Royal | Threat Level: critical | Type: Ransomware

Cryptographic Identifiers

SHA25606abc46d5dbd012b170c97d142c6b679183159197e9d3f6a76ba5e5abf999725
MD587adb14271dc49e6b0f2eb4b03f4bbe7
File Typeelf
Size2498.1 KB
First Seen2023-02-03
File Name06abc46d5dbd012b170c97d142c6b679183159197e9d3f6a76ba5e5abf999725
Tagself, ELF64, ESXi, linux, Ransomware, royal

Malware Family: Royal

Royal, Conti üyesiyle ilişkilidir.

TypeRansomware
Programming LanguageC++
Target PlatformWindows
C2 Protocol
PurposeConti sonrası ransomware
First Seen Year2022

Threat Indicators (IOC)

  • SHA256: 06abc46d5dbd012b170c97d142c6b679183159197e9d3f6a76ba5e5abf999725
  • MD5: 87adb14271dc49e6b0f2eb4b03f4bbe7

You can verify all hash values of this sample on VirusTotal.

System Cleanup Guide

  1. Sistemi ağdan DERHAL ayırın — diğer cihazlara yayılmayı durdurun
  2. Do not pay the ransom — there is no guarantee your files will be restored
  3. Quarantine the affected drives
  4. Kullanılan fidye yazılımı ailesini belirleyin (nomoreransom.org)
  5. Try available decryptor tools (the NoMoreRansom project)
  6. Report the incident to the authorities (cybercrime unit)
  7. Temiz bir yedekten kurtarın; yedeğiniz yoksa sürücüyü saklayın

YARA Rule Hints

rule Royal_SHA256 {
    meta:
        description = "Royal sample: 06abc46d5dbd012b"
        threat_level = "critical"
        first_seen = "2023-02-03"
    condition:
        hash.sha256(0, filesize) == "06abc46d5dbd012b170c97d142c6b679183159197e9d3f6a76ba5e5abf999725"
}

Royal — Malware Profile

Royal, 2022-2023 aktif C++ ransomware. Conti varisi. Kismi sifreleme. BlackSuit olarak yeniden markalasmis. CISA 2023.

Malware Type
Ransomware
Programming Language
C++
C2 Protocol
Target Systems
Windows

Technical Details

Ransomware ailesi: AES/RSA hibrid sifreleme, dosya uzantisi degistirme, shadow copy silme, C2 ile anahtar alis-verisi, fidye notu birakma, kullanici belgelerine odaklanma

Capabilities & Behavior

Dosya Şifreleme (AES/RSA)
Gölge Kopya Silme
Yedek Kaldırma
Fidye Notu Oluşturma
Kalıcılık Sağlama
Ağ Paylaşımı Şifreleme
Anti-Analiz Teknikleri
Çift Gasp (Data Leak)

IOC List (2 indicators)

IOC — Royal
# SHA256 06abc46d5dbd012b170c97d142c6b679183159197e9d3f6a76ba5e5abf999725 # MD5 87adb14271dc49e6b0f2eb4b03f4bbe7
TypeValueNote
sha256 06abc46d5dbd012b170c97d142c6b679183159197e9d3f6a76ba5e5abf999725 Sample:Royal
md5 87adb14271dc49e6b0f2eb4b03f4bbe7 Sample:Royal
Tags
royalransomwaremalwarecriticalsha256hash-analizi