Overview

overview

10

Static

static

3

sub_81792fcbaad8.exe

windows10-2004-x64

10

sub_81792fcbaad8.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    sub_81792fcbaad8.bin
  • Size 101KB
  • Sample260524-bt764agy3z
  • SHA256 81792fcbaad868d2e4aca1ed372f4a5abb34372d3265d5712a65cdfe05e42df8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
conticredential_accessdiscoveryransomwarestealer

Malware Config

Targets

    • Target
      sub_81792fcbaad8.bin
    • Size 101KB
    • SHA256 81792fcbaad868d2e4aca1ed372f4a5abb34372d3265d5712a65cdfe05e42df8
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    credential_accessdiscoverycontiransomwarestealer

    • Family: Conti Ransomware

      Ransomware generally thought to be a successor to Ryuk.

      ransomwareconti

    • Renames multiple (335) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Drops desktop.ini file(s)

    • Network Share Discovery

      Attempt to gather information on host network.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks