blackbasta | 1806b7cc24522509cab563bea8d1dc6c9c992c9d5c575836de3f363a7b10a8cc

General

Target

b.zip
Size

446KB
Sample

241221-sh76ds1rhk
MD5

9cefa111452fd3674d0d7e3e24ea076b
SHA1

c185f75dd1285e35ff59b2003ef855382d6a850f
SHA256

1806b7cc24522509cab563bea8d1dc6c9c992c9d5c575836de3f363a7b10a8cc
SHA512

b01413da6c974821b1365a264650f5daf6a6bddbf311df33c20b60fb654e6a33a070587edaa3e3f89d63ffaa14aa4ddb4b6c05ff8d2966df6561f7e4fef685ea
SSDEEP

12288:soutuJQIn872o78fwwHqo5C8nDDCLu/ou7I0ngv0q:shsJQo87QfUo5CkDOLr8bBq

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files\instructions_read_me.txt

Family

blackbasta

Ransom Note

ATTENTION! Your network has been breached and all data was encrypted. Please contact us at: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ Login ID: 3dd718a3-db04-485f-b882-250349c8a4de *!* To access .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) *!* To restore all your PCs and get your network working again, follow these instructions: - Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency. Please follow these simple rules to avoid data corruption: - Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. Waiting you in a chat.

URLs

https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/

Targets

- Target
  
  basta/basta.exe
- Size
  
  1023KB
- MD5
  
  08378cd36fdbf69dba24d14393ad564d
- SHA1
  
  c698e08ff114499e9fecf39fcbf23f652f1cdad8
- SHA256
  
  764b1117262d33f0a69b4f4c72fad607b7c71c262f60b9b2b35a21e7f4967786
- SHA512
  
  ef831fc12ad4831e180c9e5e9babbf1a2d8675a918992fc6f5306447b30e12de63e5034124e31a2d9517db4322e7aaf4a01cecf3239f2c6f6d459358849ef197
- SSDEEP
  
  12288:jbXTgrBCnMCz5WYgeWYg955/155/UqgFUHx2lvyRJbhLvTcT+sqnhDik2BBD+/rF:jbTgrBCnjzgsKrd7m4+OmMlaT2BZSP2
Score

10^/10

blackbasta discovery ransomware spyware stealer
- Black Basta
  A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
  ransomware blackbasta
- Blackbasta family
  blackbasta
- Renames multiple (9722) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
behavioral1 behavioral2
- Target
  
  basta/blank.docx
- Size
  
  97KB
- MD5
  
  faef191f63aa34eaf62b309e1fa6797b
- SHA1
  
  f694595c850267b72ae7d78deb087badcaba1e9c
- SHA256
  
  23628968944a6db98842aa2b69d931edd4dd889ff51d345373624af62f71f5b7
- SHA512
  
  0bc5de66bdf619cd3a56916c0918d12ac1412e83b18d44db55b7593e4a29c9ff96f84b48b945b80ff50cfebd812a543be70e3298205bd46b9c6c8f8b1e01b617
- SSDEEP
  
  3:v:v
Score

3^/10

discovery
behavioral3 behavioral4