blackbasta | 96baed262fd126604299b719bb1c5f44376149693c9d5c66f663b2ea693854cc

General

Target

96baed262fd126604299b719bb1c5f44376149693c9d5c66f663b2ea693854cc.bin.sample
Size

890KB
Sample

241218-n1bgxsxnhw
MD5

cbcdea93331bf90f7f2ca77ac98fe13c
SHA1

b9c7e3371dd668847d73c661a93ed28d046f0f75
SHA256

96baed262fd126604299b719bb1c5f44376149693c9d5c66f663b2ea693854cc
SHA512

519d9f5f0762bda56e3c5ff1330255038259af7a7d6b595448711ca408a26e5f9f1691729f1eca13f144cae730a59ba294efb34a1d142bc1de698326fc63773f
SSDEEP

24576:aPXdcPawe01sAN3BSWM0sdcOHgbLTB8/JYYaj:aK1sW3B6dcOHgbBgJYYaj

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files\instructions_read_me.txt

Family

blackbasta

Ransom Note

ATTENTION! Your network has been breached and all data was encrypted. Please contact us at: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ Login ID: f6c10067-1e5b-41fb-8e2e-1bccf55444af *!* To access .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) *!* To restore all your PCs and get your network working again, follow these instructions: - Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency. Please follow these simple rules to avoid data corruption: - Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. Waiting you in a chat.

URLs

https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/

Targets

- Target
  
  96baed262fd126604299b719bb1c5f44376149693c9d5c66f663b2ea693854cc.bin.sample
- Size
  
  890KB
- MD5
  
  cbcdea93331bf90f7f2ca77ac98fe13c
- SHA1
  
  b9c7e3371dd668847d73c661a93ed28d046f0f75
- SHA256
  
  96baed262fd126604299b719bb1c5f44376149693c9d5c66f663b2ea693854cc
- SHA512
  
  519d9f5f0762bda56e3c5ff1330255038259af7a7d6b595448711ca408a26e5f9f1691729f1eca13f144cae730a59ba294efb34a1d142bc1de698326fc63773f
- SSDEEP
  
  24576:aPXdcPawe01sAN3BSWM0sdcOHgbLTB8/JYYaj:aK1sW3B6dcOHgbBgJYYaj
Score

10^/10

blackbasta defense_evasion discovery execution impact persistence ransomware
- Black Basta
  A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
  ransomware blackbasta
- Blackbasta family
  blackbasta
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (4988) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Adds Run key to start application
  persistence
behavioral1 behavioral2