Extracted

Extracted

• • Target
    2026-08-20_83f675ef9c33779f738fe7c41f2e681b_conti
  • Size 256KB
  • SHA256 44c0596db68f8883326675a31b2a07ef5db34bb01461a508721c6c01ceced07d
  • MD5 83f675ef9c33779f738fe7c41f2e681b
  • SHA1 5fb103f315686d82839cb5df580cb264bcfaaefd
  • SHA512 dd04c2dedd5c4dbc6709c20d2ac85f20a01eb2a49a30bec227c7bdc9a5f6069b73c6a76fa1b2de67293149f8da2baa6cfd1f0b29d1be138798a6eb4dd6fda448
  • SSDEEP 6144:+RwW8fQ7EZJRnUJN233iXDmBuQojqWN/281Lp8eaWifuajn4bVLP:+yW847EXRs+3iSuzqWNeMieaWiJj4btP
  • TLSH
    T13D44120071D391F6E95A913BD1F68DF5F26BBE2A006C597B5F85C6B02B31206D6BC087
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwarespywarestealer

  • Disables Task Manager via registry modification

    defense_evasion

  • Drops file in Drivers directory

  • Manipulates Digital Signatures

    Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

  • Boot or Logon Autostart Execution: Print Processors

    Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

    persistence

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory

  • Modifies termsrv.dll

    Commonly used to allow simultaneous RDP sessions.

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2