blackbasta | 1391c20a26f248f7c602f20096bf1886cfe7e4d151602a1258a9bbe7c02c1c80

General

Target

1391c20a26f248f7c602f20096bf1886cfe7e4d151602a1258a9bbe7c02c1c80
Size

524KB
Sample

221106-amzqpsach5
MD5

20d03f8272648fa3fd31e222b8e2220f
SHA1

ac20624e8aff3d4f9c42a8e2ddd493250e631f47
SHA256

1391c20a26f248f7c602f20096bf1886cfe7e4d151602a1258a9bbe7c02c1c80
SHA512

3bcfde35141671b4de022ae2423d020e53de35075c9a2c0a2dde45dc993364543af443dc97e6d3cc96c9a1d34533d6adb50c2495a23b5c4de97f64b3176ebd70
SSDEEP

12288:SwCt9ZABL6wADs7yjyYTW3nMxIg/NmGta1WeGcvc4OulNI:AHUADs+jVW3nMxIKMOa1Wpecule

Score

10^/10

blackbasta ransomware

Malware Config

Extracted

Path

C:\MSOCache\readme.txt

Ransom Note

Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom You can contact us and decrypt one file for free on this TOR site (you should download and install TOR browser first https://torproject.org) https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/ Your company id for log in: 41bdf082-8936-4e21-9f70-5446160a730f

URLs

https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/

Targets

- Target
  
  1391c20a26f248f7c602f20096bf1886cfe7e4d151602a1258a9bbe7c02c1c80
- Size
  
  524KB
- MD5
  
  20d03f8272648fa3fd31e222b8e2220f
- SHA1
  
  ac20624e8aff3d4f9c42a8e2ddd493250e631f47
- SHA256
  
  1391c20a26f248f7c602f20096bf1886cfe7e4d151602a1258a9bbe7c02c1c80
- SHA512
  
  3bcfde35141671b4de022ae2423d020e53de35075c9a2c0a2dde45dc993364543af443dc97e6d3cc96c9a1d34533d6adb50c2495a23b5c4de97f64b3176ebd70
- SSDEEP
  
  12288:SwCt9ZABL6wADs7yjyYTW3nMxIg/NmGta1WeGcvc4OulNI:AHUADs+jVW3nMxIKMOa1Wpecule
Score

10^/10

blackbasta ransomware
- Black Basta
  A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
  ransomware blackbasta
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2