MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b524ed1cc22253f09d56f54d8ded4566b63352ff739f58de961f8a5bebb0fad9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Conti


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b524ed1cc22253f09d56f54d8ded4566b63352ff739f58de961f8a5bebb0fad9
SHA3-384 hash: ba1b3c01d727e3c5b629ae5b0b8280b92b502283e733bdef72476e923d1fadf2172a48930a8fd9404096edcf30d1d005
SHA1 hash: 0666df78cb4f95a3ba82457ddcccd660888d8b00
MD5 hash: 1c2e8cb65ebe1702d2ee519d970d7808
humanhash: cat-december-fanta-cardinal
File name:b524ed1cc22253f09d56f54d8ded4566b63352ff739f58de961f8a5bebb0fad9.bin
Download: download sample
Signature Conti
Create hunting rule
File size:593'920 bytes
First seen:2020-12-12 00:19:40 UTC
Last seen:2020-12-12 02:11:54 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 17774555ef912b9d4fce9f388e7dcf16 (1 x Conti)
ssdeep 12288:PNZbUcR1IwNIiIHr2TC1IGPG1Uqu3JYSzaSVujIgm:VZocvDPIkC+GeeqSzfoc
TLSH 90C4AE53B7E0C07AC1E711308FE29B75A2F6FC604E3A868767C56B0D5E31AC59936B21
Reporter Arkbird_SOLG
Tags:conti Loader Ransomware V2

Intelligence

File Origin
# of uploads :
2
# of downloads :
490
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
login.exe
Verdict:
Malicious activity
Analysis date:
2020-11-11 22:48:26 UTC
Tags:
ransomware
Link:
https://app.any.run/tasks/5e48544c-c62a-4f7f-b78d-b422d9d5d34b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Conti
Create hunting rule
Link:
https://www.capesandbox.com/analysis/107789/
Detection(s):
PUA.Win.Packer.Armadillo-65
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Using the Windows Management Instrumentation requests
Launching a service
Launching a process
Connection attempt
Creating a file
Changing a file
Creating a file in the Program Files directory
Moving a file to the Program Files directory
Creating a file in the Program Files subdirectories
Moving a file to the Program Files subdirectory
Modifying an executable file
Reading critical registry keys
Creating a file in the mass storage device
Encrypting user's files
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Conti
Create hunting rule
Detection:
malicious
Classification:
rans.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/561352
Signature
Antivirus / Scanner detection for submitted sample
Found ransom note / readme
Found Tor onion address
Multi AV Scanner detection for submitted file
Writes many files with high entropy
Yara detected Conti ransomware
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b524ed1cc22253f09d56f54d8ded4566b63352ff739f58de961f8a5bebb0fad9/
Threat name:
Win32.Trojan.Emotetcrypt
Create hunting rule
Status:
Malicious
First seen:
2020-11-12 12:45:39 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wuso2hgcejj7bhkw6vgy33kfm23dgux7oopvrxuwd6ffx25q7lmq._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
ransomware spyware
Link:
https://tria.ge/reports/201212-2pfzqbmmtj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Drops file in Windows directory
Drops desktop.ini file(s)
Reads user/profile data of web browsers
Modifies extensions of user files
Unpacked files
SH256 hash:
b524ed1cc22253f09d56f54d8ded4566b63352ff739f58de961f8a5bebb0fad9
MD5 hash:
1c2e8cb65ebe1702d2ee519d970d7808
SHA1 hash:
0666df78cb4f95a3ba82457ddcccd660888d8b00
Link:
https://www.unpac.me/results/a1da5ee5-b48f-424c-90f2-2d2b2cb73d37/
SH256 hash:
e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685
MD5 hash:
20a0f74349d36d65cb45a7512596848e
SHA1 hash:
0c3603f4f1e386e7af030e94f24cfa71a27aa4e5
Link:
https://www.unpac.me/results/a1da5ee5-b48f-424c-90f2-2d2b2cb73d37/
SH256 hash:
03b9c7a3b73f15dfc2dcb0b74f3e971fdda7d1d1e2010c6d1861043f90a2fecd
MD5 hash:
0a49ed1c5419bb9752821d856f7ce4ff
SHA1 hash:
e026e1f27d503a23aaab354c1de6e17d4c6a2b1f
Link:
https://www.unpac.me/results/a1da5ee5-b48f-424c-90f2-2d2b2cb73d37/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Cryptor
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b524ed1cc22253f09d56f54d8ded4566b63352ff739f58de961f8a5bebb0fad9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cobalt_functions
Create hunting rule
Author:@j0sm1
Description:Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT
Rule name:Conti
Create hunting rule
Author:kevoreilly
Description:Conti Ransomware
Rule name:IceID_Bank_trojan
Create hunting rule
Author:unixfreaxjp
Description:Detects IcedID..adjusted several times

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/107789/

Comments