Genel Bakış
Royal, Conti üyesiyle ilişkilidir.
MalwareBazaar İstihbarat Verileri
Hash Örnekleri (İlk 50)
| SHA256 | MD5 | İlk Görülme | Tip | Boyut |
|---|---|---|---|---|
| 09a79e5e20fa4f5aae61... | 1feee7319f7a6560... | 2023-05-03 | elf | 2.558.055 |
| b64acb7dcc968b9a3a49... | a9429fa4db9a5fe0... | 2023-02-04 | elf | 2.558.055 |
| 06abc46d5dbd012b170c... | 87adb14271dc49e6... | 2023-02-03 | elf | 2.558.055 |
| b57e5f0c857e807a0377... | 2902e12f00a18547... | 2023-02-02 | elf | 2.558.055 |
| beef7e428f26c583dd92... | a0e99a1ba424a8f9... | 2023-01-30 | exe | 2.245.120 |
| 8e01ecf9d804454f34ee... | 613daed6d9b84066... | 2023-01-02 | dll | 2.235.392 |
| f484f919ba6e36ff33e4... | df0b88dafe7a6529... | 2022-10-12 | exe | 3.085.312 |
IOC Özeti
- Bu analiz 7 adet benzersiz Royal örneğini kapsar.
- Toplam 14 hash IOC kayıt altına alındı.
- Kampanya aktivitesi: 2022-10-12 ile 2023-05-03 arasında tespit edildi.
Royal — Malware Profile
Royal, 2022-2023 aktif C++ ransomware. Conti varisi. Kismi sifreleme. BlackSuit olarak yeniden markalasmis. CISA 2023.
Malware Type
Ransomware
Programming Language
C++
C2 Protocol
—
Target Systems
Windows
Technical Details
Ransomware ailesi: AES/RSA hibrid sifreleme, dosya uzantisi degistirme, shadow copy silme, C2 ile anahtar alis-verisi, fidye notu birakma, kullanici belgelerine odaklanma
Capabilities & Behavior
Dosya Şifreleme (AES/RSA)
Gölge Kopya Silme
Yedek Kaldırma
Fidye Notu Oluşturma
Kalıcılık Sağlama
Ağ Paylaşımı Şifreleme
Anti-Analiz Teknikleri
Çift Gasp (Data Leak)
IOC List (28 indicators)
IOC — Royal
# SHA256
09a79e5e20fa4f5aae610c8ce3fe954029a91972b56c6576035ff7e0ec4c1d14
# SHA256
b64acb7dcc968b9a3a4909e3fddc2e116408c50079bba7678e85fee82995b0f4
# SHA256
06abc46d5dbd012b170c97d142c6b679183159197e9d3f6a76ba5e5abf999725
# SHA256
b57e5f0c857e807a03770feb4d3aa254d2c4c8c8d9e08687796be30e2093286c
# SHA256
beef7e428f26c583dd92962cbe886f2e4286825a1637b7a427ce84139ab6307a
# SHA256
8e01ecf9d804454f34eeceb0f7793f4884be8868886a646526419fc2e2bbb648
# SHA256
09a79e5e20fa4f5aae610c8ce3fe954029a91972b56c6576035ff7e0ec4c1d14
# SHA256
f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429
# SHA256
b64acb7dcc968b9a3a4909e3fddc2e116408c50079bba7678e85fee82995b0f4
# SHA256
06abc46d5dbd012b170c97d142c6b679183159197e9d3f6a76ba5e5abf999725
# SHA256
b57e5f0c857e807a03770feb4d3aa254d2c4c8c8d9e08687796be30e2093286c
# SHA256
beef7e428f26c583dd92962cbe886f2e4286825a1637b7a427ce84139ab6307a
# SHA256
8e01ecf9d804454f34eeceb0f7793f4884be8868886a646526419fc2e2bbb648
# SHA256
f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429
