2026-07-01_2c9b408bba47c68ca8fb58fd41c94f99_conti

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-01_2c9b408bba47c68ca8fb58fd41c94f99_conti
Size 48KB
Sample260701-mbacwsbv2q
SHA256 a3628236cd0b13b35e9d51df823a443a6d5402ca59764cea0057e41ee5039f56
MD5 2c9b408bba47c68ca8fb58fd41c94f99
SHA1 a18511fde4a4137ba8bf2f22c2259d64261439f9
SHA512 1868018da20237c1a69c375c7492660c4c3177bcffedb2c01d536a8dba2df10b3cf8bebb1adc4db3807d5f584baa7a65cf43bb18b0db3a66df22bf9a32f9bb9e
SSDEEP 768:ppXl4VpqqM/62wbyNFVjJKvki0qHzwlmqfFtZTs+7RSW:pmpIGaFJJKv7w7s+7RSW
TLSH
T12E23C71BE7A788F4C19ADA38A1DB9233E921BC1E0535577D5B44DB2A1F20F90973DB02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-01_2c9b408bba47c68ca8fb58fd41c94f99_conti

File Explorer

2026-07-01_2c9b408bba47c68ca8fb58fd41c94f99_conti

.exe 48KB

2026-07-01_2c9b408bba47c68ca8fb58fd41c94f99_conti

IMPHASH 018b2fd95a273892b4e215fb6b76ee5a
SHA256 a3628236cd0b13b35e9d51df823a443a6d5402ca59764cea0057e41ee5039f56
MD5 2c9b408bba47c68ca8fb58fd41c94f99
SHA1 a18511fde4a4137ba8bf2f22c2259d64261439f9
SHA512 1868018da20237c1a69c375c7492660c4c3177bcffedb2c01d536a8dba2df10b3cf8bebb1adc4db3807d5f584baa7a65cf43bb18b0db3a66df22bf9a32f9bb9e
SSDEEP 768:ppXl4VpqqM/62wbyNFVjJKvki0qHzwlmqfFtZTs+7RSW:pmpIGaFJJKv7w7s+7RSW
TLSH
T12E23C71BE7A788F4C19ADA38A1DB9233E921BC1E0535577D5B44DB2A1F20F90973DB02
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables Discord URL observed in first stage droppers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

bcrypt

BCryptCloseAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptImportKey BCryptOpenAlgorithmProvider BCryptSetProperty

crypt32

CryptUnprotectData

libgcc_s_seh-1

_Unwind_Resume

kernel32

DeleteCriticalSection EnterCriticalSection GetConsoleWindow GetLastError InitializeCriticalSection LeaveCriticalSection LocalFree SetUnhandledExceptionFilter Sleep TlsGetValue VirtualProtect VirtualQuery

api-ms-win-crt-environment-l1-1-0

__p__environ getenv

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-private-l1-1-0

__C_specific_handler memcpy memmove

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _cexit _configure_narrow_argv _crt_atexit _errno _exit _initialize_narrow_environment _set_app_type _initterm _initterm_e _set_invalid_parameter_handler abort exit signal system

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf fflush setvbuf

api-ms-win-crt-string-l1-1-0

memset strlen strncmp wcslen

libwinpthread-1

nanosleep64

libsqlite3-0

sqlite3_close sqlite3_column_blob sqlite3_column_bytes sqlite3_column_text sqlite3_finalize sqlite3_open sqlite3_prepare_v2 sqlite3_step

