conti | 16cc7519945bace49ef729e69db7d19e00252f2bd559903e1631c8878c2360f4

General

Target
sub_16cc7519945b.bin
Size 163KB
Sample260524-bt764agy31
SHA256 16cc7519945bace49ef729e69db7d19e00252f2bd559903e1631c8878c2360f4
MD5 73a84e02b9a4b3c967e1cd70e860d9b0
SHA1 14f6fd18754e78740f23448b7f3784b9675e5156
SHA512 9d346e3d23b1429878cc86a3d92660db3d36f9835a78ba8ef9280dc49c192a4745e2e08812206a66819e4ee738e8c36a82f57f26d04e5cd66f4a4aa8ba72468f
SSDEEP 3072:XXnj8/S996sLWfxY8+DAxzkf7/Wih73i7SEWCFje0TQmDyFnrAi:X3jmS996sL98pxzkf7OAytWY+3x8i
TLSH
T198F37E26F181E1B3F4B3007412EB9B725D79BA391B7545DB73401B291A301E26A3EA7F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files (x86)\readme.txt

conti

Ransom Note

All of your files are currently encrypted by CONTI strain. If you don't know who we are - just "Google it." As you already know, all of your data has been encrypted by our software. It cannot be recovered by any means without contacting our team directly. DON'T TRY TO RECOVER your data by yourselves. Any attempt to recover your data (including the usage of the additional recovery software) can damage your files. However, if you want to try - we recommend choosing the data of the lowest value. DON'T TRY TO IGNORE us. We've downloaded a pack of your internal data and are ready to publish it on our news website if you do not respond. So it will be better for both sides if you contact us as soon as possible. DON'T TRY TO CONTACT feds or any recovery companies. We have our informants in these structures, so any of your complaints will be immediately directed to us. So if you will hire any recovery company for negotiations or send requests to the police/FBI/investigators, we will consider this as a hostile intent and initiate the publication of whole compromised data immediately. To prove that we REALLY CAN get your data back - we offer you to decrypt two random files completely free of charge. You can contact our team directly for further instructions through our website : TOR VERSION : (you should download and install TOR browser first https://torproject.org) http://contirec7nchr45rx6ympez5rjldibnqzh7lsa56lvjvaeywhvoj3wad.onion/WopXZ9Pm5nFBPcUKJV8pgTiGnvgeL4pkSTv2h01krJNlw1Y1L8QGRcX66W6qw7Wl YOU SHOULD BE AWARE! We will speak only with an authorized person. It can be the CEO, top management, etc. In case you are not such a person - DON'T CONTACT US! Your decisions and action can result in serious harm to your company! Inform your supervisors and stay calm!

URLs

http://contirec7nchr45rx6ympez5rjldibnqzh7lsa56lvjvaeywhvoj3wad.onion/WopXZ9Pm5nFBPcUKJV8pgTiGnvgeL4pkSTv2h01krJNlw1Y1L8QGRcX66W6qw7Wl

Targets

- Target
  sub_16cc7519945b.bin
- Size 163KB
- SHA256 16cc7519945bace49ef729e69db7d19e00252f2bd559903e1631c8878c2360f4
- MD5 73a84e02b9a4b3c967e1cd70e860d9b0
- SHA1 14f6fd18754e78740f23448b7f3784b9675e5156
- SHA512 9d346e3d23b1429878cc86a3d92660db3d36f9835a78ba8ef9280dc49c192a4745e2e08812206a66819e4ee738e8c36a82f57f26d04e5cd66f4a4aa8ba72468f
- SSDEEP 3072:XXnj8/S996sLWfxY8+DAxzkf7/Wih73i7SEWCFje0TQmDyFnrAi:X3jmS996sL98pxzkf7OAytWY+3x8i
- TLSH
  T198F37E26F181E1B3F4B3007412EB9B725D79BA391B7545DB73401B291A301E26A3EA7F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery conti ransomware spyware stealer
- Family: Conti Ransomware
  Ransomware generally thought to be a successor to Ryuk.
  ransomware conti
- Renames multiple (9269) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2