General
-
Target
d43b52e3453ce77d2694a239232f39341a98fa704954a558125e74a85f22a346
-
Size
194KB
-
Sample
211119-zrf7laeeg4
-
MD5
f4650d292682a8ae1ca1efd08fa1eb58
-
SHA1
e64e2a4909672cd6ff27788976b875be8c3f25a6
-
SHA256
d43b52e3453ce77d2694a239232f39341a98fa704954a558125e74a85f22a346
-
SHA512
64ba5a118c5fdd9633c102062591ceb8e8511f3cfea8223989ad9997e1fb7b9d1012e157214ad6e103a9314abbd28b0d5a8a0e559bbfbf8df94a6adffb02d222
Static task
static1
Behavioral task
behavioral1
Sample
d43b52e3453ce77d2694a239232f39341a98fa704954a558125e74a85f22a346.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
d43b52e3453ce77d2694a239232f39341a98fa704954a558125e74a85f22a346.exe
Resource
win10-en-20211014
Malware Config
Extracted
C:\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.click
Targets
-
-
Target
d43b52e3453ce77d2694a239232f39341a98fa704954a558125e74a85f22a346
-
Size
194KB
-
MD5
f4650d292682a8ae1ca1efd08fa1eb58
-
SHA1
e64e2a4909672cd6ff27788976b875be8c3f25a6
-
SHA256
d43b52e3453ce77d2694a239232f39341a98fa704954a558125e74a85f22a346
-
SHA512
64ba5a118c5fdd9633c102062591ceb8e8511f3cfea8223989ad9997e1fb7b9d1012e157214ad6e103a9314abbd28b0d5a8a0e559bbfbf8df94a6adffb02d222
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-