Cybereason Conti Jan 2021

Conti can spread via SMB and encrypts files on different hosts, potentially compromising an entire network.

Conti can use compiler-based obfuscation for its code, encrypt DLLs, and hide Windows API calls.

Conti has loaded an encrypted DLL into memory and then executes it.

Conti can spread itself by infecting other remote machines via network shared drives.

Conti has used API calls during execution.

Conti has decrypted its payload using a hardcoded AES-256 key.

Conti can use CreateIoCompletionPort(), PostQueuedCompletionStatus(), and GetQueuedCompletionPort() to rapidly encrypt files, excluding those with the extensions of .exe, .dll, and .lnk. It has used a different AES-256 encryption key per file with a bundled RAS-4096 public encryption key that is unique for each victim. Conti can use “Windows Restart Manager” to ensure files are unlocked and open for encryption.