MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Conti


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420
SHA3-384 hash: c68063f914658b6ad66e4cca14a4aa5ca697786b01c7dc4bdb64e3c37af5c35d7b69b7090819ac3d8a692d485d627418
SHA1 hash: 6c66c4005b14c14a1029a601eeed55cab21ae713
MD5 hash: 95b62355385af3d2711b7a8e759ed664
humanhash: uniform-autumn-mirror-aspen
File name:1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420
Download: download sample
Signature Conti
Create hunting rule
File size:757'760 bytes
First seen:2020-11-04 13:54:41 UTC
Last seen:2020-12-12 00:11:31 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash d2366e64464aec8b95a9575cfbf071fc (1 x Conti)
ssdeep 12288:bCn5k6F+/VWDlO1Lc1hrEPa1LBZDx+OFSkq4P0P6:y5r+dWgcvJF5+F6
Threatray 829 similar samples on MalwareBazaar
TLSH 40F4E63AB1B40AB8D433B5BE0E1A445E69285C1C9706EB6F5E809BCBDCF1D491C5EE70
Reporter JAMESWT_WT
Tags:conti Ransomware

Intelligence

File Origin
# of uploads :
2
# of downloads :
320
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Conti
Create hunting rule
Link:
https://www.capesandbox.com/analysis/82907/
Detection(s):
PUA.Win.Packer.Armadillo-65
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Using the Windows Management Instrumentation requests
Launching a service
Launching a process
Connection attempt
Creating a file
Creating a file in the Program Files directory
Creating a file in the Program Files subdirectories
Changing a file
Moving a file to the Program Files directory
Moving a file to the Program Files subdirectory
Modifying an executable file
Creating a file in the %AppData% directory
Reading critical registry keys
Creating a file in the %AppData% subdirectories
Moving a file to the %AppData% subdirectory
Stealing user critical data
Enabling autorun by creating a file
Encrypting user's files
Infecting executable files
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
rans.evad
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/520182
Signature
Found potential dummy code loops (likely to delay analysis)
Multi AV Scanner detection for submitted file
Writes many files with high entropy
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420/
Threat name:
Win32.Ransomware.Conti
Create hunting rule
Status:
Malicious
First seen:
2020-10-29 05:28:05 UTC
File Type:
PE (Exe)
Extracted files:
72
AV detection:
24 of 28 (85.71%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=doaidoxa4sj5bgfyovvr47cldfyvu6euntzcp4wcp6jrdztrqqqa._file
Verdict:
unknown
Similar samples:
0a2e10583a6c70298eb3c353e0a15ebd98c8a9ae09db8e6cc9cef513e39c95dc
Conti
0a7e7f12d79130da067fd39ede7ff4dc3dc6665d88f5278745074d77132312bf
Conti
5d8a701110d58ab7c1aa8bae6bc9d5358b8cd508115891320e6af6c68f3bbd74
Conti
7c6afcfeac542cca2d2c998b7cedde2d45cba23357f26e4c999931c0fddfe435
Conti
7f8d213072a938b3dec61b257ef1f7e16e73b1404964364f3c2bd1f7fb24a8f9
Conti
8693fac3e1870183593f32d8c1f1b9a4715c87aedc2175aea329e81177185193
Conti
95434943bee6ebb8932959199755523af6f2da1214cc97ef9c0d4027727dd294
Conti
99a5a23e91e9bf15c0228052277496c6f12cdde681956526917f46550eb08c8c
Conti
bcf717700946e19e6645d77dfd89341cf56470a9e8dc8b45791de68ac84a7e89
Conti
ca1251a442c1aa570b127819f6d616bb355591aaea9f77e0132383f22b39549b
Conti
+ 819 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence ransomware spyware
Link:
https://tria.ge/reports/201104-3nkdcp6zps/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Modifies Control Panel
Drops file in Program Files directory
Drops file in Windows directory
Modifies service
Drops desktop.ini file(s)
Reads user/profile data of web browsers
Drops startup file
Modifies extensions of user files
Unpacked files
SH256 hash:
61dd6a0b2870d62f56c7fe0039d42bf5351588f927267fe7b4ee0761872a3b20
MD5 hash:
d3472c63da9bb4a24a03c485312f34bc
SHA1 hash:
86c9ee65e6e39910b52de15587137f7478bdca54
Link:
https://www.unpac.me/results/06302f5e-ade9-4abf-8fe2-4a7627d2f4b2/
SH256 hash:
f8c9eaeed4abdef8c8c7c9ef32097c982b0dc7b34e40be786f0b5cc9dabe3940
MD5 hash:
8d7041513e9317c4883331ab9dc24586
SHA1 hash:
d37ee346f413f22467379b028d125efe6d9065d1
Link:
https://www.unpac.me/results/06302f5e-ade9-4abf-8fe2-4a7627d2f4b2/
SH256 hash:
1b8081bae0e493d098b8756b1e7c4b19715a78946cf227f2c27f9311e6718420
MD5 hash:
95b62355385af3d2711b7a8e759ed664
SHA1 hash:
6c66c4005b14c14a1029a601eeed55cab21ae713
Link:
https://www.unpac.me/results/06302f5e-ade9-4abf-8fe2-4a7627d2f4b2/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cobalt_functions
Create hunting rule
Author:@j0sm1
Description:Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT
Rule name:IceID_Bank_trojan
Create hunting rule
Author:unixfreaxjp
Description:Detects IcedID..adjusted several times
Rule name:win_sisfader_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/82907/

Comments