blackbasta | 05ebae760340fe44362ab7c8f70b2d89d6c9ba9b9ee8a9f747b2f19d326c3431

General

Target

05ebae760340fe44362ab7c8f70b2d89d6c9ba9b9ee8a9f747b2f19d326c3431.dll
Size

800KB
Sample

241027-hj7adasnfm
MD5

f74cec233a9609461e7518dd4c90207b
SHA1

92408a8233567f8b10f30f83dfcdd98effe96dca
SHA256

05ebae760340fe44362ab7c8f70b2d89d6c9ba9b9ee8a9f747b2f19d326c3431
SHA512

231a0fd347933b31bbfbebebd274c4da40177360f35f295e5fa8384ad30ad11666221c39be28e56866e4b7254f9cbe3956368352ea7f4fe48e89427df7a6bcb4
SSDEEP

12288:z0LOFSM++OeO+OeNhBBhhBBhlJ2//R18nBIs0I3sHGzVylK7Nb0tq0mxHu84NeiB:zGOFSmKqEI3sHGzVylK7Nb0U1Hu8WK

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files\instructions_read_me.txt

Family

blackbasta

Ransom Note

ATTENTION! Your network has been breached and all data was encrypted. Please contact us at: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ Login ID: ab2bada7-004d-468c-8c25-a08517ea2fa0 *!* To access .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) *!* To restore all your PCs and get your network working again, follow these instructions: - Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency. Please follow these simple rules to avoid data corruption: - Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. Waiting you in a chat.

URLs

https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/

Targets

- Target
  
  05ebae760340fe44362ab7c8f70b2d89d6c9ba9b9ee8a9f747b2f19d326c3431.dll
- Size
  
  800KB
- MD5
  
  f74cec233a9609461e7518dd4c90207b
- SHA1
  
  92408a8233567f8b10f30f83dfcdd98effe96dca
- SHA256
  
  05ebae760340fe44362ab7c8f70b2d89d6c9ba9b9ee8a9f747b2f19d326c3431
- SHA512
  
  231a0fd347933b31bbfbebebd274c4da40177360f35f295e5fa8384ad30ad11666221c39be28e56866e4b7254f9cbe3956368352ea7f4fe48e89427df7a6bcb4
- SSDEEP
  
  12288:z0LOFSM++OeO+OeNhBBhhBBhlJ2//R18nBIs0I3sHGzVylK7Nb0tq0mxHu84NeiB:zGOFSmKqEI3sHGzVylK7Nb0U1Hu8WK
Score

10^/10

blackbasta discovery ransomware spyware stealer
- Black Basta
  A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
  ransomware blackbasta
- Blackbasta family
  blackbasta
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
behavioral1 behavioral2