MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b39fcf37d9019cc92127ee82c03df5e37aa8238cd76cc6eca2e3d1e7e977fc26. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Conti


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b39fcf37d9019cc92127ee82c03df5e37aa8238cd76cc6eca2e3d1e7e977fc26
SHA3-384 hash: d623d74a140f19102022cca94d160c32095034fc9437a3abfd43150d894de8c56ba68d4392de4e3d99329b3e2e2e7968
SHA1 hash: e5ee986c0e58e7e0fd070888dddd3f845e5dbdf8
MD5 hash: 53c95a43491832f50e96327c1d23da40
humanhash: happy-maine-vermont-diet
File name:b39fcf37d9019cc92127ee82c03df5e37aa8238cd76cc6eca2e3d1e7e977fc26.bin
Download: download sample
Signature Conti
Create hunting rule
File size:71'955 bytes
First seen:2022-08-12 01:12:11 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 1536:G+5geBR2Q+a8M124Zl2i5SADBDg8trv4t9MBY5yN:GDeBgQ+a8M12Y2i59hrvWMBB
TLSH T12063D64AB749EA30F59794B996FC2A13688E8978835F85C3FBD0C05A7651CC6B834F13
TrID 42.7% (.EXE) Win32 Executable (generic) (4505/5/1)
19.2% (.EXE) OS/2 Executable (generic) (2029/13)
19.0% (.EXE) Generic Win/DOS Executable (2002/3)
18.9% (.EXE) DOS Executable Generic (2000/1)
Reporter Arkbird_SOLG
Tags:BlueSky conti exe old Ransomware

Intelligence

File Origin
# of uploads :
1
# of downloads :
545
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
b39fcf37d9019cc92127ee82c03df5e37aa8238cd76cc6eca2e3d1e7e977fc26.bin
Verdict:
No threats detected
Analysis date:
2022-08-12 01:13:35 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/612dc401-ad43-462d-8f1c-c0efa22f0b15

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Conti
Create hunting rule
Link:
https://www.capesandbox.com/analysis/298120/
Detection(s):
SecuriteInfo.com.Trojan.Encoder.35508.22594.6116.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/28742/overview
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
conti filecoder overlay packed ransomware windows
Link:
https://www.filescan.io/uploads/62f5a972f6ec33747d9ac484/reports/6e49be14-5f0b-46fe-8c45-179688e2f6d0/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
BlueSky Ransomware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2d2fbdc2-bcb3-4c78-af01-5ba78de0ddac
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1050308
Signature
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b39fcf37d9019cc92127ee82c03df5e37aa8238cd76cc6eca2e3d1e7e977fc26/
Threat name:
Win32.Ransomware.Conti
Create hunting rule
Status:
Malicious
First seen:
2022-08-07 00:50:56 UTC
File Type:
PE (Exe)
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wop46n6zagomsijh52bmappv4n5kqi4m25wmn3fc4pi6p2lx7qta._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/220812-bk3j9aegcm/
Unpacked files
SH256 hash:
b39fcf37d9019cc92127ee82c03df5e37aa8238cd76cc6eca2e3d1e7e977fc26
MD5 hash:
53c95a43491832f50e96327c1d23da40
SHA1 hash:
e5ee986c0e58e7e0fd070888dddd3f845e5dbdf8
Link:
https://www.unpac.me/results/8873f9ae-b5ff-4f62-a8e2-3bed711e15f5/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.16
Link:
https://yomi.yoroi.company/submissions/b39fcf37d9019cc92127ee82c03df5e37aa8238cd76cc6eca2e3d1e7e977fc26

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Conti
Create hunting rule
Author:kevoreilly
Description:Conti Ransomware
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/298120/

Comments