conti | 19054042f099955c1a9672d87cf43275e48d0797a39f11dc8aad7e35233186b4

General

Target

19054042f099955c1a9672d87cf43275e48d0797a39f11dc8aad7e35233186b4
Size

510KB
Sample

240909-tfza5sygqd
MD5

760992a7845d46bf001c18a945f5894c
SHA1

3ba9b53bffb29f4c6f0cce90fca953d31b101542
SHA256

19054042f099955c1a9672d87cf43275e48d0797a39f11dc8aad7e35233186b4
SHA512

601b3621be17768be4f8dd4b6a943f6822ba8b6db981d88e112c7cbe5f91bb1493c10b1fdb543e16077ef08e433102eb6390985a29282f621e6fc20f3f766614
SSDEEP

3072:1Qkg5cAzJkv06HGaVpiehqpGDYwAM/cNfK89j8Qa34oYrxxt:1EcuVqTATicDNxrxb

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files (x86)\readme.txt

Family

conti

Ransom Note

All of your files are currently encrypted by CONTI strain. As you know (if you don't - just "google it"), all of the data that has been encrypted by our software cannot be recovered by any means without contacting our team directly. If you try to use any additional recovery software - the files might be damaged, so if you are willing to try - try it on the data of the lowest value. To make sure that we REALLY CAN get your data back - we offer you to decrypt 2 random files completely free of charge. You can contact our team directly for further instructions through our website : TOR VERSION : (you should download and install TOR browser first https://torproject.org) http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/ HTTPS VERSION : https://contirecovery.ws YOU SHOULD BE AWARE! Just in case, if you try to ignore us. We've downloaded a pack of your internal data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us as soon as possible. ---BEGIN ID--- XjezdRHFUimUr0tH8ArgmB2GSC70BzFRJYEeECCr4z5a0x6WoIRHtqlcNzOjkZOq ---END ID---

URLs

http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/

https://contirecovery.ws

Targets

- Target
  
  19054042f099955c1a9672d87cf43275e48d0797a39f11dc8aad7e35233186b4
- Size
  
  510KB
- MD5
  
  760992a7845d46bf001c18a945f5894c
- SHA1
  
  3ba9b53bffb29f4c6f0cce90fca953d31b101542
- SHA256
  
  19054042f099955c1a9672d87cf43275e48d0797a39f11dc8aad7e35233186b4
- SHA512
  
  601b3621be17768be4f8dd4b6a943f6822ba8b6db981d88e112c7cbe5f91bb1493c10b1fdb543e16077ef08e433102eb6390985a29282f621e6fc20f3f766614
- SSDEEP
  
  3072:1Qkg5cAzJkv06HGaVpiehqpGDYwAM/cNfK89j8Qa34oYrxxt:1EcuVqTATicDNxrxb
Score

10^/10

conti credential_access discovery ransomware stealer
- Conti Ransomware
  Ransomware generally thought to be a successor to Ryuk.
  ransomware conti
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Renames multiple (8008) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Drops startup file
- Drops desktop.ini file(s)
behavioral1 behavioral2