Conti | 威胁等级: critical | 类型: Ransomware

加密标识符

SHA256d9243af49f96c8b66715287d0dc26dbd82eab8570d5f20629ddf9e5fe06c051c
MD5315f4d5ac8e5da2c2975db1513099f99
文件类型exe
大小214.0 KB
首次发现2024-11-05
文件名MONTI Ransomware
标签conti, exe, monti, Ransomware

恶意软件家族: Conti

Conti, büyük kurumları hedef aldı.

类型Ransomware
编程语言C++
目标平台Windows/Linux
C2 协议
用途Kurumsal sektör ransomware
首次发现年份2020

威胁指标 (IOC)

  • SHA256: d9243af49f96c8b66715287d0dc26dbd82eab8570d5f20629ddf9e5fe06c051c
  • MD5: 315f4d5ac8e5da2c2975db1513099f99

您可以在 VirusTotal 上验证此样本的所有哈希值。

系统清理指南

  1. Sistemi ağdan DERHAL ayırın — diğer cihazlara yayılmayı durdurun
  2. 不要支付赎金——无法保证恢复文件
  3. 隔离受影响的驱动器
  4. Kullanılan fidye yazılımı ailesini belirleyin (nomoreransom.org)
  5. 尝试可用的解密工具(NoMoreRansom 项目)
  6. 向执法部门(网络犯罪部门)报案
  7. Temiz bir yedekten kurtarın; yedeğiniz yoksa sürücüyü saklayın

YARA 规则提示

rule Conti_SHA256 {
    meta:
        description = "Conti sample: d9243af49f96c8b6"
        threat_level = "critical"
        first_seen = "2024-11-05"
    condition:
        hash.sha256(0, filesize) == "d9243af49f96c8b66715287d0dc26dbd82eab8570d5f20629ddf9e5fe06c051c"
}

Conti — 恶意软件档案

Conti ransomware. run-as-admin.exe UAC bypass. supp onion victim support. __MUTEX_NAME__ template. DisallowRun security block. TrickBot/BazarLoader delivery.

恶意软件类型
Ransomware
编程语言
C++
C2协议
目标系统
Windows/Linux

技术细节

Conti ransomware operated by WIZARD SPIDER, active 2020-2022. One of the most prolific and destructive RaaS operations. Double extortion: file encryption + data leak site (Conti News). Encryption: ChaCha20 for files + RSA-4096 for key exchange. Highly configurable with full C source code (supports network drives, SMB shares). Conti Playbook leaked September 2021 revealing TTPs. Source code and internal chats leaked by Ukrainian researcher March 2022 after Conti publicly sided with Russia in Ukraine conflict. Attack on Costa Rica government (2022) caused national emergency declaration. Dissolved into multiple successor groups: Black Basta, BlackByte, Royal, Akira.

归因 / 威胁行为者

WIZARD SPIDER, multiple successor groups

能力与行为

Dosya Şifreleme (AES/RSA)
Gölge Kopya Silme
Yedek Kaldırma
Fidye Notu Oluşturma
Kalıcılık Sağlama
Ağ Paylaşımı Şifreleme
Anti-Analiz Teknikleri
Çift Gasp (Data Leak)

IOC列表 (2 个指标)

IOC — Conti
# SHA256 d9243af49f96c8b66715287d0dc26dbd82eab8570d5f20629ddf9e5fe06c051c # MD5 315f4d5ac8e5da2c2975db1513099f99
类型备注
sha256 d9243af49f96c8b66715287d0dc26dbd82eab8570d5f20629ddf9e5fe06c051c Sample:Conti
md5 315f4d5ac8e5da2c2975db1513099f99 Sample:Conti

C2服务器 (该家族共有 8 台已记录服务器)

地址 类型 端口 协议 状态 国家
mojobiden.com domain 80 HTTP active —
mojobiden.com domain 80 HTTP active —
213.234.12.78 ip 8080 HTTP inactive UA
paymenthacks.com domain 443 HTTPS inactive —
myosbja7hixkkjqihsjh6yvmqplz62gr3r4isctjjtu2vm5jg6hsv2ad.onion domain 80 HTTPS inactive —
mblogci3rudehaagbryjznltdp33ojwzkq6hn2pckvjq33rycmzczpid.onion domain 80 HTTPS inactive —
paymenthacks.com domain 80 HTTP inactive —
85.62.61.3 ip 443 HTTPS sinkholed RU

C2 地址仅来自 KEYDAL 团队人工验证的恶意软件样本。禁止用于商业用途。

标签
contiransomwaremalwarecriticalsha256hash-analizi