral1
Sample
957675e7fd1d1cb50f3252d3950d77ec1e37c3004c5da39674e03a817e9ba7f9.dll
Resource
win7-en-20210916
Behavioral task
behavioral2
Sample
957675e7fd1d1cb50f3252d3950d77ec1e37c3004c5da39674e03a817e9ba7f9.dll
Resource
win10v20210408
Malware Config
Extracted
C:\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.click
Targets
-
-
Target
957675e7fd1d1cb50f3252d3950d77ec1e37c3004c5da39674e03a817e9ba7f9
-
Size
215KB
-
MD5
c7d52ab979c73fc11e00c7ad32a2ee6c
-
SHA1
ef750a4dfa69a0108e72306dc2ed53e13ed38c2d
-
SHA256
957675e7fd1d1cb50f3252d3950d77ec1e37c3004c5da39674e03a817e9ba7f9
-
SHA512
afb752109186f18742ef44f0c13e10273209069e894979560c03d184949ce39201d28179f117f5206a1212268f00f3a1b0c4eabed852e3206985c11501bc158e
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Drops desktop.ini file(s)
-