General

  • Target

    83626579f6334700cb26ec528383f902a4152baf31a3d10482eee019039658ad.bin.sample

  • Size

    170KB

  • Sample

    211208-s42whagbd4

  • MD5

    c836258d653f837798260c72695e5bbc

  • SHA1

    58f9a90f473d0c340caa0b1901c18b5f705d4b92

  • SHA256

    83626579f6334700cb26ec528383f902a4152baf31a3d10482eee019039658ad

  • SHA512

    d429dcf1daddf3fd0e56bf88de75ba13d65625953ed5ce64d8daab1d13e32fe4edc2e9bc6ea3fd65cda38e384f45514b7da22e894147fa4b08edd0b4af2f67ba

Score
10/10

Malware Config

Extracted

Path

C:\readme.txt

Family

conti

Ransom Note
All of your files are currently encrypted by CONTI strain. As you know (if you don't - just "google it"), all of the data that has been encrypted by our software cannot be recovered by any means without contacting our team directly. If you try to use any additional recovery software - the files might be damaged, so if you are willing to try - try it on the data of the lowest value. To make sure that we REALLY CAN get your data back - we offer you to decrypt 2 random files completely free of charge. You can contact our team directly for further instructions through our website : TOR VERSION : (you should download and install TOR browser first https://torproject.org) http://contirec7nchr45rx6ympez5rjldibnqzh7lsa56lvjvaeywhvoj3wad.onion/faj3vdUHDGjZd52IrBxplWf3j7ZRHWxfu0L5fIG7KxEev7TgYfDKajDvC87lkNkg YOU SHOULD BE AWARE! Just in case, if you try to ignore us. We've downloaded a pack of your internal data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us as soon as possible. ---BEGIN ID--- faj3vdUHDGjZd52IrBxplWf3j7ZRHWxfu0L5fIG7KxEev7TgYfDKajDvC87lkNkg ---END ID---
URLs

http://contirec7nchr45rx6ympez5rjldibnqzh7lsa56lvjvaeywhvoj3wad.onion/faj3vdUHDGjZd52IrBxplWf3j7ZRHWxfu0L5fIG7KxEev7TgYfDKajDvC87lkNkg

Targets

    • Target

      83626579f6334700cb26ec528383f902a4152baf31a3d10482eee019039658ad.bin.sample

    • Size

      170KB

    • MD5

      c836258d653f837798260c72695e5bbc

    • SHA1

      58f9a90f473d0c340caa0b1901c18b5f705d4b92

    • SHA256

      83626579f6334700cb26ec528383f902a4152baf31a3d10482eee019039658ad

    • SHA512

      d429dcf1daddf3fd0e56bf88de75ba13d65625953ed5ce64d8daab1d13e32fe4edc2e9bc6ea3fd65cda38e384f45514b7da22e894147fa4b08edd0b4af2f67ba

    Score
    10/10
    • Conti Ransomware

      Ransomware generally thought to be a successor to Ryuk.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Drops desktop.ini file(s)

MITRE ATT&CK Matrix

Tasks