General
-
Target
fcc97208b57b5fd3aa022af41cac4eccacbb3c644da529f0427d7795037b1607
-
Size
2.9MB
-
Sample
220311-143rssbgh4
-
MD5
58350cc6958effae6c453a7fcd78cdf4
-
SHA1
bf7a55e2082277418641dea07303595e66c55cb7
-
SHA256
fcc97208b57b5fd3aa022af41cac4eccacbb3c644da529f0427d7795037b1607
-
SHA512
27c75e65de834eb2609fbbf9dc8f083f086d7ecc76051ee25227b3f2c837c0a216e20633a1cf9f10cfe2bda9fa0153e617f2be40cb3eb79158049aa3c39228b1
Static task
static1
Behavioral task
behavioral1
Sample
6660d0e87a142ab1bde4521d9c6f5e148490b05a57c71122e28280b35452e896.exe
Resource
win7-20220310-en
Behavioral task
behavioral2
Sample
6660d0e87a142ab1bde4521d9c6f5e148490b05a57c71122e28280b35452e896.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
blackcat
- Username:
Administrateur - Password:
Imed
- Username:
Irvoas - Password:
irvoas
- Username:
secretariat - Password:
secretariat
- Username:
cao - Password:
cao
-
enable_network_discovery
true
-
enable_self_propagation
true
-
enable_set_wallpaper
true
-
extension
ua3a2q0
-
note_file_name
RECOVER-${EXTENSION}-FILES.txt
-
note_full_text
Meow Meow. Bonjour. Welcome to the Black Cat Ransomware. We have been infilitrating your network for weeks and uploading all your files to our servers. We have ALL your info, ongoing projects (affaires en cours) and ended ones, providers information, passports... You better contact us fast, price will be cheaper and no one will know. If you dont contact in 5 days, we will contact all your customers 1 by 1 and publishing their info. Dont waste time with backups, we have deleted them. >> What happened? Important files on your network was ENCRYPTED and now they have "${EXTENSION}" extension. In order to recover your files you need to follow instructions below. >> Sensitive Data Sensitive data on your network was DOWNLOADED. If you DON'T WANT your sensitive data to be PUBLISHED you have to act quickly. Data includes: -Affaires en course -Affaires termines -Fournisseurs -Logiciels -Disputes -Blueprints for all your projects. -Customers contact and financial information. - Employees personal data, includin passports -All the emails (/sauve mail). - Complete network map including credentials for local and remote services. - Private financial information including: clients data, bills, budgets, annual reports, bank statements. - Manufacturing documents including: datagrams, schemas, drawings in solidworks format - And more... >> CAUTION DO NOT MODIFY ENCRYPTED FILES YOURSELF. DO NOT USE THIRD PARTY SOFTWARE TO RESTORE YOUR DATA. YOU MAY DAMAGE YOUR FILES, IT WILL RESULT IN PERMANENT DATA LOSS. >> What should I do next? 1) Download and install Tor Browser from: https://torproject.org/ 2) Navigate to: http://lputkyq4cnbwrpdmjfahc6vnvs2rhia6fq2eycjuxvv5dbob3mqvh6qd.onion/?access-key=${ACCESS_KEY}
Targets
-
-
Target
6660d0e87a142ab1bde4521d9c6f5e148490b05a57c71122e28280b35452e896.exe
-
Size
2.9MB
-
MD5
cf2264987cc01dc8d3f72027347a968b
-
SHA1
3d385b316df5d37d39b10113a67080fc1516e0c9
-
SHA256
6660d0e87a142ab1bde4521d9c6f5e148490b05a57c71122e28280b35452e896
-
SHA512
3a8ce5a82f4455804e8f0a43526b8d60524426a4a4ae04f777cfd6d139ef6e7adcc4cbc07fcbe6399f6ad583e293fa6f6b27e95db30f14a89cf51ca5622516e6
Score1/10 -