blackbasta | 2413841b2f5f656e269f61644d3957847b199107bb6b141c3208a03df59f0759

General

Target

2024-09-18_7c62976c8d0e7434b327ce3c402d8a62_magniber
Size

1.9MB
Sample

240918-v98mcavcqq
MD5

7c62976c8d0e7434b327ce3c402d8a62
SHA1

0d91b68c7b1a1fb5471258591676fcf89025e238
SHA256

2413841b2f5f656e269f61644d3957847b199107bb6b141c3208a03df59f0759
SHA512

51e43e3d863ff2f549699653c27bf4e08aaabe1d3853a3ed0b2a713ac627295646ef309906ecf1765d9372fc653891c31c87b6bd39676a59ec5b12876e38d58c
SSDEEP

49152:qfM4iMoQz20361ERIJ0UWGtT069FKdqd:qfM4RoQz20KVsG+akdqd

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files (x86)\instructions_read_me.txt

Family

blackbasta

Ransom Note

ATTENTION! Your network has been breached and all data was encrypted. Please contact us at: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ Login ID: a3ae86a9-08d9-49ca-8317-2f17622c44fd *!* To access .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) *!* To restore all your PCs and get your network working again, follow these instructions: - Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency. Please follow these simple rules to avoid data corruption: - Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. Waiting you in a chat.

URLs

https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/

Targets

- Target
  
  2024-09-18_7c62976c8d0e7434b327ce3c402d8a62_magniber
- Size
  
  1.9MB
- MD5
  
  7c62976c8d0e7434b327ce3c402d8a62
- SHA1
  
  0d91b68c7b1a1fb5471258591676fcf89025e238
- SHA256
  
  2413841b2f5f656e269f61644d3957847b199107bb6b141c3208a03df59f0759
- SHA512
  
  51e43e3d863ff2f549699653c27bf4e08aaabe1d3853a3ed0b2a713ac627295646ef309906ecf1765d9372fc653891c31c87b6bd39676a59ec5b12876e38d58c
- SSDEEP
  
  49152:qfM4iMoQz20361ERIJ0UWGtT069FKdqd:qfM4RoQz20KVsG+akdqd
Score

10^/10

discovery blackbasta defense_evasion execution impact persistence ransomware
- Black Basta
  A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
  ransomware blackbasta
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (4256) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Adds Run key to start application
  persistence
behavioral1 behavioral2