Kryptografische Kennungen
| SHA256 | a83796aa471d9710b44d2ca9196d990b189cb9cbe1846e688be8660c5a6298dd |
|---|---|
| MD5 | b2a627779dbdb376cf94bd6ad4e670eb |
| Dateityp | exe |
| Größe | 214.0 KB |
| Erstsichtung | 2025-08-05 |
| Dateiname | 2025-08-05_b2a627779dbdb376cf94bd6ad4e670eb_bitrat_black-basta_conti_elex_luca-stealer.exe |
| Tags | conti, exe |
Malware-Familie: Conti
Conti, büyük kurumları hedef aldı.
| Typ | Ransomware |
|---|---|
| Programmiersprache | C++ |
| Zielplattform | Windows/Linux |
| C2-Protokoll | — |
| Zweck | Kurumsal sektör ransomware |
| Jahr der Erstsichtung | 2020 |
Bedrohungsindikatoren (IOC)
- SHA256:
a83796aa471d9710b44d2ca9196d990b189cb9cbe1846e688be8660c5a6298dd - MD5:
b2a627779dbdb376cf94bd6ad4e670eb
Anleitung zur Systembereinigung
- Sistemi ağdan DERHAL ayırın — diğer cihazlara yayılmayı durdurun
- Zahlen Sie kein Lösegeld — es gibt keine Garantie für die Wiederherstellung
- Stellen Sie die betroffenen Laufwerke unter Quarantäne
- Kullanılan fidye yazılımı ailesini belirleyin (nomoreransom.org)
- Probieren Sie verfügbare Entschlüsselungstools (Projekt NoMoreRansom)
- Yetkililere ihbarda bulunun
- Temiz bir yedekten kurtarın
Hinweise für YARA-Regeln
rule Conti_SHA256 {
meta:
description = "Conti sample: a83796aa471d9710"
threat_level = "critical"
first_seen = "2025-08-05"
condition:
hash.sha256(0, filesize) == "a83796aa471d9710b44d2ca9196d990b189cb9cbe1846e688be8660c5a6298dd"
}Conti — Malware-Profil
Conti ransomware. run-as-admin.exe UAC bypass. supp onion victim support. __MUTEX_NAME__ template. DisallowRun security block. TrickBot/BazarLoader delivery.
Technische Details
Conti ransomware operated by WIZARD SPIDER, active 2020-2022. One of the most prolific and destructive RaaS operations. Double extortion: file encryption + data leak site (Conti News). Encryption: ChaCha20 for files + RSA-4096 for key exchange. Highly configurable with full C source code (supports network drives, SMB shares). Conti Playbook leaked September 2021 revealing TTPs. Source code and internal chats leaked by Ukrainian researcher March 2022 after Conti publicly sided with Russia in Ukraine conflict. Attack on Costa Rica government (2022) caused national emergency declaration. Dissolved into multiple successor groups: Black Basta, BlackByte, Royal, Akira.
Attribution / Bedrohungsakteur
WIZARD SPIDER, multiple successor groups
Fähigkeiten & Verhalten
IOC-Liste (3 Indikatoren)
# SHA256
a83796aa471d9710b44d2ca9196d990b189cb9cbe1846e688be8660c5a6298dd
# MD5
b2a627779dbdb376cf94bd6ad4e670eb
# DOMAIN
myosbja7hixkkjqihsjh6yvmqplz62gr3r4isctjjtu2vm5jg6hsv2ad.onion
| Typ | Wert | Bemerkung |
|---|---|---|
| sha256 | a83796aa471d9710b44d2ca9196d990b189cb9cbe1846e688be8660c5a6298dd | Conti |
| md5 | b2a627779dbdb376cf94bd6ad4e670eb | Conti |
| domain | myosbja7hixkkjqihsjh6yvmqplz62gr3r4isctjjtu2vm5jg6hsv2ad.onion | Conti |
C2-Server (8 erfasste Server für diese Familie)
| Adresse | Typ | Port | Protokoll | Status | Land |
|---|---|---|---|---|---|
| mojobiden.com | domain | 80 | HTTP | active | — |
| mojobiden.com | domain | 80 | HTTP | active | — |
| 213.234.12.78 | ip | 8080 | HTTP | inactive | UA |
| paymenthacks.com | domain | 443 | HTTPS | inactive | — |
| myosbja7hixkkjqihsjh6yvmqplz62gr3r4isctjjtu2vm5jg6hsv2ad.onion | domain | 80 | HTTPS | inactive | — |
| mblogci3rudehaagbryjznltdp33ojwzkq6hn2pckvjq33rycmzczpid.onion | domain | 80 | HTTPS | inactive | — |
| paymenthacks.com | domain | 80 | HTTP | inactive | — |
| 85.62.61.3 | ip | 443 | HTTPS | sinkholed | RU |
C2-Adressen stammen ausschließlich aus vom KEYDAL-Team manuell verifizierten Malware-Samples. Kommerzielle Nutzung ist untersagt.