General
-
Target
49b2c44d9a304035e586a15c1eb06101dcd64cdc17b64a0d69d253e653ff25a7
-
Size
191KB
-
Sample
240225-gayq7sch36
-
MD5
bc92ea510a5630c770d9443be4b40fde
-
SHA1
a9373b14ef1167139615840a3bffcb22692ef1f3
-
SHA256
49b2c44d9a304035e586a15c1eb06101dcd64cdc17b64a0d69d253e653ff25a7
-
SHA512
02eedf5ab6ba77616f4074e10b12296e96b76b627274de56b408d1f35b53ed4bf80547e19e7799d3b04cd5884ae7e184cf14998f0cf4da5c8aa3185924fa277c
-
SSDEEP
3072:tPIJkdhKgxqN5EiRaUvg9HX3oKj2orU9FLBD9ZKq9gvPK3KU9:tAJkdog+5EiRaUvMnoG29JD3KL6
Static task
static1
Behavioral task
behavioral1
Sample
49b2c44d9a304035e586a15c1eb06101dcd64cdc17b64a0d69d253e653ff25a7.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
49b2c44d9a304035e586a15c1eb06101dcd64cdc17b64a0d69d253e653ff25a7.exe
Resource
win10v2004-20240221-en
Malware Config
Extracted
C:\Program Files (x86)\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.best
Targets
-
-
Target
49b2c44d9a304035e586a15c1eb06101dcd64cdc17b64a0d69d253e653ff25a7
-
Size
191KB
-
MD5
bc92ea510a5630c770d9443be4b40fde
-
SHA1
a9373b14ef1167139615840a3bffcb22692ef1f3
-
SHA256
49b2c44d9a304035e586a15c1eb06101dcd64cdc17b64a0d69d253e653ff25a7
-
SHA512
02eedf5ab6ba77616f4074e10b12296e96b76b627274de56b408d1f35b53ed4bf80547e19e7799d3b04cd5884ae7e184cf14998f0cf4da5c8aa3185924fa277c
-
SSDEEP
3072:tPIJkdhKgxqN5EiRaUvg9HX3oKj2orU9FLBD9ZKq9gvPK3KU9:tAJkdog+5EiRaUvMnoG29JD3KL6
Score10/10-
Renames multiple (8015) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file
-
Drops desktop.ini file(s)
-