blackbasta | a252719d1712ec5aa37a8ce6e84474584c7d8d8221fa5aa033f32f5f5cf6d484

General

Target

a252719d1712ec5aa37a8ce6e84474584c7d8d8221fa5aa033f32f5f5cf6d484
Size

452KB
Sample

221203-fwjzhagd66
MD5

e029a9272ec6143f355336607444126d
SHA1

03daa3569328bb9771ddbcafc05ab9e90a8679f5
SHA256

a252719d1712ec5aa37a8ce6e84474584c7d8d8221fa5aa033f32f5f5cf6d484
SHA512

e8ccdd63f20ce86459f96a4ba11a451c48ed63045af91ba2b6d53ad0ca33cd39ed5e09f24fcd1250a5d29be9a3f3bcbe4a62c3a118fe5a75912ee098569573d9
SSDEEP

6144:rSweN/Prd9a3hETz571wU1KyY5kzwVY1TbhU1mekUzJ9A/6HLpeukgsOA7nbmUE1:rShN6Mbtd18KTbaesk6guvQbm1sSbL

Score

10^/10

blackbasta ransomware

Malware Config

Extracted

Path

C:\MSOCache\readme.txt

Ransom Note

Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom You can contact us and decrypt one file for free on this TOR site (you should download and install TOR browser first https://torproject.org) https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/ Your company id for log in: eeded09d-2ac0-4e69-bf25-875cd524e744

URLs

https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/

Targets

- Target
  
  a252719d1712ec5aa37a8ce6e84474584c7d8d8221fa5aa033f32f5f5cf6d484
- Size
  
  452KB
- MD5
  
  e029a9272ec6143f355336607444126d
- SHA1
  
  03daa3569328bb9771ddbcafc05ab9e90a8679f5
- SHA256
  
  a252719d1712ec5aa37a8ce6e84474584c7d8d8221fa5aa033f32f5f5cf6d484
- SHA512
  
  e8ccdd63f20ce86459f96a4ba11a451c48ed63045af91ba2b6d53ad0ca33cd39ed5e09f24fcd1250a5d29be9a3f3bcbe4a62c3a118fe5a75912ee098569573d9
- SSDEEP
  
  6144:rSweN/Prd9a3hETz571wU1KyY5kzwVY1TbhU1mekUzJ9A/6HLpeukgsOA7nbmUE1:rShN6Mbtd18KTbaesk6guvQbm1sSbL
Score

10^/10

blackbasta ransomware
- Black Basta
  A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
  ransomware blackbasta
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2