Win32.Ransom.Conti MVID-2022-0662 Cryptography Logic Flaw

Credits: Malvuln (John Page, aka Hyp3rlinx), Discovery (c) 2022
Original source: https://malvuln.com/advisory/99e55ce93392068c970384ab24a0e13d.txt

Contact: [email protected]

Media: twitter.com/malvuln

Backup media: infosec.exchange/@malvuln

Threat: Win32.Ransom.Conti

Vulnerability: Crypto Logic Flaw

Description: Conti ransomware fails to encrypt PE files that contain a “.exe”. This malware sample was able to create file names that were specially designed and successfully bypassed encryption. Other variants of the virus are not known as they have yet been tested.

E.g.

Test.exe.docx

Test.exe.pdf

It was tested in a virtual machine environment.

Conti: Family

Type: PE32

MD5: 99e55ce93392068c970384ab24a0e13d

Vuln ID: MVID-2022 – 0662

Disclosure: 11/25/2022

Video URL for PoC:

Exploit/PoC:

Files with the extension “.exe” should be created within the filename

Disclaimer: This advisory information is provided “as-is,” without warranties, guarantees or other conditions. This advisory may be redistributed, subject to its original form and credit. For inclusion in vulnerability databases or similar programs, permission is granted explicitly provided credit to the author. Author is not responsible for misuse or misappropriation of information and does not accept responsibility for damages resulting from the misuse. Any malicious or illegal use of security-related information, exploits or other methods is prohibited by the author. You should not try to obtain Malware samples. This website does not accept responsibility for damages resulting from Malware handling errors or downloading any Malware. All content copyrighted (c) Malvuln.comTM