哈希 / 信息值
SHA256db601f84fd39ba6be26e7a6c0cc1a74da424698244d9a1861b2f9fb980ab7dea
MD5987e0fb2e2e25e7587fc73ad83dcd096
SHA18f84cdc64ff17e23cbc4f61cd37e3f7f4ec1b665
ImpHash97aba84ffab33ceb075b559b71327dc3
文件 AdiPrint.exe
文件类型exe
大小344,064 bytes
首次发现2023-08-24

Tehdit 值lendirmesi

Bu ornek, kurban sistemindeki dosyaları sifreleyerek erisimi engelleyen ve sifre cozme anahtarı karsılıgında fidye talep eden bir fidye yazılımı olarak analiz edilmistir.

检测到的功能

  • 文件 Sifreleme
  • Golge Kopya Silme
  • Fidye Notu
  • Yedek Yok Etme
  • Veri Sizdirma

MalwareBazaar 标签

BuerLoadercontiexeRansomwarewin.conti

分析说明

Bu ornek Conti ailesine ait ve MalwareBazaar platformundan alınmıstır. KEYDAL Guvenlik Arastirmaları tarafından metadata analizi gerceklestirilmis ve IOC veritabanına eklenmistir.

Conti — 恶意软件档案

Conti ransomware. run-as-admin.exe UAC bypass. supp onion victim support. __MUTEX_NAME__ template. DisallowRun security block. TrickBot/BazarLoader delivery.

恶意软件类型
Ransomware
编程语言
C++
C2协议
—
目标系统
Windows/Linux

技术细节

Conti ransomware operated by WIZARD SPIDER, active 2020-2022. One of the most prolific and destructive RaaS operations. Double extortion: file encryption + data leak site (Conti News). Encryption: ChaCha20 for files + RSA-4096 for key exchange. Highly configurable with full C source code (supports network drives, SMB shares). Conti Playbook leaked September 2021 revealing TTPs. Source code and internal chats leaked by Ukrainian researcher March 2022 after Conti publicly sided with Russia in Ukraine conflict. Attack on Costa Rica government (2022) caused national emergency declaration. Dissolved into multiple successor groups: Black Basta, BlackByte, Royal, Akira.

归因 / 威胁行为者

WIZARD SPIDER, multiple successor groups

能力与行为

Dosya Şifreleme (AES/RSA)
Gölge Kopya Silme
Yedek Kaldırma
Fidye Notu Oluşturma
Kalıcılık Sağlama
Ağ Paylaşımı Şifreleme
Anti-Analiz Teknikleri
Çift Gasp (Data Leak)

IOC列表 (2 个指标)

IOC — Conti
# SHA256 db601f84fd39ba6be26e7a6c0cc1a74da424698244d9a1861b2f9fb980ab7dea # MD5 987e0fb2e2e25e7587fc73ad83dcd096
类型值备注
sha256 db601f84fd39ba6be26e7a6c0cc1a74da424698244d9a1861b2f9fb980ab7dea
md5 987e0fb2e2e25e7587fc73ad83dcd096
Conti — 查看完整档案 →

C2服务器 (该家族共有 8 台已记录服务器)

地址 类型 端口 协议 状态 国家
mojobiden.com domain 80 HTTP active —
mojobiden.com domain 80 HTTP active —
213.234.12.78 ip 8080 HTTP inactive UA
paymenthacks.com domain 443 HTTPS inactive —
myosbja7hixkkjqihsjh6yvmqplz62gr3r4isctjjtu2vm5jg6hsv2ad.onion domain 80 HTTPS inactive —
mblogci3rudehaagbryjznltdp33ojwzkq6hn2pckvjq33rycmzczpid.onion domain 80 HTTPS inactive —
paymenthacks.com domain 80 HTTP inactive —
85.62.61.3 ip 443 HTTPS sinkholed RU

C2 地址仅来自 KEYDAL 团队人工验证的恶意软件样本。禁止用于商业用途。

标签
BuerLoadercontiexeRansomwarewin.conti