Ransom.Win32.CONTI.YAAI-A

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following copies of itself into the affected system and executes them:

• %AppDataLocal%\Microsoft\Windows\Temporary Internet Files\պԴպեԵղԸԴԶԽՈԻՖՑԾիքցիֆուպԼՆԹԿԱփԾոքգԽղԻՖՑԾՊՃճվԷՉՃԲէւպհվՒՉլնբԷՉԿԲրջպճ\պԴպեԵղԸԴԶԽՈԻՖՑԾիքցիֆուպԼՆԹԿԱփԾոքգԽղԻՖՑԾՊՃճվԷՉՃԲէւպհվՒՉլնբԷՉԿԲրջպճ.exe (if MsMpEng.exe runs on the system)

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It drops the following files:

• %System Root%\CONTI_LOG.txt (if parameter has -log)

(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)

It adds the following processes:

• %AppDataLocal%\Microsoft\Windows\Temporary Internet Files\պԴպեԵղԸԴԶԽՈԻՖՑԾիքցիֆուպԼՆԹԿԱփԾոքգԽղԻՖՑԾՊՃճվԷՉՃԲէւպհվՒՉլնբԷՉԿԲրջպճ\պԴպեԵղԸԴԶԽՈԻՖՑԾիքցիֆուպԼՆԹԿԱփԾոքգԽղԻՖՑԾՊՃճվԷՉՃԲէւպհվՒՉլնբԷՉԿԲրջպճ.exe (if MsMpEng.exe runs on the system)

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• {Random characters}

Other Details

This Ransomware accepts the following parameters:

• -h - Specify file for IP list to focus on network shares
• -log - Log output to %System Root%\CONTI_LOG.txt

(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)

Ransomware Routine

This Ransomware appends the following extension to the file name of the encrypted files:

• .EBEAR

It drops the following file(s) as ransom note:

• {Encrypted folder}\R3ADM3.txt