General
-
Target
603fbfe3d00baa8aa65288169af993b1a43cb6d02718204130922af513cc404b
-
Size
194KB
-
Sample
211025-ycn38ageh2
-
MD5
38c68c11f6fff05be28c7f70f9e00255
-
SHA1
f49dd6576e63ff72cab929d7008acaeb8a74be8e
-
SHA256
603fbfe3d00baa8aa65288169af993b1a43cb6d02718204130922af513cc404b
-
SHA512
6e141309ec23e740eeca34757db4eafa9373574ddfa222e1467c29bfc4cbfc42b7b7bba36294ad58e0adc7fdab0ad25818f2f01f8b4dcf5ff590821db31aacfd
Static task
static1
Behavioral task
behavioral1
Sample
603fbfe3d00baa8aa65288169af993b1a43cb6d02718204130922af513cc404b.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
603fbfe3d00baa8aa65288169af993b1a43cb6d02718204130922af513cc404b.exe
Resource
win10-en-20211014
Malware Config
Extracted
C:\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.click
Targets
-
-
Target
603fbfe3d00baa8aa65288169af993b1a43cb6d02718204130922af513cc404b
-
Size
194KB
-
MD5
38c68c11f6fff05be28c7f70f9e00255
-
SHA1
f49dd6576e63ff72cab929d7008acaeb8a74be8e
-
SHA256
603fbfe3d00baa8aa65288169af993b1a43cb6d02718204130922af513cc404b
-
SHA512
6e141309ec23e740eeca34757db4eafa9373574ddfa222e1467c29bfc4cbfc42b7b7bba36294ad58e0adc7fdab0ad25818f2f01f8b4dcf5ff590821db31aacfd
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-