Overview

overview

10

Static

static

10

blackcat.zip

windows7-x64

1

blackcat.zip

windows10-2004-x64

1

blackcat.exe

windows7-x64

1

blackcat.exe

windows10-2004-x64

1

�...��.doc

windows7-x64

4

�...��.doc

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    blackcat.zip

  • Size

    1.6MB

  • Sample

    221229-e4tm8sfd5v

  • MD5

    f8fa36ebd1c3e16af23c1e5e5b08b81d

  • SHA1

    420febdc5f3f0cda8097ab229f137a9806d19dea

  • SHA256

    3539c61962135c39176ba278fffe871d39d7f2055000650f8b13bdcad2d0d502

  • SHA512

    9aeeaa8dc99c3d56e68f80fed3609c4fe777acf30f67b2e9d39e8f2e74be77682501c75ff17fe20ab24b2b462db103cae1b16cad5e927dc5145fcef0b7d1a7c1

  • SSDEEP

    49152:ji3xXV9n+CCQUcyqDUSuc002G3RvISSfl211I:jyxDCXcyjSuc002mg/flgI

Score
10/10
blackcat

Malware Config

Extracted

Family

blackcat

Credentials
  • Username:
    NANOFOCUS.LOCAL\Administrator
  • Password:
    368CkbIna?#
Attributes
  • enable_network_discovery

    true

  • enable_self_propagation

    true

  • enable_set_wallpaper

    true

  • extension

    mfqssdj

  • note_file_name

    RECOVER-${EXTENSION}-FILES.txt

  • note_full_text

    >> What happened? Important files on your network was ENCRYPTED and now they have "${EXTENSION}" extension. In order to recover your files you need to follow instructions below. >> Sensitive Data Sensitive data on your system was DOWNLOADED. If you DON'T WANT your sensitive data to be PUBLISHED you have to act quickly. Data includes: - Employees personal data, CVs, DL, SSN. - Complete network map including credentials for local and remote services. - Private financial information including: clients data, bills, budgets, annual reports, bank statements. - Manufacturing documents including: datagrams, schemas, drawings in solidworks format. - Source code. -And more... >> CAUTION DO NOT MODIFY ENCRYPTED FILES YOURSELF. DO NOT USE THIRD PARTY SOFTWARE TO RESTORE YOUR DATA. YOU MAY DAMAGE YOUR FILES, IT WILL RESULT IN PERMANENT DATA LOSS. >> What should I do next? Follow these simple steps to get everything back to normal: 1) Download and install Tor Browser from: https://torproject.org/ 2) Navigate to: http://b4twqa2mvob3s6uvuyfra5xk3qgps2v5kkt7k2qnb7rpdu3j4fkntead.onion/?access-key=${ACCESS_KEY}

rsa_pubkey.plain

Targets

    • Target

      blackcat.zip

    • Size

      1.6MB

    • MD5

      f8fa36ebd1c3e16af23c1e5e5b08b81d

    • SHA1

      420febdc5f3f0cda8097ab229f137a9806d19dea

    • SHA256

      3539c61962135c39176ba278fffe871d39d7f2055000650f8b13bdcad2d0d502

    • SHA512

      9aeeaa8dc99c3d56e68f80fed3609c4fe777acf30f67b2e9d39e8f2e74be77682501c75ff17fe20ab24b2b462db103cae1b16cad5e927dc5145fcef0b7d1a7c1

    • SSDEEP

      49152:ji3xXV9n+CCQUcyqDUSuc002G3RvISSfl211I:jyxDCXcyjSuc002mg/flgI

    Score
    1/10
    behavioral1behavioral2

    • Target

      blackcat.bin

    • Size

      2.9MB

    • MD5

      ccde3fe374a219ed3a85a0bf548542c3

    • SHA1

      c1187fe0eaddee995773d6c66bcb558536e9b62c

    • SHA256

      c3e5d4e62ae4eca2bfca22f8f3c8cbec12757f78107e91e85404611548e06e40

    • SHA512

      94852c04d6f627b35a7486de166648eb43373850b862e1958e676c53fd5dc37103659fe28e2b51f2fffd815ded2745d8793d8158543ff14b1e1f0cafe2a3c63c

    • SSDEEP

      49152:4dwE1vCCeShiBHJFIPiEPE3bvk6Ca89388YhwjfJNt/RgaJ2wtb:WwE1253IPiYE3bnCa8Hzj5vwwtb

    Score
    1/10
    behavioral3behavioral4

    • Target

      ĵ.doc

    • Size

      30.2MB

    • MD5

      277dc0423cdb0e81ab4913b56719ee9f

    • SHA1

      28f7523185f3af2f441163a8dbb2ec86eeae4360

    • SHA256

      cbbeaba48435e1711b2a3d1f2983dac8f5d681d48163782ca5ac3ed9cb63454d

    • SHA512

      78d6fdb5b18035978b2518d513d4f2bf27441bb1889a26b35765cd2f303ad44b26d0f105f8e4ed69242fff1348a92e536266f859746cdb00168bc652ae0e91be

    • SSDEEP

      3:k63636363636363636363636363636363636363636363636363636363636363z:n

    Score
    4/10
    behavioral5behavioral6

MITRE ATT&CK Enterprise v6

Tasks