Conti | Threat Level: critical | Type: Ransomware

Cryptographic Identifiers

SHA25691d1851a7dfd2133102df6f58b34823726796744e62f61e4181b977026b19d6b
MD58330ee5e6df29bdb94e65f2c93e3da24
File Typeexe
Size326.0 KB
First Seen2023-08-24
File NameReview.exe
TagsBuerLoader, conti, exe, Ransomware, win.conti

Malware Family: Conti

Conti, büyük saldırılar yaptı.

TypeRansomware
Programming LanguageC++
Target PlatformWindows/Linux
C2 Protocol
PurposeKurum ransomware
First Seen Year2020

Threat Indicators (IOC)

  • SHA256: 91d1851a7dfd2133102df6f58b34823726796744e62f61e4181b977026b19d6b
  • MD5: 8330ee5e6df29bdb94e65f2c93e3da24

You can verify all hash values of this sample on VirusTotal.

System Cleanup Guide

  1. Sistemi ağdan DERHAL ayırın — diğer cihazlara yayılmayı durdurun
  2. Do not pay the ransom — there is no guarantee your files will be restored
  3. Quarantine the affected drives
  4. Kullanılan fidye yazılımı ailesini belirleyin (nomoreransom.org)
  5. Try available decryptor tools (the NoMoreRansom project)
  6. Report the incident to the authorities (cybercrime unit)
  7. Temiz bir yedekten kurtarın; yedeğiniz yoksa sürücüyü saklayın

YARA Rule Hints

rule Conti_SHA256 {
    meta:
        description = "Conti sample: 91d1851a7dfd2133"
        threat_level = "critical"
        first_seen = "2023-08-24"
    condition:
        hash.sha256(0, filesize) == "91d1851a7dfd2133102df6f58b34823726796744e62f61e4181b977026b19d6b"
}

Conti — Malware Profile

Conti ransomware. run-as-admin.exe UAC bypass. supp onion victim support. __MUTEX_NAME__ template. DisallowRun security block. TrickBot/BazarLoader delivery.

Malware Type
Ransomware
Programming Language
C++
C2 Protocol
Target Systems
Windows/Linux

Technical Details

Conti ransomware operated by WIZARD SPIDER, active 2020-2022. One of the most prolific and destructive RaaS operations. Double extortion: file encryption + data leak site (Conti News). Encryption: ChaCha20 for files + RSA-4096 for key exchange. Highly configurable with full C source code (supports network drives, SMB shares). Conti Playbook leaked September 2021 revealing TTPs. Source code and internal chats leaked by Ukrainian researcher March 2022 after Conti publicly sided with Russia in Ukraine conflict. Attack on Costa Rica government (2022) caused national emergency declaration. Dissolved into multiple successor groups: Black Basta, BlackByte, Royal, Akira.

Attribution / Threat Actor

WIZARD SPIDER, multiple successor groups

Capabilities & Behavior

Dosya Şifreleme (AES/RSA)
Gölge Kopya Silme
Yedek Kaldırma
Fidye Notu Oluşturma
Kalıcılık Sağlama
Ağ Paylaşımı Şifreleme
Anti-Analiz Teknikleri
Çift Gasp (Data Leak)

IOC List (2 indicators)

IOC — Conti
# SHA256 91d1851a7dfd2133102df6f58b34823726796744e62f61e4181b977026b19d6b # MD5 8330ee5e6df29bdb94e65f2c93e3da24
TypeValueNote
sha256 91d1851a7dfd2133102df6f58b34823726796744e62f61e4181b977026b19d6b Sample:Conti
md5 8330ee5e6df29bdb94e65f2c93e3da24 Sample:Conti

C2 Servers (8 recorded servers for this family)

Address Type Port Protocol Status Country
mojobiden.com domain 80 HTTP active —
mojobiden.com domain 80 HTTP active —
213.234.12.78 ip 8080 HTTP inactive UA
paymenthacks.com domain 443 HTTPS inactive —
myosbja7hixkkjqihsjh6yvmqplz62gr3r4isctjjtu2vm5jg6hsv2ad.onion domain 80 HTTPS inactive —
mblogci3rudehaagbryjznltdp33ojwzkq6hn2pckvjq33rycmzczpid.onion domain 80 HTTPS inactive —
paymenthacks.com domain 80 HTTP inactive —
85.62.61.3 ip 443 HTTPS sinkholed RU

C2 addresses are provided only from malware samples manually verified by the KEYDAL team. Commercial use is prohibited.

Tags
contiransomwaremalwarecriticalsha256hash-analizi