General
-
Target
a5aeae61d5045abdc28dd0e78bd1cef6e4bc2beb5360696959f532a616435f70
-
Size
194KB
-
Sample
211119-zldjhseef3
-
MD5
7d599fba9d8a06c70ddfdf8f55cf5c1c
-
SHA1
67a48ca5b621f23d133154cf5b0348f37bbc4963
-
SHA256
a5aeae61d5045abdc28dd0e78bd1cef6e4bc2beb5360696959f532a616435f70
-
SHA512
6c6f591a9badcd04ed488b292da247fac29d933f81f9a146a2221609a0f951a85f9179c1d7b4c9fdd2c551c697bdb7eb58d252f029e14332b6944af72dcc1781
Static task
static1
Behavioral task
behavioral1
Sample
a5aeae61d5045abdc28dd0e78bd1cef6e4bc2beb5360696959f532a616435f70.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
a5aeae61d5045abdc28dd0e78bd1cef6e4bc2beb5360696959f532a616435f70.exe
Resource
win10-en-20211014
Malware Config
Extracted
C:\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.click
Targets
-
-
Target
a5aeae61d5045abdc28dd0e78bd1cef6e4bc2beb5360696959f532a616435f70
-
Size
194KB
-
MD5
7d599fba9d8a06c70ddfdf8f55cf5c1c
-
SHA1
67a48ca5b621f23d133154cf5b0348f37bbc4963
-
SHA256
a5aeae61d5045abdc28dd0e78bd1cef6e4bc2beb5360696959f532a616435f70
-
SHA512
6c6f591a9badcd04ed488b292da247fac29d933f81f9a146a2221609a0f951a85f9179c1d7b4c9fdd2c551c697bdb7eb58d252f029e14332b6944af72dcc1781
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-