Overview

overview

10

Static

static

61a17892a4...4b.exe

windows7_x64

10

61a17892a4...4b.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    61a17892a491b33ce44c7c62950bdc7a4e5e14defa0e53e41d4ebdaf2ebac04b

  • Size

    310KB

  • Sample

    220329-zmd7fabah6

  • MD5

    bafabf22676cb0516d39a29e4b1f6bba

  • SHA1

    901d0dd5488f9d76021ea94c75c77b17e55ced4a

  • SHA256

    61a17892a491b33ce44c7c62950bdc7a4e5e14defa0e53e41d4ebdaf2ebac04b

  • SHA512

    e5f696a0d142cc201de54898557fac38778e8ce5e9969b3d8666bf8a5e8331b3bada65a6de17ce16a5a4cff533ccffbff09d5d949d3f2ae6db5bc632619d209b

Score
10/10
contidaveransomware

Malware Config

Extracted

Path

C:\readme.txt

Family

conti

Ransom Note
All of your files are currently encrypted by CONTI ransomware. If you try to use any additional recovery software - the files might be damaged or lost. To make sure that we REALLY CAN recover data - we offer you to decrypt samples. You can contact us for further instructions through: Our email [email protected] Our website TOR VERSION : (you should download and install TOR browser first https://torproject.org) http://m232fdxbfmbrcehbrj5iayknxnggf6niqfj6x4iedrgtab4qupzjlaid.onion HTTPS VERSION : contirecovery.best YOU SHOULD BE AWARE! Just in case, if you try to ignore us. We've downloaded your data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us ASAP ---BEGIN ID--- r1m0powNo66txhNNT8jbLjxSeYwak8M9MWeYiUHeWKV1wjW46XyPao2FejwARuCT ---END ID---
URLs

http://m232fdxbfmbrcehbrj5iayknxnggf6niqfj6x4iedrgtab4qupzjlaid.onion

https://contirecovery.best

Targets

    • Target

      61a17892a491b33ce44c7c62950bdc7a4e5e14defa0e53e41d4ebdaf2ebac04b

    • Size

      310KB

    • MD5

      bafabf22676cb0516d39a29e4b1f6bba

    • SHA1

      901d0dd5488f9d76021ea94c75c77b17e55ced4a

    • SHA256

      61a17892a491b33ce44c7c62950bdc7a4e5e14defa0e53e41d4ebdaf2ebac04b

    • SHA512

      e5f696a0d142cc201de54898557fac38778e8ce5e9969b3d8666bf8a5e8331b3bada65a6de17ce16a5a4cff533ccffbff09d5d949d3f2ae6db5bc632619d209b

    Score
    10/10
    contidaveransomware

    • Conti Ransomware

      Ransomware generally thought to be a successor to Ryuk.

      ransomwareconti

    • Dave packer

      Detects executable using a packer named 'Dave' by the community, based on a string at the end.

      dave

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks