Essential information

Value / Name

d80db8afc1145d754007c88bac8d8e3e3d8166c4

Confidence

100/100

Revoked

Yes

Valid from

22/09/2023 16:27

Valid until

25/12/2024 15:27

Pattern type

yara

Published

20/12/2025 19:40

Modified

21/12/2025 01:13

Author / Source

AlienVault

Description

Pattern

rule monti_ransom {    
    meta:    
    description = "Detects ChaCha8 encrypted 'MONTI Strain' text (using all-zero key and nonce) embedded in ransomware payload"    
    author = "BlackBerry Threat Research Team"    
    date = "August 15, 2021"    
    license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"  strings:    
    $s = {20 19 57 65 03 62 D0 AE F4 D1 68}  condition:    
    uint16be(0) == 0x4d5a and filesize < 2MB    
    and $s    
   }

Labels / Tags

Labels: conti dumper eazfuscator monti reverse engineering sql database veeambackup veeamp

Marking (TLP)

TLP:CLEAR