blackcat | blackcat2[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
blackcat2.zip
Size 1.6MB
Sample221229-fbk13acd33
SHA256 d0a91a7fdaf19a825cf4eafd186d5da7079cfe9b54f7d51b850e6af303725483
MD5 f46a2fb7b8cd1e92ce8b136db5455252
SHA1 f23a53c58b284dc84c5ea1822e52284e5a2d7991
SHA512 eca5ca053bd77292fcade2e14f1ea7aa1c9b25dcbc5491c4997ed5b45837574d6ccef2ceb3c967a26a72bc252df571b5a27ae323f6d227eb9816f9e6285046f0
SSDEEP 24576:yBzR6j3UeZuvWvirk0cSw31u1MHpVGoZGwBQP/+VoIN/0fi/T2u3r7:ycU7vWvuArlnptAk1VJNZyu77
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

blackcat

Malware Config

Extracted

Family

blackcat

Credentials

Username
KELLERSUPPLY\Administrator
Password
d@gw00d

Credentials

Username
KELLERSUPPLY\AdminRecovery
Password
K3ller!$Supp1y

Credentials

Username
.\Administrator
Password
d@gw00d

Credentials

Username
.\Administrator
Password
K3ller!$Supp1y

Attributes

enable_network_discovery
true
enable_self_propagation
false
enable_set_wallpaper
true
extension
sykffle
note_file_name
RECOVER-${EXTENSION}-FILES.txt
note_full_text
>> Introduction Important files on your system was ENCRYPTED and now they have have "${EXTENSION}" extension. In order to recover your files you need to follow instructions below. >> Sensitive Data Sensitive data on your system was DOWNLOADED and it will be PUBLISHED if you refuse to cooperate. Data includes: - Employees personal data, CVs, DL, SSN. - Complete network map including credentials for local and remote services. - Financial information including clients data, bills, budgets, annual reports, bank statements. - Complete datagrams/schemas/drawings for manufacturing in solidworks format - And more... Private preview is published here: http://zujgzbu5y64xbmvc42addp4lxkoosb4tslf5mehnh7pvqjpwxn5gokyd.onion/b21e1fb6-ff88-425b-8339-3523179a1e3e/886cf430a907bbe9a3fd38fb704d524dbd199c1b042ad6f65dc72ad78704e21 >> CAUTION DO NOT MODIFY FILES YOURSELF. DO NOT USE THIRD PARTY SOFTWARE TO RESTORE YOUR DATA. YOU MAY DAMAGE YOUR FILES, IT WILL RESULT IN PERMANENT DATA LOSS. YOUR DATA IS STRONGLY ENCRYPTED, YOU CAN NOT DECRYPT IT WITHOUT CIPHER KEY. >> Recovery procedure Follow these simple steps to get in touch and recover your data: 1) Download and install Tor Browser from: https://torproject.org/ 2) Navigate to: http://mu75ltv3lxd24dbyu6gtvmnwybecigs5auki7fces437xvvflzva2nqd.onion/?access-key=${ACCESS_KEY}

rsa_pubkey.plain

Signatures

Blackcat family
blackcat

File Explorer

blackcat2.zip

.zip 1.6MB
blackcat2.exe

.exe 2.6MB
ĵ.doc

30.2MB

blackcat2.zip

SHA256 d0a91a7fdaf19a825cf4eafd186d5da7079cfe9b54f7d51b850e6af303725483
MD5 f46a2fb7b8cd1e92ce8b136db5455252
SHA1 f23a53c58b284dc84c5ea1822e52284e5a2d7991
SHA512 eca5ca053bd77292fcade2e14f1ea7aa1c9b25dcbc5491c4997ed5b45837574d6ccef2ceb3c967a26a72bc252df571b5a27ae323f6d227eb9816f9e6285046f0
SSDEEP 24576:yBzR6j3UeZuvWvirk0cSw31u1MHpVGoZGwBQP/+VoIN/0fi/T2u3r7:ycU7vWvuArlnptAk1VJNZyu77
MD5 SHA1 SHA512 SSDEEP

