ebeca2df24a55c629cf0ce0d4b703ed632819d8ac101b1b930ec666760036124

Classification: Malicious

ebeca2df24a55c629cf0ce0d4b703ed632819d8ac101b1b930ec666760036124 is a ransomware (Windows executable, 185.5 KB). Linked to Conti malware.

Detection summary

  • 88 antivirus detections (87% detection ratio)
  • 0 IDS alerts
  • 12 processes observed
  • 0 contacted hosts
  • 0 DNS requests

MITRE ATT&CK associations

Malware families: CONTI (S0575)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Generic Malware Hybrid-Analysis 2024-02-23 23:00:03 2024-02-24 00:30:07
Conti ThreatFox Abuse.ch 2023-04-25 18:49:31 2023-04-25 19:17:40 S0575 Conti

Tags

win.conti

Sample information

Filenames
ebeca2df24a55c629cf0ce0d4b703ed632819d8ac101b1b930ec666760036124
File type
PE32 executable (GUI) Intel 80386, for MS Windows
Size
189952 bytes
MD5
7076f9674bc42536d1e0e2ca80d1e4f6
SHA-1
854485ee63e5a399fffe150f04cd038d6a5490ef
SHA-256
ebeca2df24a55c629cf0ce0d4b703ed632819d8ac101b1b930ec666760036124
First indexed
2021-08-03 06:12:13
Last updated
2026-10-03 01:53:39

Antivirus detections

EngineDetection
LionicTrojan.Win32.Generic.trM7
ElasticWindows.Ransomware.Conti
MicroWorld-eScanGen:Heur.Ransom.REntS.Gen.1
FireEyeGeneric.mg.7076f9674bc42536
CAT-QuickHealRansom.Bluesky.S29960716
ALYacTrojan.Ransom.Conti
Cylanceunsafe
ZillyaTrojan.Generic.Win32.1243043
SangforTrojan.Win32.Save.a
CrowdStrikewin/malicious_confidence_100% (W)
AlibabaRansom:Win32/Conti.4a0
K7GWTrojan ( 00570e101 )
K7AntiVirusTrojan ( 00570e101 )
BitDefenderThetaGen:NN.ZexaF.36132.lCW@a4mb6Hji
VirITRansom.Win32.Conti.DAX
CyrenW32/Conti.B.gen!Eldorado
SymantecTrojan.Gen.MBT
ESET-NOD32a variant of Win32/Filecoder.Conti.F
APEXMalicious
Paloaltogeneric.ml
ClamAVWin.Ransomware.Conti-9808001-0
KasperskyHEUR:Trojan-Ransom.Win32.Cryptor.gen
BitDefenderGen:Heur.Ransom.REntS.Gen.1
NANO-AntivirusVirus.Win32.Gen.ccmw
AvastWin32:Conti-B [Ransom]
TencentMalware.Win32.Gencirc.10bdc170
EmsisoftGen:Heur.Ransom.REntS.Gen.1 (B)
F-SecureHeuristic.HEUR/AGEN.1318988
DrWebTrojan.Encoder.32845
VIPREGen:Heur.Ransom.REntS.Gen.1
TrendMicroRansom.Win32.CONTI.SM.hp
McAfee-GW-EditionBehavesLike.Win32.Generic.ch
Trapminemalicious.high.ml.score
SophosMal/Generic-R
SentinelOneStatic AI - Suspicious PE
GDataGen:Heur.Ransom.REntS.Gen.1
JiangminTrojan.Generic.ggbhk
WebrootW32.Ransom.Conti
GoogleDetected
AviraHEUR/AGEN.1318988
Antiy-AVLTrojan[Ransom]/Win32.Conti
GridinsoftRansom.Win32.Conti.bot
XcitiumMalware@#3s0aunm2kvefq
ArcabitTrojan.Ransom.REntS.Gen.1
ViRobotTrojan.Win32.S.Ransom.189952.A
ZoneAlarmHEUR:Trojan-Ransom.Win32.Cryptor.gen
MicrosoftRansom:Win32/CONTI.DC!MTB
CynetMalicious (score: 100)
AhnLab-V3Malware/Win.Ransom.R475841
McAfeeRansom-Conti!7076F9674BC4
MAXmalware (ai score=100)
VBA32BScope.Trojan.Mansabo
MalwarebytesMalware.AI.1156218888
PandaTrj/GdSda.A
TrendMicro-HouseCallRansom.Win32.CONTI.SM.hp
RisingRansom.Conti!1.DF1E (CLASSIC)
IkarusTrojan-Ransom.Conti
FortinetW32/Conti.F!tr.ransom
AVGWin32:Conti-B [Ransom]
DeepInstinctMALICIOUS
BkavW32.AIDetectMalware
CTXexe.ransomware.conti
CylanceUnsafe
ESET-NOD32Win32/Filecoder.Conti.F trojan
GridinsoftTrojan.Win32.Wacatac.oa!s1
K7AntiVirusRiskware ( 0040eff71 )
K7GWRiskware ( 0040eff71 )
KasperskyHEUR:Trojan-Ransom.Win32.Generic
Kingsoftmalware.kb.a.995
MalwarebytesMalware.AI.1054755980
McAfeeDti!EBECA2DF24A5
PandaTrj/Genetic.gen
SkyhighBehavesLike.Win32.NetLoader.ch
SophosMal/Generic-S
TrellixENSRansom-Conti!7076F9674BC4
VaristW32/Conti.B.gen!Eldorado
YandexTrojan.Filecoder!xCUzMVJ8rFA
ZoneAlarmTroj/Ransom-GJI
alibabacloudRansomware:Win/Conti.F
huorongRansom/Filecoder.ct
ArcabitDump:Generic.Peed.2.CC7CBBCB
BitDefenderDump:Generic.Peed.2.CC7CBBCB
EmsisoftDump:Generic.Peed.2.CC7CBBCB (B)
GDataDump:Generic.Peed.2.CC7CBBCB
MaxSecureTrojan.Malware.10307848.susgen
McAfeeDTrojan:Win/Conti.AB
MicroWorld-eScanDump:Generic.Peed.2.CC7CBBCB
VIPREDump:Generic.Peed.2.CC7CBBCB

