conti ransom

Conti Ransomware

Introduction

Conti is a relatively new family. Since its first appearance in May 2020, ransomware operators (commonly known as Conti Gang) claim to have successfully launched more than 150 attacks.

Like other ransomware, Conti Gang is taking advantage of continuous growth to steal sensitive files and information from victims and threaten to use them to publish data without paying a ransom.

Like such as Egregor and Maze, Conti Gang has its own website, Conti News, which stores lists of victims and publishes stolen data.

conti news

Conti not only encrypts files on the infected host, but also spreads via SMB, and also encrypts files on other hosts, which will compromise the security of the entire network.

Gang is replacing Ryuk with Conti as its new ransomware.

Attack process

conti attack process

The latest version has two types. One is a stand-alone executable file, and the other is a loader that loads and executes the DLL from the resource section.

conti pe sections

Use GetProcAddress to dynamically load resource-related APIs.

conti ida apis

The loader then decrypts the payload using the hardcoded key and loads it into memory.

conti ransomware
After the DLL is loaded, Conti begins to encrypt and spread. The scans the SMB (port 445) in the network. If it finds an accessible shared folder, it will also try to encrypt files on the remote computer.conti ransomware

After the files are encrypted, the malware will leave a note in each folder, and if the payment is not made by the deadline, they will publish their data on their website, Conti News.

IOCs

6afca3f517df7ed8686434b71f2f894b
9e2c7e57b2008f0ee54a909c549fee0a
51dab0e8b495aff442c481de9d016eca
2b24eadfb55237e39781bd1e4dd713c5
a200d6c3988d8bf49c305f3e2adee785
af28ffb7971a47b57e6b7e735af2f430
e323c6aee8b172b57203a7e478c1caca
e4dd4afa81fb9a0725f2b20e25a32feb
23ae107d8e488bf681cac9616c3689d8
390d5e1f5e996b7e7b09b5e9fc030bed
c92ccf5e3fe074a77c4caa14a611adc9
574636474eb06b3e45dfec2fc1f8830f
4df30312791dc780155903416573d0c4
732a229132d455b98038e5a23432385d
b3d6ba0aa663f699283d25ddcb6561b9
3738c70875c0c3682f45b35587c14480
96ceab5afa378f5650e94a9695758305
20f0c736a966142de88dee06a2e4a5b1
c8229ecc8b36da53095e489f228acc27
304745b78d1caf12316eb73955eb175f
e1b25e5273a15174c143e8ff3efcb3a1dfc933d3
ac34c944fe6293b24934fea42b7a2f87a6f9cf17
6f2c3637ab7e941f0fc9e1f34dc4e7f0a88d8dbb
96f8d00c2b0e2cb89c508da9fc4993edfb5a997e
68dcbf15e926bd239026ed065471d914c85f9c75
a4b95a0ec43700c1994fa5c476b14cbcd70ba1fb
61488490142f1602a542d6e0b6bf6d8ae0156c79
a6cada7d8800aeee2dfb45e2853be90a3a99cfb9
2de7653d469bb2846a68775220b784153059e051
29179742e1653c1a9a31488c577c48bc558e6c38
5817a974fded575e67abe514f8a79f3c926f3bf0
363144ea42fbe675090903f743184b151a4df47d
848b59e29228e2402d9a913dec1649ac90cc65f9
d0fb9051f8f4a9063b9f19841182b1707527f89f
a1f27e6be62bf0af7d5bff447156b3413f0d97c8
e3b90c071be75b5be43d18b512b4ad6d9011ec29
db9f667dc08f7dde4abc24fa3ea5a5a6f957d167
afb2fe6b541069259b0fd9be82d62594a361afb0
9febd22b7a953727ce1011055a8c15d1193ab7a3
20967bd64eabb8dddbaa711c85c7bd2f3146ee83
74b7a1da50ce44b640d84422bb3f99e2f338cc5d5be9ef5f1ad03c8e947296c3
c67ba4c6e872dbcd2b1281c33fb033f886d8472ea021cf3974a445c4b804fec2
3d8b6ccfcb742aeaac194c6a245ed08131a14919c4950039bf833c764e6d4f66
2452cf5c6fccf361fa27131d9b261a60253eef8b96e6e2f524c85beea6488bd0
c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4
dca167046acf7d64ebd38f310393a1a8af8c147249c70f192d87d1d36da46c2d
227164b06f201b07a8b82800adcc6a831cadaed6709d1473fd4182858fbd80a5
1ee0bbfe78f6da5eea5e4aad6992cfcfe3aa824584c04aa3fba5a0d9c605b997
d1e0164c68c9ee348c437127c3a037d08767e9be5aded7a304bb1300a4a1aa35
d1f09689b4328f75473906a44ed57eface89170049d25cd22c94a871d3674faa
deb1b6840628917b8e04670e6c643c7994b88b3b80c9dac3ba01806531222c2f
6f0c6f447a18ad9fd81382b062d16d07eede05a15ab75870c0fdb43d421bb42d
a7bff21d2695168b3f4aad1aa084f3a986d074a363ae52c7545536a98f00fe63
2fc6d7df9252b1e2c4eb3ad7d0d29c188d87548127c44cebc40db9abe8e5aa35
d3c75c5bc4ae087d547bd722bd84478ee6baf8c3355b930f26cc19777cd39d4c
5b20049dafa8caad38635f122a59eae6bf1d1f84c6626c6fe0d913cf73c56095
b422ced27d9358665699d37648a640db10ade85e591a4cc6ceb16f01dbf9b3d6
198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3
f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047
7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c