blackbasta | 7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a

General

Target

7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.bin
Size

543KB
Sample

221009-neebpahaep
MD5

998022b70d83c6de68e5bdf94e0f8d71
SHA1

b87a947f3e85701fcdadd733e9b055a65a3b1308
SHA256

7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a
SHA512

2744b77f951bd2bb34b094dd3b54fcf8f7dca76e03c745809edc045749c814c7d88c9ddd69ad684a1c156716afae76b5ebec3f932d0f2a72b242878134f65647
SSDEEP

12288:M1DTMHixr1moQqUiXINDl/m1s6BQio67VlA:AzmoQqUiXw2s6yiVx

Score

10^/10

blackbasta ransomware

Malware Config

Extracted

Path

C:\readme.txt

Ransom Note

Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom You can contact us and decrypt one file for free on this TOR site (you should download and install TOR browser first https://torproject.org) https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion:80/ Your company id for log in: ba7a7058-3531-4b67-bae6-d602e9110361

URLs

https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion:80/

Targets

- Target
  
  7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a.bin
- Size
  
  543KB
- MD5
  
  998022b70d83c6de68e5bdf94e0f8d71
- SHA1
  
  b87a947f3e85701fcdadd733e9b055a65a3b1308
- SHA256
  
  7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a
- SHA512
  
  2744b77f951bd2bb34b094dd3b54fcf8f7dca76e03c745809edc045749c814c7d88c9ddd69ad684a1c156716afae76b5ebec3f932d0f2a72b242878134f65647
- SSDEEP
  
  12288:M1DTMHixr1moQqUiXINDl/m1s6BQio67VlA:AzmoQqUiXw2s6yiVx
Score

10^/10

blackbasta ransomware
- Black Basta
  A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
  ransomware blackbasta
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1