Process list

NameCommand line
ebeca2df24a55c629cf0ce0d4b703ed632819d8ac101b1b930ec666760036124.exe
WerFault.exe-u -p 7560 -s 600
WerFault.exe-pss -s 476 -p 7560 -ip 7560
ebeca2df24a55c629cf0ce0d4b703ed632819d8ac101b1b930ec666760036124.exe
cmd.exe/c %WINDIR%\System32\wbem\WMIC.exe shadowcopy where "ID='{D788DEAE-869B-4966-974B-C1D121FDFD2D}'" delete
WMIC.exeshadowcopy where "ID='{D788DEAE-869B-4966-974B-C1D121FDFD2D}'" delete
cmd.exe/c %WINDIR%\System32\wbem\WMIC.exe shadowcopy where "ID='{6EEE7147-1F06-4554-A7E3-EFC640164C2A}'" delete
WMIC.exeshadowcopy where "ID='{6EEE7147-1F06-4554-A7E3-EFC640164C2A}'" delete
cmd.exe/c %WINDIR%\System32\wbem\WMIC.exe shadowcopy where "ID='{4F57338A-C848-47CD-BF4E-93AFAA1D2962}'" delete
WMIC.exeshadowcopy where "ID='{4F57338A-C848-47CD-BF4E-93AFAA1D2962}'" delete
cmd.exe/c %WINDIR%\System32\wbem\WMIC.exe shadowcopy where "ID='{7BDFF95C-10A1-4A6D-A596-AE1108E0E970}'" delete
WMIC.exeshadowcopy where "ID='{7BDFF95C-10A1-4A6D-A596-AE1108E0E970}'" delete