conti | 11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754

General

Target

11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample
Size

517KB
Sample

210923-scbj8segb5
MD5

4eaaf31a7ff227a52fb036ed30103c79
SHA1

eef0ee30efb1a0595a5a1633e08dcdf65a94a3c4
SHA256

11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754
SHA512

917707ea12dc5ec296e41d25797dcafdda525eaaee768137926df11699cad07f8176567ecd0969e471ebced0e00932bf3aa270a9d177de814d6c003ff7d18e73

Score

10^/10

Malware Config

Extracted

Path

C:\readme.txt

Family

conti

Ransom Note

All of your files are currently encrypted by CONTI ransomware. If you try to use any additional recovery software - the files might be damaged or lost. To make sure that we REALLY CAN recover data - we offer you to decrypt samples. You can contact us for further instructions through: Our website TOR VERSION : (you should download and install TOR browser first https://torproject.org) http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/ HTTPS VERSION : https://contirecovery.click YOU SHOULD BE AWARE! Just in case, if you try to ignore us. We've downloaded your data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us ASAP ---BEGIN ID--- 1oCoJXb9aUiCGzFzjVs55rTrO2ucfQqV0GFhlPOS6ka81opOFBGKUQG5ZT0nLKpt ---END ID---

URLs

http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/

https://contirecovery.click

Targets

- Target
  
  11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754.bin.sample
- Size
  
  517KB
- MD5
  
  4eaaf31a7ff227a52fb036ed30103c79
- SHA1
  
  eef0ee30efb1a0595a5a1633e08dcdf65a94a3c4
- SHA256
  
  11d1bda99c350ee4d82c6e53ca9a1c1c76bc5b9e3148853899cc04d1d00e9754
- SHA512
  
  917707ea12dc5ec296e41d25797dcafdda525eaaee768137926df11699cad07f8176567ecd0969e471ebced0e00932bf3aa270a9d177de814d6c003ff7d18e73
Score

10^/10

conti ransomware spyware stealer
- Conti Ransomware
  Ransomware generally thought to be a successor to Ryuk.
  ransomware conti
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Conti Ransomware

Modifies extensions of user files

Drops startup file

Reads user/profile data of web browsers

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2