General
- Target ecea6b772742758a2240898ef772ca11aa9d870aec711cffab8994c23044117c
- Size 2.9MB
- Sample231207-psrdvaaf79
- SHA256 ecea6b772742758a2240898ef772ca11aa9d870aec711cffab8994c23044117c
Malware Config
Extracted
-
blackcat
-
enable_network_discovery
true
-
enable_self_propagation
true
-
enable_set_wallpaper
true
-
extension
kh1ftzx
-
note_file_name
RECOVER-${EXTENSION}-FILES.txt
-
note_full_text
>> What happened? Important files on your network was ENCRYPTED and now they have "${EXTENSION}" extension. In order to recover your files you need to follow instructions below. >> Sensitive Data Sensitive data on your system was DOWNLOADED. If you DON'T WANT your sensitive data to be PUBLISHED you have to act quickly. Data includes: - Employees personal data, CVs, DL, SSN. - Complete network map including credentials for local and remote services. - Private financial information including: clients data, bills, budgets, annual reports, bank statements. - Manufacturing documents including: datagrams, schemas, drawings in solidworks format - And more... >> CAUTION DO NOT MODIFY ENCRYPTED FILES YOURSELF. DO NOT USE THIRD PARTY SOFTWARE TO RESTORE YOUR DATA. YOU MAY DAMAGE YOUR FILES, IT WILL RESULT IN PERMANENT DATA LOSS. >> What should I do next? Follow these simple steps to get everything back to normal: 1) Download and install Tor Browser from: https://torproject.org/ 2) Navigate to: http://rfosusl6qdm4zhoqbqnjxaloprld2qz35u77h4aap46rhwkouejsooqd.onion/?access-key=${ACCESS_KEY}
Extracted
-
C:\RECOVER-kh1ftzx-FILES.txt
- >> What happened? Important files on your network was ENCRYPTED and now they have "kh1ftzx" extension. In order to recover your files you need to follow instructions below. >> Sensitive Data Sensitive data on your system was DOWNLOADED. If you DON'T WANT your sensitive data to be PUBLISHED you have to act quickly. Data includes: - Employees personal data, CVs, DL, SSN. - Complete network map including credentials for local and remote services. - Private financial information including: clients data, bills, budgets, annual reports, bank statements. - Manufacturing documents including: datagrams, schemas, drawings in solidworks format - And more... >> CAUTION DO NOT MODIFY ENCRYPTED FILES YOURSELF. DO NOT USE THIRD PARTY SOFTWARE TO RESTORE YOUR DATA. YOU MAY DAMAGE YOUR FILES, IT WILL RESULT IN PERMANENT DATA LOSS. >> What should I do next? Follow these simple steps to get everything back to normal: 1) Download and install Tor Browser from: https://torproject.org/ 2) Navigate to: http://rfosusl6qdm4zhoqbqnjxaloprld2qz35u77h4aap46rhwkouejsooqd.onion/?access-key=UxntJi70cnr%2FeZKl3a3X2vYPtySVfSv6QP0EyER8b4yxq%2BbelUrzG7lf9eA0zAbb9XijZH6xILkIlOCa2SSh5k0iJHaF4cyzH%2Bdea937n%2Bhf7mXqJtldjzbHmViGarJwFyCzryAHRKh4YT3ZizBoEYwINNLzQ%2FlZ37iZgbGVTrf1dp874fbBlSPkIDlPGFp4j2Sy8UCA%2Fg1QC3eRCIgENAwe%2FkPfNn5bVmSjQEMt%2By3scHfe8BPLrVSsq%2FYFm9CuxGhoKss5MeYRBZGaaXBu%2FjUj%2FzkS%2BOSygpefbm0BNUsTctNGiIVjBd0F%2B8xraLKmYSLJWgbNGi0FijgCHsZlrA%3D%3D
