conti | f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9

General

Target

f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample
Size

194KB
Sample

211123-v9zz7seae6
MD5

31c250609693ca7450a1d79840c51057
SHA1

eca2dea03f2c5eac7bbf54e1d212f0fc61d936f8
SHA256

f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9
SHA512

eac254d9a4950666747fad7534c815bafcdc75b6862bb442c9a4d9b4c00aedc2e9317514b7e76f5453c4f0ca55327c88e8cec743a46ccac78fcbfa3e32700424

Score

10^/10

Malware Config

Extracted

Path

C:\readme.txt

Family

conti

Ransom Note

All of your files are currently encrypted by CONTI ransomware. If you try to use any additional recovery software - the files might be damaged or lost. To make sure that we REALLY CAN recover data - we offer you to decrypt samples. You can contact us for further instructions through: Our website TOR VERSION : (you should download and install TOR browser first https://torproject.org) http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/ HTTPS VERSION : https://contirecovery.ws YOU SHOULD BE AWARE! Just in case, if you try to ignore us. We've downloaded your data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us ASAP ---BEGIN ID--- 1XOTsYKOEFHqHwWPPYpfi6QfUEK4rHVxjLeOYfZwL4AYYuRtXTJdINrIQGMGRNVQ ---END ID---

URLs

http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/

https://contirecovery.ws

Targets

- Target
  
  f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample
- Size
  
  194KB
- MD5
  
  31c250609693ca7450a1d79840c51057
- SHA1
  
  eca2dea03f2c5eac7bbf54e1d212f0fc61d936f8
- SHA256
  
  f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9
- SHA512
  
  eac254d9a4950666747fad7534c815bafcdc75b6862bb442c9a4d9b4c00aedc2e9317514b7e76f5453c4f0ca55327c88e8cec743a46ccac78fcbfa3e32700424
Score

10^/10

conti ransomware spyware stealer
- Conti Ransomware
  Ransomware generally thought to be a successor to Ryuk.
  ransomware conti
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Conti Ransomware

Modifies extensions of user files

Drops startup file

Reads user/profile data of web browsers

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2