2026-10-27_ec06c9503a92da14faf875b74e941c28_conti

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-27_ec06c9503a92da14faf875b74e941c28_conti
Size 109KB
Sample261027-22d64avz7k
SHA256 a23b105172248f031c564c5354a7e24a5fdc94c2f8140f1cc72c7e73e07eb7ae
MD5 ec06c9503a92da14faf875b74e941c28
SHA1 2330de8e54c664a8e9fd76461f622117adb99b3e
SHA512 0255a5ecea8d989d096544748f17ee1828a9629b2587b998098cdfd52a71255b9e9772df5a92bda7ae52571207b8db63c9c7a3f7bc9fe6cdbeb590f5fb719202
SSDEEP 1536:7dNOeK6ymFB71+kcakSCkQtAHUmJHUJhO1JyT0QdYO+oZvqvWkMKqugA0GQOpQRU:zv4OsakSJQtAHbHUJhoydhqOkl7puER
TLSH
T105B34C2FF29240BDC647C1B88AFF9332A732F42516307B6E57A8C6515F90A602F3D596
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-27_ec06c9503a92da14faf875b74e941c28_conti

File Explorer

2026-10-27_ec06c9503a92da14faf875b74e941c28_conti

.exe 109KB

2026-10-27_ec06c9503a92da14faf875b74e941c28_conti

IMPHASH 9264c5225a55a573d0b129a22c6b1700
SHA256 a23b105172248f031c564c5354a7e24a5fdc94c2f8140f1cc72c7e73e07eb7ae
MD5 ec06c9503a92da14faf875b74e941c28
SHA1 2330de8e54c664a8e9fd76461f622117adb99b3e
SHA512 0255a5ecea8d989d096544748f17ee1828a9629b2587b998098cdfd52a71255b9e9772df5a92bda7ae52571207b8db63c9c7a3f7bc9fe6cdbeb590f5fb719202
SSDEEP 1536:7dNOeK6ymFB71+kcakSCkQtAHUmJHUJhO1JyT0QdYO+oZvqvWkMKqugA0GQOpQRU:zv4OsakSJQtAHbHUJhoydhqOkl7puER
TLSH
T105B34C2FF29240BDC647C1B88AFF9332A732F42516307B6E57A8C6515F90A602F3D596
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

cygmandb-2-7-6-1

compare_ids database dbdelete dblookup_all dblookup_pattern dbprintf dbver_rd free_mandata_struct man_gdbm_close man_gdbm_open_wrapper

cygwin1

__assert_func __cxa_atexit __errno __getreent __locale_ctype_ptr __main _dll_crt0 _impure_ptr abort access atoi bsearch calloc canonicalize_file_name chdir chmod close closedir cygwin_detach_dll cygwin_internal dll_dllcrt0 dup error exit fclose fcntl fflush fopen fprintf fputs free fwrite getc getenv getline isatty localtime lstat malloc memcpy mkstemp open opendir posix_memalign printf putchar puts qsort readdir realloc rename setenv sscanf stat stpcpy strcasecmp strcasestr strchr strcmp strcpy strcspn strlen strncasecmp strncat strncmp strncpy strrchr strsep strstr strtok tcgetattr tcsetattr time umask unlink

cygiconv-2

libiconv libiconv_close libiconv_open

cygintl-8

_nl_msg_cat_cntr libintl_gettext libintl_setlocale

cygpipeline-1

pipecmd_arg pipecmd_argf pipecmd_args pipecmd_argstr pipecmd_argv pipecmd_chdir pipecmd_discard_err pipecmd_fchdir pipecmd_free pipecmd_new pipecmd_new_args pipecmd_new_argstr pipecmd_new_function pipecmd_new_passthrough pipecmd_new_sequence pipecmd_nice pipecmd_sequence_command pipecmd_setenv pipeline_command pipeline_command_args pipeline_command_argstr pipeline_connect pipeline_dump pipeline_free pipeline_get_command pipeline_get_ncommands pipeline_ignore_signals pipeline_install_post_fork pipeline_new pipeline_new_command_args pipeline_new_commands pipeline_peek pipeline_peek_skip pipeline_peekline pipeline_pump pipeline_read pipeline_readline pipeline_run pipeline_set_command pipeline_start pipeline_tostring pipeline_wait pipeline_want_out

kernel32

GetModuleHandleA GetModuleHandleW GetProcAddress

cygman-2-7-6-1

appendstr argp_error argp_parse argp_state_help base_name check_preprocessor_encoding comp_list create_tempdir debug debug_error debug_level decompress_fdopen decompress_open dir_name directory_on_path do_system_drop_privs drop_effective_privs escape_shell find_charset_locale free_cwd get_canonical_charset_name get_default_device get_groff_preconv get_jless_charset get_less_charset get_line_length get_locale_charset get_output_encoding get_page_encoding get_roff_encoding get_source_encoding gnu_fnmatch hashtable_create hashtable_free hashtable_install hashtable_lookup hashtable_remove init_debug init_locale is_changed is_directory is_roff_device lang_dir order_files pop_all_cleanups pop_cleanup push_cleanup regain_effective_privs remove_directory restore_cwd rpl_glob rpl_globfree rpl_regexec rpl_regfree save_cwd utimens xalloc_die xasprintf xgetcwd xmalloc xrealloc xregcomp xstrdup xstrndup xzalloc

Name

.text

Size

57KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-27_ec06c9503a92da14faf875b74e941c28_conti

cygmandb-2-7-6-1

cygwin1

cygiconv-2

cygintl-8

cygpipeline-1

kernel32

cygman-2-7-6-1

generic