libstdc++-6

_ZNKSt10filesystem7__cxx114path11parent_pathEv _ZNKSt10filesystem7__cxx114path5_List13_Impl_deleterclEPNS2_5_ImplE _ZNKSt12__basic_fileIcE7is_openEv _ZNKSt25__codecvt_utf8_utf16_baseIwE10do_unshiftER9_MbstatetPcS3_RS3_ _ZNKSt25__codecvt_utf8_utf16_baseIwE11do_encodingEv _ZNKSt25__codecvt_utf8_utf16_baseIwE13do_max_lengthEv _ZNKSt25__codecvt_utf8_utf16_baseIwE16do_always_noconvEv _ZNKSt25__codecvt_utf8_utf16_baseIwE5do_inER9_MbstatetPKcS4_RS4_PwS6_RS6_ _ZNKSt25__codecvt_utf8_utf16_baseIwE6do_outER9_MbstatetPKwS4_RS4_PcS6_RS6_ _ZNKSt25__codecvt_utf8_utf16_baseIwE9do_lengthER9_MbstatetPKcS4_y _ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE4findEPKcyy _ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE4findEcy _ZNSt10filesystem6statusERKNS_7__cxx114pathE _ZNSt10filesystem7__cxx1116filesystem_errorC1ERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEESt10error_code _ZNSt10filesystem7__cxx1116filesystem_errorD1Ev _ZNSt10filesystem7__cxx114path14_M_split_cmptsEv _ZNSt10filesystem7__cxx114path5_ListC1ERKS2_ _ZNSt10filesystem7__cxx114path5_ListC1Ev _ZNSt10filesystem7__cxx114pathdVERKS1_ _ZNSt12__basic_fileIcED1Ev _ZNSt13basic_filebufIcSt11char_traitsIcEE4openEPKwSt13_Ios_Openmode _ZNSt13basic_filebufIcSt11char_traitsIcEE5closeEv _ZNSt13basic_filebufIcSt11char_traitsIcEEC1Ev _ZNSt13basic_filebufIcSt11char_traitsIcEED1Ev _ZNSt14basic_ifstreamIcSt11char_traitsIcEED1Ev _ZNSt25__codecvt_utf8_utf16_baseIwED2Ev _ZNSt3_V216generic_categoryEv _ZNSt6localeC1Ev _ZNSt6localeD1Ev _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE10_M_disposeEv _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE10_M_replaceEyyPKcy _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE6resizeEyc _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE9_M_assignERKS4_ _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE9_M_createERyy _ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE10_M_disposeEv _ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE6resizeEyw _ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE9_M_createERyy _ZNSt7__cxx1119basic_ostringstreamIcSt11char_traitsIcESaIcEED1Ev _ZNSt7codecvtIwc9_MbstatetEC2Ey _ZNSt8ios_baseC2Ev _ZNSt8ios_baseD2Ev _ZNSt9basic_iosIcSt11char_traitsIcEE4initEPSt15basic_streambufIcS1_E _ZNSt9basic_iosIcSt11char_traitsIcEE5clearESt12_Ios_Iostate _ZSt16__ostream_insertIcSt11char_traitsIcEERSt13basic_ostreamIT_T0_ES6_PKS3_x _ZSt19__throw_logic_errorPKc _ZSt20__throw_length_errorPKc _ZSt24__throw_out_of_range_fmtPKcz _ZTTNSt7__cxx1119basic_ostringstreamIcSt11char_traitsIcESaIcEEE _ZTTSt14basic_ifstreamIcSt11char_traitsIcEE _ZTVN10__cxxabiv117__class_type_infoE _ZTVN10__cxxabiv120__si_class_type_infoE _ZTVN10__cxxabiv121__vmi_class_type_infoE _ZTVNSt7__cxx1115basic_stringbufIcSt11char_traitsIcESaIcEEE _ZTVNSt7__cxx1119basic_ostringstreamIcSt11char_traitsIcESaIcEEE _ZTVSt13basic_filebufIcSt11char_traitsIcEE _ZTVSt14basic_ifstreamIcSt11char_traitsIcEE _ZTVSt15basic_streambufIcSt11char_traitsIcEE _ZTVSt9basic_iosIcSt11char_traitsIcEE _ZdlPvy _Znwy __cxa_allocate_exception __cxa_begin_catch __cxa_end_catch __cxa_free_exception __cxa_guard_abort __cxa_guard_acquire __cxa_guard_release __cxa_throw __gxx_personality_seh0

user32

ShowWindow

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption

Name

.text

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

160B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1024B

Virtual Size

852B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

228B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