conti | 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c

General

Target

5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c
Size

2.1MB
Sample

220107-yf32jscfa9
MD5

6552b8bf9ba6a4931548fe65cde76ad4
SHA1

0c81ed07b0fcc9b8a4ff983ed83dd1c83c8fa600
SHA256

5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c
SHA512

4421f18fc7b276977366f4099e0602947b85ab0f0b7a75e818389d35b3d8e9d0b81b8128ef47dff47a45e4541d23512267139f361822e18b7bb807105071448d

Score

10^/10

Malware Config

Extracted

Path

C:\readme.txt

Family

conti

Ransom Note

All of your files are currently encrypted by CONTI strain. As you know (if you don't - just "google it"), all of the data that has been encrypted by our software cannot be recovered by any means without contacting our team directly. If you try to use any additional recovery software - the files might be damaged, so if you are willing to try - try it on the data of the lowest value. To make sure that we REALLY CAN get your data back - we offer you to decrypt 2 random files completely free of charge. You can contact our team directly for further instructions through our website : TOR VERSION : (you should download and install TOR browser first https://torproject.org) http://contirec7nchr45rx6ympez5rjldibnqzh7lsa56lvjvaeywhvoj3wad.onion/PZ8lOWohN5xGPEYNRMJljsyK7PSBDmbUWQgY74Uvxm8TdMEXICZLVkvTBn5ubLDK YOU SHOULD BE AWARE! Just in case, if you try to ignore us. We've downloaded a pack of your internal data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us as soon as possible. ---BEGIN ID--- PZ8lOWohN5xGPEYNRMJljsyK7PSBDmbUWQgY74Uvxm8TdMEXICZLVkvTBn5ubLDK ---END ID---

URLs

http://contirec7nchr45rx6ympez5rjldibnqzh7lsa56lvjvaeywhvoj3wad.onion/PZ8lOWohN5xGPEYNRMJljsyK7PSBDmbUWQgY74Uvxm8TdMEXICZLVkvTBn5ubLDK

Targets

- Target
  
  5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c
- Size
  
  2.1MB
- MD5
  
  6552b8bf9ba6a4931548fe65cde76ad4
- SHA1
  
  0c81ed07b0fcc9b8a4ff983ed83dd1c83c8fa600
- SHA256
  
  5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c
- SHA512
  
  4421f18fc7b276977366f4099e0602947b85ab0f0b7a75e818389d35b3d8e9d0b81b8128ef47dff47a45e4541d23512267139f361822e18b7bb807105071448d
Score

10^/10

conti ransomware spyware stealer
- Conti Ransomware
  Ransomware generally thought to be a successor to Ryuk.
  ransomware conti
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2