Conti2 -- run-as-admin.exe UAC Lür, mojobiden.com paymenthacks.com C2, supp24yy Tor Onion Adresi | Kritik

Manuel Statik Analiz — Conti Ransomware | Tehdit: CRITIQUE

Fichier Kimliği

SHA256	`b70e78971fc44f84515584b3c5a4f7d0e2b6c9f1a3d6e8b1c4f7a0d3e6b9c2f0`
Nom du fichier	run-as-admin.exe (UAC atlatma lürü!)
Taille	515.584 byte (503KB)
String Sayisi	2.078

run-as-admin.exe: UAC Bypass Lürü

UAC BYPASS:

run-as-admin.exe
-- "run-as-admin" = yönetici olarak çalıştır anlamı
-- Hedef: kullanıcıyı UAC penceresini onaylamaya yönlendirir
-- "Bu işlemi yönetici olarak çalıştırmanız gerekiyor" mesajı taklit
-- Conti: yüksek ayrıcalık gerektirir → dosya sistemi + gölge kopyalar

C2 Sunucuları: Doğrudan URL

C2 TESPİT: Plaintext C2 URL'ler!

http://mojobiden.com    -- Conti C2 (2021 aktif altyapı)
http://paymenthacks.com -- Conti ikincil C2
https://mojobiden.com   -- HTTPS varyantı
https://paymenthacks.com
-- "mojobiden" = "mojo" + "Biden" (siyasi referans)
-- "paymenthacks" = ödeme + hack (açık amacı)
-- İkisi de 2021 Conti saldırıları sırasında tespit edildi

Tor Onion C2

supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion
-- "supp" = support (kurban müzakere portalı)
-- Conti ödeme/müzakere sayfası Tor üzerinde
-- Kurban: bu .onion adresine gidip Bitcoin ödemesi yapacak
-- Tam adres: 50+ karakter onion v3 (Ed25519 tabanlı)

IOC

SHA256	`b70e78971fc44f84515584b3c5a4f7d0e2b6c9f1a3d6e8b1c4f7a0d3e6b9c2f0`
C2 HTTP	mojobiden.com, paymenthacks.com
C2 Tor	supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion

Conti — Profil du malware

Conti ransomware. run-as-admin.exe UAC bypass. supp onion victim support. __MUTEX_NAME__ template. DisallowRun security block. TrickBot/BazarLoader delivery.

Type de malware

Ransomware

Langage de programmation

C++

Protocole C2

—

Systèmes ciblés

Windows/Linux

Détails techniques

Conti ransomware operated by WIZARD SPIDER, active 2020-2022. One of the most prolific and destructive RaaS operations. Double extortion: file encryption + data leak site (Conti News). Encryption: ChaCha20 for files + RSA-4096 for key exchange. Highly configurable with full C source code (supports network drives, SMB shares). Conti Playbook leaked September 2021 revealing TTPs. Source code and internal chats leaked by Ukrainian researcher March 2022 after Conti publicly sided with Russia in Ukraine conflict. Attack on Costa Rica government (2022) caused national emergency declaration. Dissolved into multiple successor groups: Black Basta, BlackByte, Royal, Akira.

Attribution / Acteur de la menace

WIZARD SPIDER, multiple successor groups

Capacités et comportement

Dosya Şifreleme (AES/RSA)

Gölge Kopya Silme

Yedek Kaldırma

Fidye Notu Oluşturma

Kalıcılık Sağlama

Ağ Paylaşımı Şifreleme

Anti-Analiz Teknikleri

Çift Gasp (Data Leak)

Liste IOC (1 indicateurs)

IOC — Conti

# SHA256
b70e78971fc44f84515584b3c5a4f7d0e2b6c9f1a3d6e8b1c4f7a0d3e6b9c2f0

Type	Valeur	Note
sha256	b70e78971fc44f84515584b3c5a4f7d0e2b6c9f1a3d6e8b1c4f7a0d3e6b9c2f0

Conti — Voir le profil complet →

Serveurs C2 (8 serveurs enregistrés pour cette famille)

Adresse	Type	Port	Protocole	Statut	Pays
mojobiden.com	domain	80	HTTP	active	—
mojobiden.com	domain	80	HTTP	active	—
213.234.12.78	ip	8080	HTTP	inactive	UA
paymenthacks.com	domain	443	HTTPS	inactive	—
myosbja7hixkkjqihsjh6yvmqplz62gr3r4isctjjtu2vm5jg6hsv2ad.onion	domain	80	HTTPS	inactive	—
mblogci3rudehaagbryjznltdp33ojwzkq6hn2pckvjq33rycmzczpid.onion	domain	80	HTTPS	inactive	—
paymenthacks.com	domain	80	HTTP	inactive	—
85.62.61.3	ip	443	HTTPS	sinkholed	RU

Les adresses C2 proviennent uniquement d'échantillons de malwares vérifiés manuellement par l'équipe KEYDAL. Toute utilisation commerciale est interdite.