Resubmissions

29-04-2023 00:04

230429-acrx4sah5x 10

28-04-2023 15:19

230428-sp6wxaeh54 8

General

  • Target

    SIR02TEST.7z

  • Size

    230KB

  • Sample

    230429-acrx4sah5x

  • MD5

    61dc6039703d3a09efdf0c90d8e73e08

  • SHA1

    1034712e72e527dd7a60b4ff08d5a653a3fd319d

  • SHA256

    5b9b1df2edcdddc88c613abed6ffebea61aaea766649473769d501e7f5dc23cb

  • SHA512

    f0a01b76ea5787eada77c1542cc63df07bfcc6d660dad1d9a6b79310f49680e88d57ef784a6e141c6364422ce6ec4132237d8885fe75e85a3cfa30100cf58be7

  • SSDEEP

    6144:AmK8/VV0WtA33lUNYQmVKTzoC3PQDQYfzbbFln:AmKisW0UNYQoMB3P45t

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\readme.txt

Family

blackbasta

Ransom Note
All of your files are currently encrypted by no_name_software. These files cannot be recovered by any means without contacting our team directly. DON'T TRY TO RECOVER your data by yourselves. Any attempt to recover your data (including the usage of the additional recovery software) can damage your files. However, if you want to try - we recommend choosing the data of the lowest value. DON'T TRY TO IGNORE us. We've downloaded a pack of your internal data and are ready to publish it on our news website if you do not respond. So it will be better for both sides if you contact us as soon as possible. DON'T TRY TO CONTACT feds or any recovery companies. We have our informants in these structures, so any of your complaints will be immediately directed to us. So if you will hire any recovery company for negotiations or send requests to the police/FBI/investigators, we will consider this as a hostile intent and initiate the publication of whole compromised data immediately. DON'T move or rename your files. These parameters can be used for encryption/decryption process. To prove that we REALLY CAN get your data back - we offer you to decrypt two random files completely free of charge. You can contact our team directly for further instructions through our website : TOR VERSION : (you should download and install TOR browser first https://torproject.org) https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion:80/ Your company id for log in: c98fa42b-3233-45df-bd7c-42529c44cb70 Your company key: 3 of any of your dc through comma. Example: "DC1, DC2, DC3". You can type less if you have no enough YOU SHOULD BE AWARE! We will speak only with an authorized person. It can be the CEO, top management, etc. In case you are not such a person - DON'T CONTACT US! Your decisions and action can result in serious harm to your company! Inform your supervisors and stay calm!
URLs

https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion:80/

Targets

    • Target

      blackbasta.exe

    • Size

      636KB

    • MD5

      267d5c3137d313ce1a86c2f255a835e6

    • SHA1

      c7a37c0edeffd23777cca44f9b49076be1bd43e6

    • SHA256

      17205c43189c22dfcb278f5cc45c2562f622b0b6280dcd43cc1d3c274095eb90

    • SHA512

      9c119a9f973dae77f2cdd6a855ae45c20660aadc5c592f6d06f6360dd0bb5a380d0ed1fcc23c0cb721da70bcca7d32db46181be675bf0587276d35d6da26a31e

    • SSDEEP

      12288:aEky5bwpy02iRaeXCP2CIcdoKAXMr+Mr+kJZ4:j02iRaeHPcdo18rTrf6

    • Black Basta

      A ransomware family targeting Windows and Linux ESXi first seen in February 2022.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks