🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2d33ac8fce0592ef88bdeeee00e840c41a5a8fccc85c67316b74cc06c13ba0c5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Conti


Vendor detections: 11


Intelligence 11 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2d33ac8fce0592ef88bdeeee00e840c41a5a8fccc85c67316b74cc06c13ba0c5
SHA3-384 hash: 1c4376dbd44324d16759be0c047a25e56e584f44cf131819fd6783bb453de0fa4edc642b86c976da8e122890574b5190
SHA1 hash: 2fd36e604ef5f11ded128c6edcbb4c1ee5f7a91f
MD5 hash: 72acae41645beae9afeef212b9e56be9
humanhash: minnesota-happy-september-florida
File name:2d33ac8fce0592ef88bdeeee00e840c41a5a8fccc85c67316b74cc06c13ba0c5
Download: download sample
Signature Conti
Create hunting rule
File size:222'208 bytes
First seen:2022-03-02 11:07:53 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 137fa89046164fe07e0dd776ed7a0191 (7 x Conti)
ssdeep 3072:a6ZPkBIwEgmmX9WJ3yubwvmEuAvBRTWqSYTE2lIlMrSMLBhMs7/C26:akoItgmq9WJ3yuUeEr7TGz2liMGW9t6
Threatray 14 similar samples on MalwareBazaar
TLSH T1CF24F740B16EDBE9D1D383B88956A602BEF735C02B549EEBC3864A710D070D572EDFA1
Reporter vxunderground
Tags:conti exe Ransomware

Intelligence

File Origin
# of uploads :
1
# of downloads :
632
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/246267/
Detection(s):
Win.Ransomware.Razy-9874372-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a file
Changing a file
Creating a file in the Program Files directory
Moving a file to the Program Files directory
Creating a file in the Program Files subdirectories
Moving a file to the Program Files subdirectory
Moving a recently created file
Modifying an executable file
Reading critical registry keys
Creating a file in the mass storage device
Stealing user critical data
Encrypting user's files
Forced shutdown of a browser
Infecting executable files
Result
Malware family:
n/a
Score:
  0/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/7851/overview
Behaviour
CheckCmdLine
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
expand.exe greyware
Link:
https://www.filescan.io/uploads/621f501adfdfa8501c76a6c6/reports/26c84d4a-8a5b-4203-b0d0-1bae8ca4a5d6/overview
Malware family:
Conti
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/59863ca4-e742-407a-8e4b-1d2a074624e4
Result
Threat name:
Conti
Create hunting rule
Detection:
malicious
Classification:
rans.spre.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/949045
Signature
Antivirus / Scanner detection for submitted sample
Connects to many different private IPs (likely to spread or exploit)
Found ransom note / readme
Found Tor onion address
Infects executable files (exe, dll, sys, html)
Multi AV Scanner detection for submitted file
Sigma detected: Regsvr32 Network Activity
Sigma detected: Suspicious Call by Ordinal
System process connects to network (likely due to code injection or exploit)
Writes many files with high entropy
Yara detected Conti ransomware
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2d33ac8fce0592ef88bdeeee00e840c41a5a8fccc85c67316b74cc06c13ba0c5/
Threat name:
Win64.Ransomware.Conti
Create hunting rule
Status:
Malicious
First seen:
2022-03-02 02:36:00 UTC
File Type:
PE+ (Dll)
Extracted files:
1
AV detection:
26 of 43 (60.47%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fuz2zd6oawjo7cf553xab2cayqnfvd6mzbogomllotganqj3udcq._file
Verdict:
malicious
Similar samples:
1dea453e5344898c9a66309bd6d1cf6e21c56eb1427c026aac84b14a6b23f7fc
Conti
2586026617b117506dfe326f50e45476ce765a74fe48c8650d32980a4dfe5ee9
Conti
930ec6d08e9d29fa23805ff9784cb0d78b1dc4cc4d58daa0e653dfe478c45d3a
Conti
a79dcac3753c055d7b46b5ffa27b1b4bb55516180966f20a2878698b81638137
Conti
cf487bd54e487585cd052e982fd765cbc0d8d164cc21b8635e55475182dadf00
Conti
ed4afa874e75b7bac665b9bcbf1d8e1324d4f9263c862755101cd79bb087ad45
Conti
+ 4 additional samples on MalwareBazaar
Result
Malware family:
conti
Create hunting rule
Score:
  10/10
Tags:
family:conti ransomware
Link:
https://tria.ge/reports/220302-m8k6naefc7/
Behaviour
Suspicious behavior: EnumeratesProcesses
Drops file in Program Files directory
Drops desktop.ini file(s)
Modifies extensions of user files
Conti Ransomware
Unpacked files
SH256 hash:
2d33ac8fce0592ef88bdeeee00e840c41a5a8fccc85c67316b74cc06c13ba0c5
MD5 hash:
72acae41645beae9afeef212b9e56be9
SHA1 hash:
2fd36e604ef5f11ded128c6edcbb4c1ee5f7a91f
Link:
https://www.unpac.me/results/075e278d-4782-493a-bc88-7690e79e845a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2d33ac8fce0592ef88bdeeee00e840c41a5a8fccc85c67316b74cc06c13ba0c5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_conti_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.conti.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/246267/

Comments