conti | b2365e9dbed11615908276e371bb40400eea0563752527ef91aeb8105de1d16f

General

Target

b2365e9dbed11615908276e371bb40400eea0563752527ef91aeb8105de1d16f
Size

984KB
Sample

211105-y6yvhscgc9
MD5

d5830d258e4aa138b21a0841d85f4e2a
SHA1

d82f858eaac39c4ce5f20cf6db8414de7147b4e3
SHA256

b2365e9dbed11615908276e371bb40400eea0563752527ef91aeb8105de1d16f
SHA512

9cb37cc4e8292a189c390f6b0df912a24870e762f79a23c94a005c62e7b518f637b0de697a306b3543cda294b5ce9e45324edca3fc6f8c8b496d659dcb4a6e19

Score

10^/10

Malware Config

Extracted

Path

C:\readme.txt

Family

conti

Ransom Note

All of your files are currently encrypted by CONTI ransomware. If you try to use any additional recovery software - the files might be damaged or lost. To make sure that we REALLY CAN recover data - we offer you to decrypt samples. You can contact us for further instructions through: Our website TOR VERSION : (you should download and install TOR browser first https://torproject.org) http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/ HTTPS VERSION : https://contirecovery.ws YOU SHOULD BE AWARE! Just in case, if you try to ignore us. We've downloaded your data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us ASAP ---BEGIN ID--- gmJxnzHa5Dw2DvbKWC4mcXdBrCrgIzoW9s4hbbeYjYeFNCPs72WwCKPkoPC06zzH ---END ID---

URLs

http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/

https://contirecovery.ws

Targets

- Target
  
  b2365e9dbed11615908276e371bb40400eea0563752527ef91aeb8105de1d16f
- Size
  
  984KB
- MD5
  
  d5830d258e4aa138b21a0841d85f4e2a
- SHA1
  
  d82f858eaac39c4ce5f20cf6db8414de7147b4e3
- SHA256
  
  b2365e9dbed11615908276e371bb40400eea0563752527ef91aeb8105de1d16f
- SHA512
  
  9cb37cc4e8292a189c390f6b0df912a24870e762f79a23c94a005c62e7b518f637b0de697a306b3543cda294b5ce9e45324edca3fc6f8c8b496d659dcb4a6e19
Score

10^/10

conti ransomware spyware stealer
- Conti Ransomware
  Ransomware generally thought to be a successor to Ryuk.
  ransomware conti
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Conti Ransomware

Modifies extensions of user files

Drops startup file

Reads user/profile data of web browsers

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2