Rewterz Threat Alert – Conti Ransomware – Active IOCs

Severity

High

Analysis Summary

Conti is a type of ransomware that was first discovered in December 2019. It is a highly sophisticated and dangerous malware that is designed to encrypt files on a victim’s computer and demand a ransom payment in exchange for the decryption key. The ransomware is typically spread through phishing emails or by exploiting vulnerabilities in unpatched software. Once a computer is infected, Conti will encrypt files and append the “.conti” extension to the file names. The malware also drops a ransom note on the victim’s desktop, which provides instructions on how to pay the ransom and regain access to the encrypted files. It is important to note that paying the ransom does not guarantee that the files will be decrypted, and it is generally not recommended to pay the ransom as it only encourages the attackers to continue their activities.

Impact

• Sensitive File Theft
• File Encryption

Indicators of Compromise

MD5

• 2728cc27bed3e893827ad3442920f13f
• d69589f5bd6c3c799be2d2fd2b718af1
• b1c42bc4f6b0ceeb90853b69879b7a1b

SHA-256

• d826f4cb8240f894e43fea3c84b14fd85be9758d7ad4eafa113ad7d45c30bc26
• 41324493142b10db127217274e21df37f6ccd13f01a8d29d2b23b7b1463423a7
• 767ab6e3cf7f6251e76b0f6d3c9812d738f24382d3057c627902d9402b722dbc

SHA-1

• bd79a5123e03fd09217103ef9740ca9b52047ec1
• 1c68264c9b7b4fef73cc231b944388b4abaa1962
• 895dc9a571f74b6515d82974b3591de7e3378079

Remediation

• Search for IOCs in your environment.
• Block all threat indicators at your respective controls.