blackbasta | a6fbdbf8efe0ea129636bb5b3d6d6faec298272a2afded7e7516f2491844abc7

General

Target

a6fbdbf8efe0ea129636bb5b3d6d6faec298272a2afded7e7516f2491844abc7
Size

623KB
Sample

240528-n4r9vaca46
MD5

9dbd19323b253a9758195c8efa72f329
SHA1

1661ae91f105b6854ebfbaa47563fce45660cc79
SHA256

a6fbdbf8efe0ea129636bb5b3d6d6faec298272a2afded7e7516f2491844abc7
SHA512

2e34266b691a8041e525037ae67cf65142523c45f01b6da2008a50b452b9664697f86011cdb0daf0510cfea33bd786560bb2d147b06b00779f89199d32552e01
SSDEEP

12288:DIkz+rSP5VV3VG7rYyPT+p/VYXMJ8oD536bGIqs7GBvw0QygfmHH:DISj3IXYETQV1XD5VIZ7GOg1n

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files (x86)\instructions_read_me.txt

Family

blackbasta

Ransom Note

ATTENTION! Your network has been breached and all data was encrypted. Please contact us at: https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/ Login ID: ae31fac0-5ef2-4d58-8434-0c644b47d85c *!* To access .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) *!* To restore all your PCs and get your network working again, follow these instructions: - Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency. Please follow these simple rules to avoid data corruption: - Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. Waiting you in a chat.

URLs

https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/

Targets

- Target
  
  a6fbdbf8efe0ea129636bb5b3d6d6faec298272a2afded7e7516f2491844abc7
- Size
  
  623KB
- MD5
  
  9dbd19323b253a9758195c8efa72f329
- SHA1
  
  1661ae91f105b6854ebfbaa47563fce45660cc79
- SHA256
  
  a6fbdbf8efe0ea129636bb5b3d6d6faec298272a2afded7e7516f2491844abc7
- SHA512
  
  2e34266b691a8041e525037ae67cf65142523c45f01b6da2008a50b452b9664697f86011cdb0daf0510cfea33bd786560bb2d147b06b00779f89199d32552e01
- SSDEEP
  
  12288:DIkz+rSP5VV3VG7rYyPT+p/VYXMJ8oD536bGIqs7GBvw0QygfmHH:DISj3IXYETQV1XD5VIZ7GOg1n
Score

10^/10

defense_evasion execution impact ransomware blackbasta
- Black Basta
  A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
  ransomware blackbasta
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (3765) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
behavioral1 behavioral2