General
-
Target
86.dll
-
Size
190KB
-
Sample
210923-mlq4dsebd9
-
MD5
33e977a44164db82bfef0c35c436f1f4
-
SHA1
36a855d68aaf368c543707714afca78217815cbb
-
SHA256
74ebfcd116fdd39217935d11ae62e48a0c44dfab822edea62ac7f611aca969dd
-
SHA512
9ba400ecb65b8166fab1bc9199115845ee62cd5e30e1f3d5661ddbd62d4e0da91232c548dbb1ae9ee1ed0d296e5eb5a36f19776c7cb6715e2376e1e096a4fdc8
Static task
static1
Behavioral task
behavioral1
Sample
86.dll
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
86.dll
Resource
win10v20210408
Malware Config
Extracted
C:\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.click
Targets
-
-
Target
86.dll
-
Size
190KB
-
MD5
33e977a44164db82bfef0c35c436f1f4
-
SHA1
36a855d68aaf368c543707714afca78217815cbb
-
SHA256
74ebfcd116fdd39217935d11ae62e48a0c44dfab822edea62ac7f611aca969dd
-
SHA512
9ba400ecb65b8166fab1bc9199115845ee62cd5e30e1f3d5661ddbd62d4e0da91232c548dbb1ae9ee1ed0d296e5eb5a36f19776c7cb6715e2376e1e096a4fdc8
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Drops desktop.ini file(s)
-