General
-
Target
e6e248be24782f28a492055ebb35886ad057d8a5ff4d7315f22af1fe29d9df0d
-
Size
382KB
-
Sample
240410-r3hwkaef3y
-
MD5
26624208981e08658186ff15904ea89d
-
SHA1
ff6256d719147c5aeab4c7c0d304fae2c82bfcf2
-
SHA256
e6e248be24782f28a492055ebb35886ad057d8a5ff4d7315f22af1fe29d9df0d
-
SHA512
c32ba04953064327f0902a3c521085e5a9fc2e91737ca4f43dec0cdd79dd7b3672fc4fc86145db73ebe148ae1090631d46a93bd952bd47e28452a55b17a4dd1f
-
SSDEEP
6144:kQ9zmZjVZ4SYnWMi1mpO8EAO40DjtHOY/zm7EGZ++N7PWL2Aw:z9oV6nTp+nVOY/zm7EGZRrQw
Static task
static1
Behavioral task
behavioral1
Sample
e6e248be24782f28a492055ebb35886ad057d8a5ff4d7315f22af1fe29d9df0d.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e6e248be24782f28a492055ebb35886ad057d8a5ff4d7315f22af1fe29d9df0d.dll
Resource
win10v2004-20240226-en
Malware Config
Extracted
C:\Program Files\readme.txt
conti
http://contirec7nchr45rx6ympez5rjldibnqzh7lsa56lvjvaeywhvoj3wad.onion/DQ9sVn8U7WzJxFVJd3dMDAtaNEW6O7GMDVzJN0W0W0f79MCQoEoeHks8G8NCl8SV
Targets
-
-
Target
e6e248be24782f28a492055ebb35886ad057d8a5ff4d7315f22af1fe29d9df0d
-
Size
382KB
-
MD5
26624208981e08658186ff15904ea89d
-
SHA1
ff6256d719147c5aeab4c7c0d304fae2c82bfcf2
-
SHA256
e6e248be24782f28a492055ebb35886ad057d8a5ff4d7315f22af1fe29d9df0d
-
SHA512
c32ba04953064327f0902a3c521085e5a9fc2e91737ca4f43dec0cdd79dd7b3672fc4fc86145db73ebe148ae1090631d46a93bd952bd47e28452a55b17a4dd1f
-
SSDEEP
6144:kQ9zmZjVZ4SYnWMi1mpO8EAO40DjtHOY/zm7EGZ++N7PWL2Aw:z9oV6nTp+nVOY/zm7EGZRrQw
Score10/10-
Renames multiple (7936) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file
-
Sets desktop wallpaper using registry
-