Extracted

Extracted

• • Target
    2026-08-18_44fce1705f8554357c9c95282fb23e5a_conti
  • Size 256KB
  • SHA256 f2bea11f3eb295b10d852de7de63c3b7904919008fc12430b80713d8de48dd2a
  • MD5 44fce1705f8554357c9c95282fb23e5a
  • SHA1 039095b03b3dd36dbd17a253da07ca2922c44868
  • SHA512 8c4bc9de5a2d2e161c50728e1544d3b94da7cca4c66add0337f07e5cd326e058fe42a6737867346ab3b4dd02a6471b8c6709164e7fcf0c99ca7253d3de087e12
  • SSDEEP 6144:5RBopuHyMmfP352vC3Dz2AgNwShD5XU9k5:5rodPZblgNRhl6I
  • TLSH
    T18D441285BE1757FDCC13E23AE54A8FB0D9A0E9120408EE769274E2F62D254C5CBBD807
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwarespywarestealer

  • Disables Task Manager via registry modification

    defense_evasion

  • Drops file in Drivers directory

  • Manipulates Digital Signatures

    Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

  • Boot or Logon Autostart Execution: Print Processors

    Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

    persistence

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory

  • Modifies termsrv.dll

    Commonly used to allow simultaneous RDP sessions.

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2