blackbasta | 0a8297b274aeab986d6336b395b39b3af1bb00464cf5735d1ecdb506fef9098e

General

Target

0a8297b274aeab986d6336b395b39b3af1bb00464cf5735d1ecdb506fef9098e
Size

849KB
Sample

240514-fmb8ascb47
MD5

403dee0dd3891459b22a8a37828b66b8
SHA1

919c33adb648ce13ee8bd7c11bffbfd836936c00
SHA256

0a8297b274aeab986d6336b395b39b3af1bb00464cf5735d1ecdb506fef9098e
SHA512

8cab8ca9ff17c404d6e41358804daf0915713ad3e8e690457e2f9aab4014c894fd73e406aad8837ed8409be32315a4a0f3ef41795828d7447fde68c6fe9226f2
SSDEEP

24576:TdxKSvB4i4sSnMIsBadfBZz4kIsPP3q7uL+gB+UtcMT:Jvei4sSEad5Zz4kIsPP34uL+gB++cW

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files (x86)\instructions_read_me.txt

Family

blackbasta

Ransom Note

ATTENTION! Your network has been breached and all data was encrypted. Please contact us at: https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/ Login ID: 2943b2b6-dc20-44a7-9dc4-94f7cb67f695 *!* To access .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) *!* To restore all your PCs and get your network working again, follow these instructions: - Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency. Please follow these simple rules to avoid data corruption: - Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. Waiting you in a chat.

URLs

https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/

Targets

- Target
  
  0a8297b274aeab986d6336b395b39b3af1bb00464cf5735d1ecdb506fef9098e
- Size
  
  849KB
- MD5
  
  403dee0dd3891459b22a8a37828b66b8
- SHA1
  
  919c33adb648ce13ee8bd7c11bffbfd836936c00
- SHA256
  
  0a8297b274aeab986d6336b395b39b3af1bb00464cf5735d1ecdb506fef9098e
- SHA512
  
  8cab8ca9ff17c404d6e41358804daf0915713ad3e8e690457e2f9aab4014c894fd73e406aad8837ed8409be32315a4a0f3ef41795828d7447fde68c6fe9226f2
- SSDEEP
  
  24576:TdxKSvB4i4sSnMIsBadfBZz4kIsPP3q7uL+gB+UtcMT:Jvei4sSEad5Zz4kIsPP34uL+gB++cW
Score

10^/10

defense_evasion execution impact ransomware blackbasta spyware stealer
- Black Basta
  A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
  ransomware blackbasta
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (9479) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
behavioral1 behavioral2