General

  • Target

    e6e248be24782f28a492055ebb35886ad057d8a5ff4d7315f22af1fe29d9df0d

  • Size

    382KB

  • Sample

    240410-r3hwkaef3y

  • MD5

    26624208981e08658186ff15904ea89d

  • SHA1

    ff6256d719147c5aeab4c7c0d304fae2c82bfcf2

  • SHA256

    e6e248be24782f28a492055ebb35886ad057d8a5ff4d7315f22af1fe29d9df0d

  • SHA512

    c32ba04953064327f0902a3c521085e5a9fc2e91737ca4f43dec0cdd79dd7b3672fc4fc86145db73ebe148ae1090631d46a93bd952bd47e28452a55b17a4dd1f

  • SSDEEP

    6144:kQ9zmZjVZ4SYnWMi1mpO8EAO40DjtHOY/zm7EGZ++N7PWL2Aw:z9oV6nTp+nVOY/zm7EGZRrQw

Score
10/10

Malware Config

Extracted

Path

C:\Program Files\readme.txt

Family

conti

Ransom Note
All of your files are currently encrypted by CONTI strain. If you don't know who we are - just "Google it." As you already know, all of your data has been encrypted by our software. It cannot be recovered by any means without contacting our team directly. DON'T TRY TO RECOVER your data by yourselves. Any attempt to recover your data (including the usage of the additional recovery software) can damage your files. However, if you want to try - we recommend choosing the data of the lowest value. DON'T TRY TO IGNORE us. We've downloaded a pack of your internal data and are ready to publish it on our news website if you do not respond. So it will be better for both sides if you contact us as soon as possible. DON'T TRY TO CONTACT feds or any recovery companies. We have our informants in these structures, so any of your complaints will be immediately directed to us. So if you will hire any recovery company for negotiations or send requests to the police/FBI/investigators, we will consider this as a hostile intent and initiate the publication of whole compromised data immediately. To prove that we REALLY CAN get your data back - we offer you to decrypt two random files completely free of charge. You can contact our team directly for further instructions through our website : TOR VERSION : (you should download and install TOR browser first https://torproject.org) http://contirec7nchr45rx6ympez5rjldibnqzh7lsa56lvjvaeywhvoj3wad.onion/DQ9sVn8U7WzJxFVJd3dMDAtaNEW6O7GMDVzJN0W0W0f79MCQoEoeHks8G8NCl8SV YOU SHOULD BE AWARE! We will speak only with an authorized person. It can be the CEO, top management, etc. In case you are not such a person - DON'T CONTACT US! Your decisions and action can result in serious harm to your company! Inform your supervisors and stay calm!
URLs

http://contirec7nchr45rx6ympez5rjldibnqzh7lsa56lvjvaeywhvoj3wad.onion/DQ9sVn8U7WzJxFVJd3dMDAtaNEW6O7GMDVzJN0W0W0f79MCQoEoeHks8G8NCl8SV

Targets

    • Target

      e6e248be24782f28a492055ebb35886ad057d8a5ff4d7315f22af1fe29d9df0d

    • Size

      382KB

    • MD5

      26624208981e08658186ff15904ea89d

    • SHA1

      ff6256d719147c5aeab4c7c0d304fae2c82bfcf2

    • SHA256

      e6e248be24782f28a492055ebb35886ad057d8a5ff4d7315f22af1fe29d9df0d

    • SHA512

      c32ba04953064327f0902a3c521085e5a9fc2e91737ca4f43dec0cdd79dd7b3672fc4fc86145db73ebe148ae1090631d46a93bd952bd47e28452a55b17a4dd1f

    • SSDEEP

      6144:kQ9zmZjVZ4SYnWMi1mpO8EAO40DjtHOY/zm7EGZ++N7PWL2Aw:z9oV6nTp+nVOY/zm7EGZRrQw

    Score
    10/10
    • Conti Ransomware

      Ransomware generally thought to be a successor to Ryuk.

    • Renames multiple (7936) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Drops startup file

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v13

Defense Evasion

Modify Registry

1
T1112

Impact

Defacement

1
T1491

Tasks