General
-
Target
locker.bin
-
Size
194KB
-
Sample
211027-fpxxsaaff9
-
MD5
f784984a20b4e58d6301bfef1f4c13b8
-
SHA1
512754b0f5bbd204dd26fadf20982f9babd45576
-
SHA256
d417f3785a33da8b26ce68b62e66bdf7d46869b692fe325541a7be2b98119bd1
-
SHA512
af085f96ab972df9661036efcdd626718dabf94e969559b243e1bf367f19aa047d442e6384136a59a1d833462a74a0c906e4b1e87f4cf76aec0287fd5f3738e5
Static task
static1
Behavioral task
behavioral1
Sample
locker.bin.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
locker.bin.exe
Resource
win10-en-20211014
Malware Config
Extracted
C:\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.click
Targets
-
-
Target
locker.bin
-
Size
194KB
-
MD5
f784984a20b4e58d6301bfef1f4c13b8
-
SHA1
512754b0f5bbd204dd26fadf20982f9babd45576
-
SHA256
d417f3785a33da8b26ce68b62e66bdf7d46869b692fe325541a7be2b98119bd1
-
SHA512
af085f96ab972df9661036efcdd626718dabf94e969559b243e1bf367f19aa047d442e6384136a59a1d833462a74a0c906e4b1e87f4cf76aec0287fd5f3738e5
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-