blackbasta | 3090a37e591554d7406107df87b3dc21bda059df0bc66244e8abef6a5678af35

General

Target

3090a37e591554d7406107df87b3dc21bda059df0bc66244e8abef6a5678af35
Size

4.4MB
Sample

240514-fmf69abf41
MD5

4e8a7b03ff758f5c75ce992615a14fd0
SHA1

0110e12ae768872ea5c1b194dba50cbf74ec4d84
SHA256

3090a37e591554d7406107df87b3dc21bda059df0bc66244e8abef6a5678af35
SHA512

3fa53510e08ba1914f8cc6d34bb9c7fff544d23e365ca6e1d71d3bf022b0c3bc9bdc68cacc50a89af6744b2ba496fc0bc06e44a147f6ec8a44f446148330f3b9
SSDEEP

98304:1/rljWsSqkPe1hRa3Y1D6k8LFMF9aPfckJrLH+VFuIHQgFLOAkGkzdnEVomFHKnP:1BjOqjH+XMG0uIHQgFLOyomFHKnP

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files (x86)\instructions_read_me.txt

Family

blackbasta

Ransom Note

ATTENTION! Your network has been breached and all data was encrypted. Please contact us at: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ Login ID: f8ed7b93-0f13-4c24-aba9-4024b228551a *!* To access .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) *!* To restore all your PCs and get your network working again, follow these instructions: - Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency. Please follow these simple rules to avoid data corruption: - Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. Waiting you in a chat.

URLs

https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/

Targets

- Target
  
  3090a37e591554d7406107df87b3dc21bda059df0bc66244e8abef6a5678af35
- Size
  
  4.4MB
- MD5
  
  4e8a7b03ff758f5c75ce992615a14fd0
- SHA1
  
  0110e12ae768872ea5c1b194dba50cbf74ec4d84
- SHA256
  
  3090a37e591554d7406107df87b3dc21bda059df0bc66244e8abef6a5678af35
- SHA512
  
  3fa53510e08ba1914f8cc6d34bb9c7fff544d23e365ca6e1d71d3bf022b0c3bc9bdc68cacc50a89af6744b2ba496fc0bc06e44a147f6ec8a44f446148330f3b9
- SSDEEP
  
  98304:1/rljWsSqkPe1hRa3Y1D6k8LFMF9aPfckJrLH+VFuIHQgFLOAkGkzdnEVomFHKnP:1BjOqjH+XMG0uIHQgFLOyomFHKnP
Score

10^/10

defense_evasion execution impact persistence ransomware blackbasta spyware stealer
- Black Basta
  A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
  ransomware blackbasta
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2