blackbasta | 1806b7cc24522509cab563bea8d1dc6c9c992c9d5c575836de3f363a7b10a8cc

General

Target

b.zip
Size

446KB
Sample

241221-r6xtws1ngv
MD5

9cefa111452fd3674d0d7e3e24ea076b
SHA1

c185f75dd1285e35ff59b2003ef855382d6a850f
SHA256

1806b7cc24522509cab563bea8d1dc6c9c992c9d5c575836de3f363a7b10a8cc
SHA512

b01413da6c974821b1365a264650f5daf6a6bddbf311df33c20b60fb654e6a33a070587edaa3e3f89d63ffaa14aa4ddb4b6c05ff8d2966df6561f7e4fef685ea
SSDEEP

12288:soutuJQIn872o78fwwHqo5C8nDDCLu/ou7I0ngv0q:shsJQo87QfUo5CkDOLr8bBq

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files (x86)\instructions_read_me.txt

Family

blackbasta

Ransom Note

ATTENTION! Your network has been breached and all data was encrypted. Please contact us at: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ Login ID: 3dd718a3-db04-485f-b882-250349c8a4de *!* To access .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) *!* To restore all your PCs and get your network working again, follow these instructions: - Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency. Please follow these simple rules to avoid data corruption: - Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. Waiting you in a chat.

URLs

https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/

Targets

- Target
  
  b.zip
- Size
  
  446KB
- MD5
  
  9cefa111452fd3674d0d7e3e24ea076b
- SHA1
  
  c185f75dd1285e35ff59b2003ef855382d6a850f
- SHA256
  
  1806b7cc24522509cab563bea8d1dc6c9c992c9d5c575836de3f363a7b10a8cc
- SHA512
  
  b01413da6c974821b1365a264650f5daf6a6bddbf311df33c20b60fb654e6a33a070587edaa3e3f89d63ffaa14aa4ddb4b6c05ff8d2966df6561f7e4fef685ea
- SSDEEP
  
  12288:soutuJQIn872o78fwwHqo5C8nDDCLu/ou7I0ngv0q:shsJQo87QfUo5CkDOLr8bBq
Score

10^/10

blackbasta phishing ransomware
- Black Basta
  A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
  ransomware blackbasta
- Blackbasta family
  blackbasta
- Renames multiple (210) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- A potential corporate email address has been identified in the URL: [email protected]
  phishing
- Loads dropped DLL
behavioral1