# MD5
1feee7319f7a656080be51b6e7267764
# MD5
a9429fa4db9a5fe059896653a5d4d35c
# MD5
87adb14271dc49e6b0f2eb4b03f4bbe7
# MD5
2902e12f00a185471b619233ee8631f3
# MD5
a0e99a1ba424a8f967b13021b42fce9f
# MD5
613daed6d9b8406602f11019ba28d779
# MD5
1feee7319f7a656080be51b6e7267764
# MD5
df0b88dafe7a65295f99e69a67db9e1b
# MD5
a9429fa4db9a5fe059896653a5d4d35c
# MD5
87adb14271dc49e6b0f2eb4b03f4bbe7
# MD5
2902e12f00a185471b619233ee8631f3
# MD5
a0e99a1ba424a8f967b13021b42fce9f
# MD5
613daed6d9b8406602f11019ba28d779
# MD5
df0b88dafe7a65295f99e69a67db9e1b
| Type | Value | Note |
|---|---|---|
| sha256 | 09a79e5e20fa4f5aae610c8ce3fe954029a91972b56c6576035ff7e0ec4c1d14 | MB:Royal |
| sha256 | b64acb7dcc968b9a3a4909e3fddc2e116408c50079bba7678e85fee82995b0f4 | MB:Royal |
| sha256 | 06abc46d5dbd012b170c97d142c6b679183159197e9d3f6a76ba5e5abf999725 | MB:Royal |
| sha256 | b57e5f0c857e807a03770feb4d3aa254d2c4c8c8d9e08687796be30e2093286c | MB:Royal |
| sha256 | beef7e428f26c583dd92962cbe886f2e4286825a1637b7a427ce84139ab6307a | MB:Royal |
| sha256 | 8e01ecf9d804454f34eeceb0f7793f4884be8868886a646526419fc2e2bbb648 | MB:Royal |
| sha256 | 09a79e5e20fa4f5aae610c8ce3fe954029a91972b56c6576035ff7e0ec4c1d14 | MB:Royal |
| sha256 | f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429 | MB:Royal |
| sha256 | b64acb7dcc968b9a3a4909e3fddc2e116408c50079bba7678e85fee82995b0f4 | MB:Royal |
| sha256 | 06abc46d5dbd012b170c97d142c6b679183159197e9d3f6a76ba5e5abf999725 | MB:Royal |
| sha256 | b57e5f0c857e807a03770feb4d3aa254d2c4c8c8d9e08687796be30e2093286c | MB:Royal |
| sha256 | beef7e428f26c583dd92962cbe886f2e4286825a1637b7a427ce84139ab6307a | MB:Royal |
| sha256 | 8e01ecf9d804454f34eeceb0f7793f4884be8868886a646526419fc2e2bbb648 | MB:Royal |
| sha256 | f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429 | MB:Royal |
| md5 | 1feee7319f7a656080be51b6e7267764 | MB:Royal |
| md5 | a9429fa4db9a5fe059896653a5d4d35c | MB:Royal |
| md5 | 87adb14271dc49e6b0f2eb4b03f4bbe7 | MB:Royal |
| md5 | 2902e12f00a185471b619233ee8631f3 | MB:Royal |
| md5 | a0e99a1ba424a8f967b13021b42fce9f | MB:Royal |
| md5 | 613daed6d9b8406602f11019ba28d779 | MB:Royal |
| md5 | 1feee7319f7a656080be51b6e7267764 | MB:Royal |
| md5 | df0b88dafe7a65295f99e69a67db9e1b | MB:Royal |
| md5 | a9429fa4db9a5fe059896653a5d4d35c | MB:Royal |
| md5 | 87adb14271dc49e6b0f2eb4b03f4bbe7 | MB:Royal |
| md5 | 2902e12f00a185471b619233ee8631f3 | MB:Royal |
| md5 | a0e99a1ba424a8f967b13021b42fce9f | MB:Royal |
| md5 | 613daed6d9b8406602f11019ba28d779 | MB:Royal |
| md5 | df0b88dafe7a65295f99e69a67db9e1b | MB:Royal |