blackbasta | b8463c09f968d938c4722febb7342f2e9babc2deba004f0945892ad297214b31

Sharing

Copy URL

Twitter E-mail

General

Target

b.zip
Size

446KB
Sample

241221-sqy8fssjhn
MD5

985b24da5760a2acb663944336ac96fa
SHA1

5750ff42866f4ebf885c4eba2d346e656c19b1d0
SHA256

b8463c09f968d938c4722febb7342f2e9babc2deba004f0945892ad297214b31
SHA512

b1c1248390de5c847033fe3b098bfe257c296add90ad0ec2d885ccc7545ee9799e0cbf6e48402b87d361070af1c71ee13c0e90900f2679f99c2ba17cd4ea7009
SSDEEP

12288:boutuJQIn872o78fwwHqo5C8nDDCLu/ou7I0ngv0Y:bhsJQo87QfUo5CkDOLr8bBY

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files\instructions_read_me.txt

Family

blackbasta

Ransom Note

ATTENTION! Your network has been breached and all data was encrypted. Please contact us at: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ Login ID: 3dd718a3-db04-485f-b882-250349c8a4de *!* To access .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) *!* To restore all your PCs and get your network working again, follow these instructions: - Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency. Please follow these simple rules to avoid data corruption: - Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. Waiting you in a chat.

URLs

https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/

Targets

- Target
  
  basta/basta.dll
- Size
  
  1023KB
- MD5
  
  08378cd36fdbf69dba24d14393ad564d
- SHA1
  
  c698e08ff114499e9fecf39fcbf23f652f1cdad8
- SHA256
  
  764b1117262d33f0a69b4f4c72fad607b7c71c262f60b9b2b35a21e7f4967786
- SHA512
  
  ef831fc12ad4831e180c9e5e9babbf1a2d8675a918992fc6f5306447b30e12de63e5034124e31a2d9517db4322e7aaf4a01cecf3239f2c6f6d459358849ef197
- SSDEEP
  
  12288:jbXTgrBCnMCz5WYgeWYg955/155/UqgFUHx2lvyRJbhLvTcT+sqnhDik2BBD+/rF:jbTgrBCnjzgsKrd7m4+OmMlaT2BZSP2
Score

10^/10

blackbasta ransomware spyware stealer
- Black Basta
  A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
  ransomware blackbasta
- Blackbasta family
  blackbasta
- Renames multiple (7968) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
behavioral1 behavioral2
- Target
  
  basta/blank.docx
- Size
  
  97KB
- MD5
  
  faef191f63aa34eaf62b309e1fa6797b
- SHA1
  
  f694595c850267b72ae7d78deb087badcaba1e9c
- SHA256
  
  23628968944a6db98842aa2b69d931edd4dd889ff51d345373624af62f71f5b7
- SHA512
  
  0bc5de66bdf619cd3a56916c0918d12ac1412e83b18d44db55b7593e4a29c9ff96f84b48b945b80ff50cfebd812a543be70e3298205bd46b9c6c8f8b1e01b617
- SSDEEP
  
  3:v:v
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  basta/blank2.docx
- Size
  
  97KB
- MD5
  
  faef191f63aa34eaf62b309e1fa6797b
- SHA1
  
  f694595c850267b72ae7d78deb087badcaba1e9c
- SHA256
  
  23628968944a6db98842aa2b69d931edd4dd889ff51d345373624af62f71f5b7
- SHA512
  
  0bc5de66bdf619cd3a56916c0918d12ac1412e83b18d44db55b7593e4a29c9ff96f84b48b945b80ff50cfebd812a543be70e3298205bd46b9c6c8f8b1e01b617
- SSDEEP
  
  3:v:v
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  
  basta/start.bat
- Size
  
  33B
- MD5
  
  34eee3ee267d4f5e0ec60e5ad8fac9e1
- SHA1
  
  d522e7e32849c1bc5e6f7665aa59e642f8fdcda0
- SHA256
  
  9eebdef38366ca977bf24574af2c996ccfb19ace6f317bf52c91aacaebe1a090
- SHA512
  
  6587491e3d725e8fad82ef3b9b915694cf54227d37d3be735f71a67c1710969c68ced5b9baf5cd877baf6d54312b386c077ed691ec769d4f74acb054a8967b93
Score

10^/10

blackbasta ransomware
- Black Basta
  A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
  ransomware blackbasta
- Blackbasta family
  blackbasta
- Renames multiple (1652) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
behavioral7 behavioral8

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Black Basta

Blackbasta family

Renames multiple (7968) files with added filename extension

Reads user/profile data of web browsers

Drops desktop.ini file(s)

Black Basta

Blackbasta family

Renames multiple (1652) files with added filename extension

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8