MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4f4a33f70099855f5f503716515f388da3a5daa1e2fac59ec6c881e89ef7d072. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Conti


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4f4a33f70099855f5f503716515f388da3a5daa1e2fac59ec6c881e89ef7d072
SHA3-384 hash: 6f583088de3a83d787a487bbc1b20b98224bc84cd7a7119d636f9bd78ad78197c4ca253b2e4e3b462bd14541fc1c79cc
SHA1 hash: ad738fd0a7d076575ffb7ab338fb784bab739435
MD5 hash: fdf9641f354987fe4683a27c5eb160a7
humanhash: mango-muppet-emma-paris
File name:fdf9641f_by_Libranalysis
Download: download sample
Signature Conti
Create hunting rule
File size:5'610'496 bytes
First seen:2021-05-15 10:04:32 UTC
Last seen:2021-05-15 10:48:37 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 3ee74f676f91600f7207f72c74f39257 (1 x Conti)
ssdeep 98304:UkFTD8AD1UaTda/deIAc0cqqgg+Pt2xwptdVUcVzwGA21z:VFTD8OUaTdhcIbcwp3xwO
Threatray 10 similar samples on MalwareBazaar
TLSH 9A4623671275010AE0E5CC398627BDE035F7037BCF42ECBDAADAA9C536225A4E347953
Reporter Libranalysis
Tags:conti


Avatar
Libranalysis
Uploaded as part of the sample sharing project

Intelligence

File Origin
# of uploads :
2
# of downloads :
345
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
fdf9641f_by_Libranalysis
Verdict:
Malicious activity
Analysis date:
2021-05-15 10:08:31 UTC
Tags:
ransomware
Link:
https://app.any.run/tasks/6e45ebe6-329d-40a3-8319-4940bf28d883

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/157345/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Launching the default Windows debugger (dwwin.exe)
Sending a UDP request
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/782738
Signature
Antivirus / Scanner detection for submitted sample
Detected VMProtect packer
Machine Learning detection for sample
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4f4a33f70099855f5f503716515f388da3a5daa1e2fac59ec6c881e89ef7d072/
Threat name:
Win32.Ransomware.Conti
Create hunting rule
Status:
Malicious
First seen:
2021-05-15 10:05:10 UTC
AV detection:
21 of 27 (77.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=j5fdh5yatgcv6x2qg4lfcxzyrwr2lwvb4l5mlhwgzca6rhxx2bza._file
Verdict:
malicious
Similar samples:
0f0eb4a8a538f339214f86a8b084d685a4fb51d54f258f5718393003ab1ff35b
Conti
34b09f16fa6e9789bda97d9bd512ac7f49e235982db9d65109a4078ab3567bcf
Conti
593f9422a79559ab792b98a272ebd5db883b8a85f34de6a6f05f1c900b221dc5
Conti
6ef31a13d71d059d6e007fb2305c8e2d7615c3d468c9f2f4e023b45490b50787
Conti
7499c45e246fe759ff4180bd864252689b1cbadc7825d007c7e25aa39c6a4450
Conti
7f588ecbff9405b87fa5b809b52d0b667f19a09e47bafc2cf1f5f9d5f19f16c1
Conti
7fb4f8f5f89b3fb2a4e9a6605763436ebb679198ee5ebbcde8972bb1e20a8da5
Conti
c120fd3e62a0ecd299625f3fbf622fb8a56b534828b6788fe766f1bc36ac7a68
Conti
f1aae79787fff8edd5f6769ebecf43eb5a94d392cb3723810a66dd9868ec2925
Conti
fb8a2b78f0d3139d8192dbeb925e8e8d13bf370540f2c7853107a8e4b3beac38
Conti
Result
Malware family:
conti
Create hunting rule
Score:
  10/10
Tags:
family:conti ransomware spyware stealer vmprotect
Link:
https://tria.ge/reports/210515-aanjwxhwsj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Drops file in Program Files directory
Drops desktop.ini file(s)
Reads user/profile data of web browsers
Modifies extensions of user files
VMProtect packed file
Conti Ransomware
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/4f4a33f70099855f5f503716515f388da3a5daa1e2fac59ec6c881e89ef7d072

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_VMProtect
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with VMProtect.
Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/157345/

Comments