General

  • Target

    d6fb956ada8728768d0bfeb98402cbb4db0358fa2c0a28966669e770d72b75a5

  • Size

    170KB

  • Sample

    220215-yltp3aagej

  • MD5

    5d886bff094134eaa420fb1a267bfd39

  • SHA1

    30dc66ee65bfc623a4424ea01971a5baebc9f890

  • SHA256

    d6fb956ada8728768d0bfeb98402cbb4db0358fa2c0a28966669e770d72b75a5

  • SHA512

    bd162509ecaed4fefd08e639e8cf906c31fb974c35d85eb8c93cc265637aa54829ed324dcfc10a6bdd33893f77d595be463b0264639b7d4e4886274f3c89d0d5

Score
10/10

Malware Config

Extracted

Path

C:\readme.txt

Family

conti

Ransom Note
All of your files are currently encrypted by CONTI strain. As you know (if you don't - just "google it"), all of the data that has been encrypted by our software cannot be recovered by any means without contacting our team directly. If you try to use any additional recovery software - the files might be damaged, so if you are willing to try - try it on the data of the lowest value. To make sure that we REALLY CAN get your data back - we offer you to decrypt 2 random files completely free of charge. You can contact our team directly for further instructions through our website : TOR VERSION : (you should download and install TOR browser first https://torproject.org) http://contirec7nchr45rx6ympez5rjldibnqzh7lsa56lvjvaeywhvoj3wad.onion/hWW0zm2xOkSEBHukdD8zUgX1DUK5aFCe6uNRJBn25Y0f8jSoVA1dgbbIqnVvfYKg YOU SHOULD BE AWARE! Just in case, if you try to ignore us. We've downloaded a pack of your internal data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us as soon as possible. ---BEGIN ID--- hWW0zm2xOkSEBHukdD8zUgX1DUK5aFCe6uNRJBn25Y0f8jSoVA1dgbbIqnVvfYKg ---END ID---
URLs

http://contirec7nchr45rx6ympez5rjldibnqzh7lsa56lvjvaeywhvoj3wad.onion/hWW0zm2xOkSEBHukdD8zUgX1DUK5aFCe6uNRJBn25Y0f8jSoVA1dgbbIqnVvfYKg

Targets

    • Target

      d6fb956ada8728768d0bfeb98402cbb4db0358fa2c0a28966669e770d72b75a5

    • Size

      170KB

    • MD5

      5d886bff094134eaa420fb1a267bfd39

    • SHA1

      30dc66ee65bfc623a4424ea01971a5baebc9f890

    • SHA256

      d6fb956ada8728768d0bfeb98402cbb4db0358fa2c0a28966669e770d72b75a5

    • SHA512

      bd162509ecaed4fefd08e639e8cf906c31fb974c35d85eb8c93cc265637aa54829ed324dcfc10a6bdd33893f77d595be463b0264639b7d4e4886274f3c89d0d5

    Score
    10/10
    • Conti Ransomware

      Ransomware generally thought to be a successor to Ryuk.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Drops desktop.ini file(s)

MITRE ATT&CK Enterprise v6

Tasks