blackbasta | affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada

General

Target

affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe
Size

546KB
Sample

221130-3l5vjseh58
MD5

adb3cf03e9be744107e61bd7de4c26bd
SHA1

cc7ea6bb6787df664adb69022546c42f5f409653
SHA256

affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada
SHA512

ba7591375768521bf7497a6c9f3c53a7121824ed352edc043dc24ca23dbd55d8c73e37fd96ce32d45aa16b7955a1fff7bcd31f25d22624bab60d598a4e536927
SSDEEP

12288:9+qCsxmzj5xiJn+aJ5REfBFW8ciUt0MV5OcIBpwG01:94riJnvJUfBFW8ciMbOc0b0

Score

10^/10

blackbasta ransomware

Malware Config

Extracted

Path

C:\MSOCache\readme.txt

Ransom Note

Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom You can contact us and decrypt one file for free on this TOR site (you should download and install TOR browser first https://torproject.org) https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/ Your company id for log in: 05d09847-9593-4dc6-95aa-61587e40e103

URLs

https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/

Targets

- Target
  
  affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada.exe
- Size
  
  546KB
- MD5
  
  adb3cf03e9be744107e61bd7de4c26bd
- SHA1
  
  cc7ea6bb6787df664adb69022546c42f5f409653
- SHA256
  
  affcb453760dbc48b39f8d4defbcc4fc65d00df6fae395ee27f031c1833abada
- SHA512
  
  ba7591375768521bf7497a6c9f3c53a7121824ed352edc043dc24ca23dbd55d8c73e37fd96ce32d45aa16b7955a1fff7bcd31f25d22624bab60d598a4e536927
- SSDEEP
  
  12288:9+qCsxmzj5xiJn+aJ5REfBFW8ciUt0MV5OcIBpwG01:94riJnvJUfBFW8ciMbOc0b0
Score

10^/10

blackbasta ransomware
- Black Basta
  A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
  ransomware blackbasta
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2