conti | 949ee1522f6b132960d02bdd0681e28b0635a266d5ec7dcaa6838806beb927be

General

Target

949ee1522f6b132960d02bdd0681e28b0635a266d5ec7dcaa6838806beb927be
Size

170KB
Sample

211216-r93vbaccg4
MD5

4013532b5d10c140fd84a12e4b1d2229
SHA1

e982160e4872792a9fe4cc641f22ff8d1795b85f
SHA256

949ee1522f6b132960d02bdd0681e28b0635a266d5ec7dcaa6838806beb927be
SHA512

da185cc4ac72ac12992a888e3e4b796ef2f49331b0c3a1023dd8bdc2da3cffd76b6bf0fbd929371c07141207afd5dcbf152a162b448a69bb66f7e8f950a32b62

Score

10^/10

Malware Config

Extracted

Path

C:\readme.txt

Family

conti

Ransom Note

All of your files are currently encrypted by CONTI strain. As you know (if you don't - just "google it"), all of the data that has been encrypted by our software cannot be recovered by any means without contacting our team directly. If you try to use any additional recovery software - the files might be damaged, so if you are willing to try - try it on the data of the lowest value. To make sure that we REALLY CAN get your data back - we offer you to decrypt 2 random files completely free of charge. You can contact our team directly for further instructions through our website : TOR VERSION : (you should download and install TOR browser first https://torproject.org) http://contirec7nchr45rx6ympez5rjldibnqzh7lsa56lvjvaeywhvoj3wad.onion/FGOqzlBY9Fj38NAF5jRhibjugpxT3whRFudQH8oM3nPHOnyk3mlXksTO1wbwvbRc YOU SHOULD BE AWARE! Just in case, if you try to ignore us. We've downloaded a pack of your internal data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us as soon as possible. ---BEGIN ID--- FGOqzlBY9Fj38NAF5jRhibjugpxT3whRFudQH8oM3nPHOnyk3mlXksTO1wbwvbRc ---END ID---

URLs

http://contirec7nchr45rx6ympez5rjldibnqzh7lsa56lvjvaeywhvoj3wad.onion/FGOqzlBY9Fj38NAF5jRhibjugpxT3whRFudQH8oM3nPHOnyk3mlXksTO1wbwvbRc

Targets

- Target
  
  949ee1522f6b132960d02bdd0681e28b0635a266d5ec7dcaa6838806beb927be
- Size
  
  170KB
- MD5
  
  4013532b5d10c140fd84a12e4b1d2229
- SHA1
  
  e982160e4872792a9fe4cc641f22ff8d1795b85f
- SHA256
  
  949ee1522f6b132960d02bdd0681e28b0635a266d5ec7dcaa6838806beb927be
- SHA512
  
  da185cc4ac72ac12992a888e3e4b796ef2f49331b0c3a1023dd8bdc2da3cffd76b6bf0fbd929371c07141207afd5dcbf152a162b448a69bb66f7e8f950a32b62
Score

10^/10

conti ransomware spyware stealer
- Conti Ransomware
  Ransomware generally thought to be a successor to Ryuk.
  ransomware conti
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
behavioral1