Overview

overview

10

Static

static

3

f218bd818d...d6.exe

windows7-x64

10

f218bd818d...d6.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6

  • Size

    515KB

  • Sample

    240908-s1v9jstelk

  • MD5

    83848a20f22e2db86b700520b5c3af69

  • SHA1

    71c1d23dd905ae91183d61d6f703fb803b5c3926

  • SHA256

    f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6

  • SHA512

    b1f9cd195e3ec3144efdf132a2a34bc59ad41309cd29cfc7625b8fcf30f18e5a540a203b6f17c75332c25af70019c4f3a7619e4db3b0ad2e7d7743a2a6233876

  • SSDEEP

    3072:uPaYEBc2jrORnQssIJkP52+JKY8/d7epmB98g89QP2EKO0+5Wk29YKvaEAJ:zYEBc2jMQsdJkQ+J+/dB9rP2v+5RS

Score
10/10
contidiscoveryransomware

Malware Config

Extracted

Path

C:\Program Files (x86)\readme.txt

Family

conti

Ransom Note
All of your files are currently encrypted by CONTI strain. As you know (if you don't - just "google it"), all of the data that has been encrypted by our software cannot be recovered by any means without contacting our team directly. If you try to use any additional recovery software - the files might be damaged, so if you are willing to try - try it on the data of the lowest value. To make sure that we REALLY CAN get your data back - we offer you to decrypt 2 random files completely free of charge. You can contact our team directly for further instructions through our website : TOR VERSION : (you should download and install TOR browser first https://torproject.org) http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/ HTTPS VERSION : https://contirecovery.xyz/ YOU SHOULD BE AWARE! Just in case, if you try to ignore us. We've downloaded a pack of your internal data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us as soon as possible. ---BEGIN ID--- ec5sSORrGN3JYtjUtK7QvDv7ZtnFwgcUnCEmqJITc9YfyoAPydlyCoE1FHyB8wCq ---END ID---
URLs

http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/

https://contirecovery.xyz/

Targets

    • Target

      f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6

    • Size

      515KB

    • MD5

      83848a20f22e2db86b700520b5c3af69

    • SHA1

      71c1d23dd905ae91183d61d6f703fb803b5c3926

    • SHA256

      f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6

    • SHA512

      b1f9cd195e3ec3144efdf132a2a34bc59ad41309cd29cfc7625b8fcf30f18e5a540a203b6f17c75332c25af70019c4f3a7619e4db3b0ad2e7d7743a2a6233876

    • SSDEEP

      3072:uPaYEBc2jrORnQssIJkP52+JKY8/d7epmB98g89QP2EKO0+5Wk29YKvaEAJ:zYEBc2jMQsdJkQ+J+/dB9rP2v+5RS

    Score
    10/10
    contidiscoveryransomware

    • Conti Ransomware

      Ransomware generally thought to be a successor to Ryuk.

      ransomwareconti
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks