conti | 3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba

General

Target

3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba
Size

514KB
Sample

240909-xt4dsswhra
MD5

a9989d691d4a509fba4fbc2a26bcb54f
SHA1

0e7e0d1ae5ec4d691de59892aa45ee80069e079d
SHA256

3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba
SHA512

eeae35103e66711cd8015ff4d0ee3c36eb030b5b6f326177075f5a02328ead68ebcad3f839ae3ef50bf8e4444aa9c597bd9b8ba25989ba1a2de9722d29f2b429
SSDEEP

3072:fvOXfbBI4++rye6iLfv7FizEPB5Oe4UKXqlc8Lm87wgZPyzOmem0:eXzin6jwUKXSL/hIOH

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files (x86)\readme.txt

Family

conti

Ransom Note

All of your files are currently encrypted by CONTI strain. As you know (if you don't - just "google it"), all of the data that has been encrypted by our software cannot be recovered by any means without contacting our team directly. If you try to use any additional recovery software - the files might be damaged, so if you are willing to try - try it on the data of the lowest value. To make sure that we REALLY CAN get your data back - we offer you to decrypt 2 random files completely free of charge. You can contact our team directly for further instructions through our website : TOR VERSION : (you should download and install TOR browser first https://torproject.org) http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/ HTTPS VERSION : https://contirecovery.click YOU SHOULD BE AWARE! Just in case, if you try to ignore us. We've downloaded a pack of your internal data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us as soon as possible. ---BEGIN ID--- lWL5aqUDwBJQsqHmM6OkU1yOTGOiNHcCdTAyuj6A1xKUIz98qMCGpifNoPeYSXBA ---END ID---

URLs

http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/

https://contirecovery.click

Targets

- Target
  
  3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba
- Size
  
  514KB
- MD5
  
  a9989d691d4a509fba4fbc2a26bcb54f
- SHA1
  
  0e7e0d1ae5ec4d691de59892aa45ee80069e079d
- SHA256
  
  3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba
- SHA512
  
  eeae35103e66711cd8015ff4d0ee3c36eb030b5b6f326177075f5a02328ead68ebcad3f839ae3ef50bf8e4444aa9c597bd9b8ba25989ba1a2de9722d29f2b429
- SSDEEP
  
  3072:fvOXfbBI4++rye6iLfv7FizEPB5Oe4UKXqlc8Lm87wgZPyzOmem0:eXzin6jwUKXSL/hIOH
Score

10^/10

conti credential_access discovery ransomware spyware stealer
- Conti Ransomware
  Ransomware generally thought to be a successor to Ryuk.
  ransomware conti
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Renames multiple (7923) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2