-
http://rfosusl6qdm4zhoqbqnjxaloprld2qz35u77h4aap46rhwkouejsooqd.onion/?access-key=UxntJi70cnr%2FeZKl3a3X2vYPtySVfSv6QP0EyER8b4yxq%2BbelUrzG7lf9eA0zAbb9XijZH6xILkIlOCa2SSh5k0iJHaF4cyzH%2Bdea937n%2Bhf7mXqJtldjzbHmViGarJwFyCzryAHRKh4YT3ZizBoEYwINNLzQ%2FlZ37iZgbGVTrf1dp874fbBlSPkIDlPGFp4j2Sy8UCA%2Fg1QC3eRCIgENAwe%2FkPfNn5bVmSjQEMt%2By3scHfe8BPLrVSsq%2FYFm9CuxGhoKss5MeYRBZGaaXBu%2FjUj%2FzkS%2BOSygpefbm0BNUsTctNGiIVjBd0F%2B8xraLKmYSLJWgbNGi0FijgCHsZlrA%3D%3D
Extracted
-
C:\RECOVER-kh1ftzx-FILES.txt
- >> What happened? Important files on your network was ENCRYPTED and now they have "kh1ftzx" extension. In order to recover your files you need to follow instructions below. >> Sensitive Data Sensitive data on your system was DOWNLOADED. If you DON'T WANT your sensitive data to be PUBLISHED you have to act quickly. Data includes: - Employees personal data, CVs, DL, SSN. - Complete network map including credentials for local and remote services. - Private financial information including: clients data, bills, budgets, annual reports, bank statements. - Manufacturing documents including: datagrams, schemas, drawings in solidworks format - And more... >> CAUTION DO NOT MODIFY ENCRYPTED FILES YOURSELF. DO NOT USE THIRD PARTY SOFTWARE TO RESTORE YOUR DATA. YOU MAY DAMAGE YOUR FILES, IT WILL RESULT IN PERMANENT DATA LOSS. >> What should I do next? Follow these simple steps to get everything back to normal: 1) Download and install Tor Browser from: https://torproject.org/ 2) Navigate to: http://rfosusl6qdm4zhoqbqnjxaloprld2qz35u77h4aap46rhwkouejsooqd.onion/?access-key=Sdzfi7%2Bwfijc5dMSoj2q1hqe%2FF0XHefoPXhE8zL1YQXlLb1TLxxYVAKEQS%2BWHI83jCQHbi9a%2BypynkRAp1ccN1G2Gc%2FV5o9okOkFgGaQ%2FdPbIK0oMFz2FyWXZ2Dw4DX2x2hqqYCZSfjGdctR1FmHd3x2oHW%2BquYMBUL4QTN%2BWhp6O2XzErgo7cFn4JalSv52d6rYvr7XR1ChHB%2B9mh6YD6%2FQoIg7Mqd7dsivTUi7rrJiJBKtmKR7xBNw%2B88Qso%2Bp6QrJbKQzjFi4Yqs4FJ0Sy%2B8CJG7F3RzZL0rOY9yVzqxmPStkvctP3K5KS%2FOZY5CpIa9IVbYek6NVdH5Jr2gkXg%3D%3D
-
http://rfosusl6qdm4zhoqbqnjxaloprld2qz35u77h4aap46rhwkouejsooqd.onion/?access-key=Sdzfi7%2Bwfijc5dMSoj2q1hqe%2FF0XHefoPXhE8zL1YQXlLb1TLxxYVAKEQS%2BWHI83jCQHbi9a%2BypynkRAp1ccN1G2Gc%2FV5o9okOkFgGaQ%2FdPbIK0oMFz2FyWXZ2Dw4DX2x2hqqYCZSfjGdctR1FmHd3x2oHW%2BquYMBUL4QTN%2BWhp6O2XzErgo7cFn4JalSv52d6rYvr7XR1ChHB%2B9mh6YD6%2FQoIg7Mqd7dsivTUi7rrJiJBKtmKR7xBNw%2B88Qso%2Bp6QrJbKQzjFi4Yqs4FJ0Sy%2B8CJG7F3RzZL0rOY9yVzqxmPStkvctP3K5KS%2FOZY5CpIa9IVbYek6NVdH5Jr2gkXg%3D%3D
Targets
-
- Target ecea6b772742758a2240898ef772ca11aa9d870aec711cffab8994c23044117c
- Size 2.9MB
- SHA256 ecea6b772742758a2240898ef772ca11aa9d870aec711cffab8994c23044117c
Score10/10-
BlackCat
A Rust-based ransomware sold as RaaS first seen in late 2021.
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Renames multiple (7455) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry