a47d7ff36064cab056d56dca4c466b4e98b331e4aed1d7aee2790cb9a94b1793

Classification: Malicious

a47d7ff36064cab056d56dca4c466b4e98b331e4aed1d7aee2790cb9a94b1793 is a ransomware (application/x-dosexec, 190.5 KB). Linked to Conti malware. Seen in RO.

Detection summary

  • 85 antivirus detections (58% detection ratio)
  • 0 IDS alerts
  • 12 processes observed
  • 0 contacted hosts
  • 0 DNS requests

MITRE ATT&CK associations

Malware families: CONTI (S0575)

Where it has been seen

Observed by Maltiverse Threat Observatory sensors in RO.

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Conti Cyber Threat Alliance 2026-10-14 16:18:02 2026-10-14 16:18:02 country_code:ro malicious-activity S0575 Conti
Conti MalwareBazaar Abuse.ch 2021-12-16 17:49:23 2021-12-16 17:49:23 malicious-activity S0575 Conti
Generic.Malware MalwareBazaar Abuse.ch 2021-12-16 17:49:23 2021-12-16 17:49:23 malicious-activity

Sample information

Filenames
a47d7ff36064cab056d56dca4c466b4e98b331e4aed1d7aee2790cb9a94b1793, a47d7ff36064cab056d56dca4c466b4e98b331e4aed1d7aee2790cb9a94b1793.bin
File type
application/x-dosexec
Size
195072 bytes
MD5
b1df6d854a85cc516b17c297e52961c7
SHA-1
b63cca38c6d715f7614f4bce1dcca60585e90731
SHA-256
a47d7ff36064cab056d56dca4c466b4e98b331e4aed1d7aee2790cb9a94b1793
First indexed
2021-10-19 10:18:53
Last updated
2026-03-27 20:20:57

Antivirus detections

EngineDetection
LionicTrojan.Win32.Cryptor.j!c
Elasticmalicious (high confidence)
MicroWorld-eScanGen:Variant.Razy.844459
FireEyeGeneric.mg.b1df6d854a85cc51
McAfeeRansom-Conti!B1DF6D854A85
CylanceUnsafe
AlibabaRansom:Win32/Conti.27e750a3
K7GWTrojan ( 0057851c1 )
K7AntiVirusTrojan ( 0057851c1 )
ArcabitTrojan.Razy.DCE2AB
BitDefenderThetaGen:NN.ZedlaF.34170.lu4@a88MLPoi
CyrenW32/Trojan.CJNB-6555
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Filecoder.Conti.N
Paloaltogeneric.ml
KasperskyHEUR:Trojan-Ransom.Win32.Cryptor.gen
BitDefenderGen:Variant.Razy.844459
AvastWin32:Conti-B [Ransom]
RisingRansom.Conti!1.D637 (CLASSIC)
Ad-AwareGen:Variant.Razy.844459
EmsisoftGen:Variant.Razy.844459 (B)
TrendMicroRansom.Win32.CONTI.SMYXBBU1
McAfee-GW-EditionRansom-Conti!B1DF6D854A85
SophosTroj/Conti-C
MAXmalware (ai score=85)
Antiy-AVLTrojan/Generic.ASMalwS.349D19E
MicrosoftRansom:Win32/Conti.MAK!MTB
ZoneAlarmHEUR:Trojan-Ransom.Win32.Cryptor.gen
GDataGen:Variant.Razy.844459
AhnLab-V3Ransomware/Win.Conti.C4644604
VBA32TrojanRansom.Crypmodng
ALYacGen:Variant.Razy.844459
MalwarebytesRansom.Conti
TencentWin32.Trojan.Filecoder.Pftf
YandexTrojan.Filecoder!PKkOnhV2IaY
IkarusTrojan-Ransom.Conti
FortinetW32/Conti.N!tr.ransom
AVGWin32:Conti-B [Ransom]
PandaTrj/GdSda.A
MaxSecureTrojan.Malware.73657187.susgen
AhnLab-V3Ransomware/Win.Conti.R489804
AlibabaRansom:Win32/Conti.859af14a
Antiy-AVLTrojan[Ransom]/Win32.Conti
ArcabitTrojan.Trojan.Ransomware.D516
AviraTR/Cryptor.brqmd
BitDefenderGen:Variant.Trojan.Ransomware.1302
BkavW32.AIDetectMalware
CAT-QuickHealTrojan.GenericRI.S25772658
CTXdll.ransomware.conti
ClamAVWin.Ransomware.Conti-10020102-0
CrowdStrikewin/malicious_confidence_100% (W)
CynetMalicious (score: 100)
DeepInstinctMALICIOUS
DrWebTrojan.Encoder.34529
ESET-NOD32Win32/Filecoder.Conti.N trojan
ElasticWindows.Ransomware.Conti
EmsisoftGen:Variant.Trojan.Ransomware.1302 (B)
F-SecureTrojan.TR/Cryptor.brqmd
GDataGen:Variant.Trojan.Ransomware.1302
GoogleDetected
JiangminTrojan.Cryptor.aaj
K7AntiVirusRansomware ( 005d78be1 )
K7GWRansomware ( 005d78be1 )
KasperskyHEUR:Trojan-Ransom.Win32.Generic
Kingsoftmalware.kb.a.764
LionicTrojan.Win32.Conti.1z!c
MalwarebytesMalware.AI.2119845281
McAfeeDTrojan:Win/Conti.AB
MicroWorld-eScanGen:Variant.Trojan.Ransomware.1302
MicrosoftRansom:Win32/Conti.AD!MTB
NANO-AntivirusTrojan.Win32.Encoder.konmex
RisingRansom.Conti!1.DF1E (CLASSIC)
SangforRansom.Win32.Conti.Vquj
SkyhighRansom-Conti!B1DF6D854A85
SymantecDownloader
TencentMalware.Win32.Gencirc.10bd2458
TrellixENSRansom-Conti!B1DF6D854A85
TrendMicro-HouseCallRansom.Win32.CONTI.SMYXBBU1
VIPREGen:Variant.Trojan.Ransomware.1302
VaristW32/Conti.A.gen!Eldorado
ViRobotTrojan.Win32.Z.Conti.195072.A
XcitiumMalware@#2qxtrix7jryrg
ZoneAlarmTroj/Conti-C
alibabacloudRansomWare
huorongRansom/LockFile.bb

Process list

NameCommand line
<Ignored Process>
rundll32.exe"C:\a47d7ff36064cab056d56dca4c466b4e98b331e4aed1d7aee2790cb9a94b1793.dll",#2
cmd.exe/c %WINDIR%\System32\wbem\WMIC.exe shadowcopy where "ID='{D788DEAE-869B-4966-974B-C1D121FDFD2D}'" delete
WMIC.exe%WINDIR%\System32\wbem\WMIC.exe shadowcopy where "ID='{D788DEAE-869B-4966-974B-C1D121FDFD2D}'" delete
cmd.exe/c %WINDIR%\System32\wbem\WMIC.exe shadowcopy where "ID='{6EEE7147-1F06-4554-A7E3-EFC640164C2A}'" delete
WMIC.exe%WINDIR%\System32\wbem\WMIC.exe shadowcopy where "ID='{6EEE7147-1F06-4554-A7E3-EFC640164C2A}'" delete
cmd.exe/c %WINDIR%\System32\wbem\WMIC.exe shadowcopy where "ID='{4F57338A-C848-47CD-BF4E-93AFAA1D2962}'" delete
WMIC.exe%WINDIR%\System32\wbem\WMIC.exe shadowcopy where "ID='{4F57338A-C848-47CD-BF4E-93AFAA1D2962}'" delete
cmd.exe/c %WINDIR%\System32\wbem\WMIC.exe shadowcopy where "ID='{7BDFF95C-10A1-4A6D-A596-AE1108E0E970}'" delete
WMIC.exe%WINDIR%\System32\wbem\WMIC.exe shadowcopy where "ID='{7BDFF95C-10A1-4A6D-A596-AE1108E0E970}'" delete
rundll32.exe"C:\a47d7ff36064cab056d56dca4c466b4e98b331e4aed1d7aee2790cb9a94b1793.dll",#3
dismhost.exe{4D96AD1C-A558-4BBF-B32B-9BBB451692F1}