Overview

overview

10

Static

static

4594624a82...ce.dll

windows7-x64

10

4594624a82...ce.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4594624a828fe7704559f90a45cf1db38a22ddb5e856a2003f15a3789d75e1ce

  • Size

    212KB

  • Sample

    221130-v5qwqsdg8v

  • MD5

    6e169583dad1106fb369fd9b6ebc0beb

  • SHA1

    c4bc5650e26855bc7b54da693ffbbb90c088268e

  • SHA256

    4594624a828fe7704559f90a45cf1db38a22ddb5e856a2003f15a3789d75e1ce

  • SHA512

    11c62dec0223d7249fe8f5b2716582703fe9c052d80772358c8b0f3aa27607940f446fc7146731a9f7a8e14541ee3b99848db7679199ab96d948c0c0a079aa3d

  • SSDEEP

    3072:9qKXlgNpgKCfzCLfDLG9dRdHkWqmXKipBAI/xRfvDMTo2tc:zKgVfGLfPG9dE4pBAoxuc

Score
10/10
contiransomware

Malware Config

Extracted

Path

C:\readme.txt

Family

conti

Ransom Note
All of your files are currently encrypted by CONTI ransomware. If you try to use any additional recovery software - the files might be damaged or lost. To make sure that we REALLY CAN recover data - we offer you to decrypt samples. You can contact us for further instructions through: Our website TOR VERSION : (you should download and install TOR browser first https://torproject.org) http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/ HTTPS VERSION : https://contirecovery.best YOU SHOULD BE AWARE! Just in case, if you try to ignore us. We've downloaded your data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us ASAP ---BEGIN ID--- g1lTzZjVPrqCZPVYj1UwpeupnaGidaVdVAVF8QyXhd5MeNX2bcl2zZYyzkMNUVUh ---END ID---
URLs

http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/

https://contirecovery.best

Targets

    • Target

      4594624a828fe7704559f90a45cf1db38a22ddb5e856a2003f15a3789d75e1ce

    • Size

      212KB

    • MD5

      6e169583dad1106fb369fd9b6ebc0beb

    • SHA1

      c4bc5650e26855bc7b54da693ffbbb90c088268e

    • SHA256

      4594624a828fe7704559f90a45cf1db38a22ddb5e856a2003f15a3789d75e1ce

    • SHA512

      11c62dec0223d7249fe8f5b2716582703fe9c052d80772358c8b0f3aa27607940f446fc7146731a9f7a8e14541ee3b99848db7679199ab96d948c0c0a079aa3d

    • SSDEEP

      3072:9qKXlgNpgKCfzCLfDLG9dRdHkWqmXKipBAI/xRfvDMTo2tc:zKgVfGLfPG9dE4pBAoxuc

    Score
    10/10
    contiransomware

    • Conti Ransomware

      Ransomware generally thought to be a successor to Ryuk.

      ransomwareconti

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks