conti | d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc

General

Target
d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc
Size 322KB
Sample260905-g9knmaybrd
SHA256 d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc
MD5 9152cb45994adab4dc27c33ee72a66e1
SHA1 ab0c3361bf3ab8b7c40883b2d3107aa7f1d7428b
SHA512 72476572d55860c7655a846ab8a7d32fa4c5ac08d4eb68a75a8a9733a243998dc5835e2014fbb823615f2e8f16d82d7252812098294a8d823ecd981a5490d681
SSDEEP 6144:kbIcqOrL3sxz5nq0d2Uyr7COWDzO2beJf/kCeg4ZRD:5cqOHEVnqnUy/COWDzneJW
TLSH
T118649D30BA90C036E0B71DF445B6C3B8692B7DB2972451CBE2D42BEA56346E5DC31B87
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\ProgramData\readme.txt

conti

Ransom Note

All of your files are currently encrypted by CONTI ransomware. If you try to use any additional recovery software - the files might be damaged or lost. To make sure that we REALLY CAN recover data - we offer you to decrypt samples. You can contact us for further instructions through: Our website TOR VERSION : (you should download and install TOR browser first https://torproject.org) http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/ HTTPS VERSION : https://contirecovery.top YOU SHOULD BE AWARE! Just in case, if you try to ignore us. We've downloaded your data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us ASAP. ---BEGIN ID--- LBCiop0VqOZuBBpA5nE826srUH9zTB8NeLk9dWX69K4nuopOjult1Wz9EY5DwmXn ---END ID---

URLs

http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.top

Targets

- Target
  d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc
- Size 322KB
- SHA256 d21c71a090cd6759efc1f258b4d087e82c281ce65a9d76f20a24857901e694fc
- MD5 9152cb45994adab4dc27c33ee72a66e1
- SHA1 ab0c3361bf3ab8b7c40883b2d3107aa7f1d7428b
- SHA512 72476572d55860c7655a846ab8a7d32fa4c5ac08d4eb68a75a8a9733a243998dc5835e2014fbb823615f2e8f16d82d7252812098294a8d823ecd981a5490d681
- SSDEEP 6144:kbIcqOrL3sxz5nq0d2Uyr7COWDzO2beJf/kCeg4ZRD:5cqOHEVnqnUy/COWDzneJW
- TLSH
  T118649D30BA90C036E0B71DF445B6C3B8692B7DB2972451CBE2D42BEA56346E5DC31B87
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery execution conti persistence privilege_escalation ransomware spyware stealer
- Family: Conti Ransomware
  Ransomware generally thought to be a successor to Ryuk.
  ransomware conti
- Renames multiple (6379) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
behavioral1