blackcat2.exe

IMPHASH 2c3e267ae163c15bfc251e74ea5319b2
SHA256 0c6f444c6940a3688ffc6f8b9d5774c032e3551ebbccb64e4280ae7fc1fac479
MD5 bb266486ee8ac70c0687989e02cefa14
SHA1 11203786b17bb3873d46acae32a898c8dac09850
SHA512 a167779fc95a5cf0a3eff86211e9e08c282470e050b17ae62c7499a82ea59b3447446eafea9d7b5c5ba833b7a2d060f76530b00509dd5ff7904a0735d83e14c4
SSDEEP 49152:rEqvaaAjc2hdKjb8WXqE1PiEbE/TKMt3/RgaJ2wW4PRT8O1:rbyaALKjwWXV1P9oVvwwW4JT8
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

5312

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

CloseServiceHandle ControlService EnumDependentServicesW EnumServicesStatusExW OpenProcessToken OpenSCManagerW OpenServiceW QueryServiceStatusEx RegCloseKey RegOpenKeyExW RegQueryValueExW RegSetValueExW

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AddVectoredExceptionHandler AttachConsole CancelIo CloseHandle CompareStringOrdinal CopyFileExW CreateEventW CreateFileMappingA CreateFileW CreateMutexA CreateNamedPipeW CreateProcessW CreateThread CreateToolhelp32Snapshot DeleteFileW DeviceIoControl DuplicateHandle EnterCriticalSection ExitProcess FileTimeToSystemTime FillConsoleOutputAttribute FillConsoleOutputCharacterA FindClose FindFirstFileW FindFirstVolumeW FindNextFileW FindNextVolumeW FindVolumeClose FormatMessageW FreeConsole FreeEnvironmentStringsW FreeLibrary GetCommandLineW GetComputerNameW GetConsoleMode GetConsoleScreenBufferInfo GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileInformationByHandle GetFileInformationByHandleEx GetFullPathNameW GetLastError GetLogicalDrives GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetOverlappedResult GetProcAddress GetProcessHeap GetStartupInfoA GetStdHandle GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetTimeZoneInformation GetVolumePathNamesForVolumeNameW HeapAlloc HeapFree HeapReAlloc InitializeCriticalSection LeaveCriticalSection LoadLibraryA MapViewOfFile Module32FirstW Module32NextW MoveFileExW OpenProcess Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency ReadConsoleW ReadFile ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared RemoveDirectoryW SetConsoleCursorInfo SetConsoleCursorPosition SetConsoleMode SetConsoleTextAttribute SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetHandleInformation SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter SetVolumeMountPointW Sleep SwitchToThread SystemTimeToFileTime SystemTimeToTzSpecificLocalTime TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection TzSpecificLocalTimeToSystemTime UnmapViewOfFile WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx Wow64DisableWow64FsRedirection WriteConsoleW WriteFile lstrlenW DeleteCriticalSection GetCurrentThreadId GetTickCount UnhandledExceptionFilter VirtualProtect VirtualQuery

netapi32

NetApiBufferFree NetServerEnum NetShareEnum

ntdll

RtlCaptureContext

user32

SystemParametersInfoW

ws2_32

WSACleanup WSAGetLastError WSASocketW WSAStartup bind closesocket connect freeaddrinfo getaddrinfo ioctlsocket recv recvfrom send sendto setsockopt

bcrypt

BCryptGenRandom

msvcrt

__dllonexit __getmainargs __initenv __lconv_init __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _fmode _fpreset _initterm _iob _lock _onexit _unlock calloc ceil exit fprintf free fwrite malloc memcmp memcpy memmove memset signal strlen strncmp abort atexit vfprintf

userenv

GetUserProfileDirectoryW

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

264B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

565KB

Virtual Size

564KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

55KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

84B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

400KB

Virtual Size

596KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

blackcat2.zip

blackcat2.exe

advapi32

kernel32

netapi32

ntdll

user32

ws2_32

bcrypt

msvcrt

userenv

ĵ.doc