General
- Target 2026-08-06_37c2cef9781617f8616c102348a4cf77_conti
- Size 20KB
- Sample260806-b47cjsbp6t
- SHA256 91ec8ed60d49abe63bf0fcc142772bfba17672049267aa4f76102773d92e79fb
- MD5 37c2cef9781617f8616c102348a4cf77
- SHA1 74b7ba25db4bd0c5487afd550bdd99d769365388
- SHA512 9f14f770a2d01d34ef749c0857f4436c77244bf2f7b0bc2153f71fc3054fdc1dad37c84103472b7ec85005fe9b6e5926937d8bca17a460acf6db2793e4a36c67
- SSDEEP 192:hrOu48AmoY81p+fR4GGqtkxz6Mct6sdsMfqmJhCsqAvjLrKfyKf1kfEEiFqmgoPx:JEmScGquFct3PhP+6KaglPBCW
- TLSH T17692090EB3D314EEC962C178F7E79277E6F5F811046A6B2E5294C8352F20E946B3D246
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-06_37c2cef9781617f8616c102348a4cf77_conti.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-06_37c2cef9781617f8616c102348a4cf77_conti.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-06_37c2cef9781617f8616c102348a4cf77_conti
- Size 20KB
- SHA256 91ec8ed60d49abe63bf0fcc142772bfba17672049267aa4f76102773d92e79fb
- MD5 37c2cef9781617f8616c102348a4cf77
- SHA1 74b7ba25db4bd0c5487afd550bdd99d769365388
- SHA512 9f14f770a2d01d34ef749c0857f4436c77244bf2f7b0bc2153f71fc3054fdc1dad37c84103472b7ec85005fe9b6e5926937d8bca17a460acf6db2793e4a36c67
- SSDEEP 192:hrOu48AmoY81p+fR4GGqtkxz6Mct6sdsMfqmJhCsqAvjLrKfyKf1kfEEiFqmgoPx:JEmScGquFct3PhP+6KaglPBCW
- TLSH T17692090EB3D314EEC962C178F7E79277E6F5F811046A6B2E5294C8352F20E946B3D246
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables Discord URL observed in first stage droppers
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.